blob: 5eb15081d634b9f2a8636003e2d3b7a28738e11a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
---
- name: load os/distrubtion/version specific variables
include_vars: "{{ item }}"
with_first_found:
- files:
- "{{ ansible_distribution_release }}.yml"
- "{{ ansible_distribution }}.yml"
- "{{ ansible_os_family }}.yml"
- name: hardening ssh-server config
vars:
sshd_options:
IgnoreRhosts: "yes"
PermitRootLogin: "without-password"
PubkeyAuthentication: "yes"
HostbasedAuthentication: "no"
PermitEmptyPasswords: "no"
UseDNS: "no"
loop: "{{ sshd_options | dict2items }}"
loop_control:
label: "{{ item.key }} = {{ item.value }}"
lineinfile:
regexp: "^#?\\s*{{ item.key }}\\s"
line: "{{ item.key }} {{ item.value }}"
dest: /etc/ssh/sshd_config
mode: 0644
notify: restart ssh
- name: limit allowed users
when: not ssh_allow_any_user
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^AllowUsers\\s"
line: "AllowUsers {{ ' '.join([ 'root' ] | union(ssh_allowusers_group | default([])) | union(ssh_allowusers_host | default([]))) }}"
notify: restart ssh
- name: allow any user
when: ssh_allow_any_user
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^AllowUsers\\s"
state: absent
notify: restart ssh
- name: install ssh keys for root
authorized_key:
user: root
key: "{{ ssh_keys_root | join('\n') }}"
exclusive: yes
- name: delete root password
when: sshd_disabled_password is defined
user:
name: root
password: "{{ sshd_disabled_password }}"
|
