blob: 88ecf64a3ebe1b4b534162a2ffacb4d21d6d70f0 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
---
- name: load os/distrubtion/version specific variables
include_vars: "{{ item }}"
with_first_found:
- files:
- "{{ ansible_distribution_release }}.yml"
- "{{ ansible_distribution }}.yml"
- "{{ ansible_os_family }}.yml"
- name: hardening ssh-server config
vars:
sshd_options:
IgnoreRhosts: "yes"
PermitRootLogin: "without-password"
PubkeyAuthentication: "yes"
HostbasedAuthentication: "no"
PermitEmptyPasswords: "no"
UseDNS: "no"
loop: "{{ sshd_options | dict2items }}"
loop_control:
label: "{{ item.key }} = {{ item.value }}"
lineinfile:
regexp: "^#?\\s*{{ item.key }}\\s"
line: "{{ item.key }} {{ item.value }}"
dest: /etc/ssh/sshd_config
mode: 0644
notify: restart ssh
- name: limit allowed users
when: not sshd_allow_any_user | bool
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^AllowUsers\\s"
line: "AllowUsers {{ ' '.join([ 'root' ] | union(sshd_allowusers_group) | union(sshd_allowusers_host)) }}"
notify: restart ssh
- name: allow any user
when: sshd_allow_any_user | bool
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^AllowUsers\\s"
state: absent
notify: restart ssh
- name: install ssh keys for root
authorized_key:
user: root
key: "{{ ssh_keys_root | union(ssh_keys_root_extra) | join('\n') }}"
exclusive: yes
- name: delete root password
when: sshd_disabled_password is defined
user:
name: root
password: "{{ sshd_disabled_password }}"
|
