blob: e638905b03a97abadbac88dbcc02a84f96f978e1 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
---
- name: install ssh-server
apt:
name: openssh-server
state: present
- name: hardening ssh-server config
lineinfile:
regexp: "^#?\\s*{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
dest: /etc/ssh/sshd_config
mode: 0644
with_dict:
IgnoreRhosts: "yes"
PermitRootLogin: "without-password"
PubkeyAuthentication: "yes"
HostbasedAuthentication: "no"
PermitEmptyPasswords: "no"
UseDNS: "no"
loop_control:
label: "{{ item.key }}"
notify: restart ssh
- name: limit allowed users
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^AllowUsers"
line: "AllowUsers {{ ' '.join([ 'root' ] | union(ssh_allowusers_group | default([])) | union(ssh_allowusers_host | default([]))) }}"
notify: restart ssh
- name: install ssh keys for root
authorized_key:
user: root
key: "{{ ssh_keys_root | join('\n') }}"
exclusive: yes
- name: delete root password
user:
name: root
password: "!"
|
