chris
81398e847e
- Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity. - Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems. - Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation. - Removed unnecessary comments and whitespace to enhance readability. - Ensured that conditions and loops are consistently formatted across all tasks.
155 lines
4.5 KiB
YAML
155 lines
4.5 KiB
YAML
---
|
|
# ---
|
|
# Set some facts
|
|
# ---
|
|
|
|
- name: (sshd.yml) Set fact_sshd_pubkey_accepted_algorithms (comma separated list)
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_pubkey_accepted_algorithms: "{{ sshd_pubkey_accepted_algorithms | join(',') }}"
|
|
when:
|
|
- sshd_pubkey_accepted_algorithms is defined and sshd_pubkey_accepted_algorithms | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Set fact_sshd_kexalgorithms (comma separated list)
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_kexalgorithms: "{{ sshd_kexalgorithms | join(',') }}"
|
|
when:
|
|
- sshd_kexalgorithms is defined and sshd_kexalgorithms | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Set fact_sshd_ciphers (comma separated list)
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_ciphers: "{{ sshd_ciphers | join(',') }}"
|
|
when:
|
|
- sshd_ciphers is defined and sshd_ciphers | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Set fact_sshd_macs
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_macs: "{{ sshd_macs | join(',') }}"
|
|
when:
|
|
- sshd_macs is defined and sshd_macs | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Set fact_sshd_hostkeyalgorithms (blank separated list)
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_hostkeyalgorithms: "{{ sshd_hostkeyalgorithms | join(',') }}"
|
|
when:
|
|
- sshd_hostkeyalgorithms is defined and sshd_hostkeyalgorithms | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Set fact_sshd_allowed_users (blank separated list)
|
|
ansible.builtin.set_fact:
|
|
fact_sshd_allowed_users: "{{ sshd_allowed_users | join(' ') }}"
|
|
when:
|
|
- sshd_allowed_users is defined and sshd_allowed_users | length > 0
|
|
tags:
|
|
- sshd-config
|
|
|
|
# ---
|
|
# Create new sshd_config
|
|
# ---
|
|
|
|
- name: (sshd.yml) Check file '/etc/ssh/sshd_config.ORIG' exists
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/sshd_config.ORIG
|
|
register: etc_sshd_sshd_config_ORIG
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Backup installation version of file '/etc/ssh/sshd_config'
|
|
ansible.builtin.command: cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.ORIG
|
|
when: etc_sshd_sshd_config_ORIG.stat.exists == False
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Create new sshd_config from template sshd_config.j2
|
|
ansible.builtin.template:
|
|
src: etc/ssh/sshd_config.j2
|
|
dest: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "sshd -f %s -T"
|
|
#backup: yes
|
|
notify: "Restart ssh"
|
|
when:
|
|
- ansible_facts['distribution'] == "Ubuntu"
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Create/Update new sshd_config from template sshd_config.j2
|
|
ansible.builtin.template:
|
|
src: etc/ssh/sshd_config.j2
|
|
dest: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "sshd -f %s -T"
|
|
notify: "Restart ssh"
|
|
when:
|
|
- create_sftp_group is undefined or create_sftp_group is defined and not create_sftp_group
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] <= "10"
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Create/Update sshd_config for chrooted sftp_group from template sshd_config.j2
|
|
ansible.builtin.template:
|
|
src: etc/ssh/sshd_config.j2
|
|
dest: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
validate: "sshd -f %s -T -C user=sftp_users"
|
|
notify: "Restart ssh"
|
|
when:
|
|
- create_sftp_group is defined and create_sftp_group
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] <= "10"
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Check if sshd_config contains activ parameter 'Subsystem sftp'..
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^Subsystem\\s+sftp(.+)$"
|
|
state: absent
|
|
check_mode: true
|
|
changed_when: false
|
|
register: sshd_config_sftp
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/sshd_config.d
|
|
state: directory
|
|
mode: "0755"
|
|
group: root
|
|
owner: root
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] > "10"
|
|
tags:
|
|
- sshd-config
|
|
|
|
- name: (sshd.yml) Create/Update file '/etc/ssh/sshd_config.d/50-sshd-local.conf' from template sshd_config.j2
|
|
ansible.builtin.template:
|
|
src: etc/ssh/sshd_config.j2
|
|
dest: /etc/ssh/sshd_config.d/50-sshd-local.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: "Restart ssh"
|
|
when:
|
|
- ansible_facts['distribution'] == "Debian"
|
|
- ansible_facts['distribution_major_version'] > "10"
|
|
tags:
|
|
- sshd-config
|