83 lines
2.8 KiB
YAML
83 lines
2.8 KiB
YAML
---
|
|
- name: Ensure OpenSSH server is installed
|
|
ansible.builtin.package:
|
|
name: openssh-server
|
|
state: present
|
|
|
|
- name: Ensure SSH daemon is enabled and running
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Backup current sshd_config
|
|
ansible.builtin.copy:
|
|
src: /etc/ssh/sshd_config
|
|
dest: /etc/ssh/sshd_config.bak
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
remote_src: true
|
|
|
|
- name: Harden SSH configuration
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ ssh_item.regexp }}"
|
|
line: "{{ ssh_item.line }}"
|
|
state: present
|
|
backrefs: yes
|
|
loop:
|
|
- regexp: "^#?Protocol"
|
|
line: "Protocol {{ ssh_protocol }}"
|
|
- regexp: "^#?PermitRootLogin"
|
|
line: "PermitRootLogin {{ ssh_permit_root_login }}"
|
|
- regexp: "^#?PasswordAuthentication"
|
|
line: "PasswordAuthentication {{ ssh_password_authentication }}"
|
|
- regexp: "^#?ChallengeResponseAuthentication"
|
|
line: "ChallengeResponseAuthentication {{ ssh_challenge_response_authentication }}"
|
|
- regexp: "^#?KerberosAuthentication"
|
|
line: "KerberosAuthentication {{ ssh_kerberos_authentication }}"
|
|
- regexp: "^#?GSSAPIAuthentication"
|
|
line: "GSSAPIAuthentication {{ ssh_gssapi_authentication }}"
|
|
- regexp: "^#?UsePAM"
|
|
line: "UsePAM {{ ssh_use_pam }}"
|
|
- regexp: "^#?X11Forwarding"
|
|
line: "X11Forwarding {{ ssh_x11_forwarding }}"
|
|
- regexp: "^#?AllowTcpForwarding"
|
|
line: "AllowTcpForwarding {{ ssh_allow_tcp_forwarding }}"
|
|
- regexp: "^#?PermitTunnel"
|
|
line: "PermitTunnel {{ ssh_permit_tunnel }}"
|
|
- regexp: "^#?AllowAgentForwarding"
|
|
line: "AllowAgentForwarding {{ ssh_allow_agent_forwarding }}"
|
|
- regexp: "^#?ClientAliveInterval"
|
|
line: "ClientAliveInterval {{ ssh_client_alive_interval }}"
|
|
- regexp: "^#?ClientAliveCountMax"
|
|
line: "ClientAliveCountMax {{ ssh_client_alive_count_max }}"
|
|
- regexp: "^#?LoginGraceTime"
|
|
line: "LoginGraceTime {{ ssh_login_grace_time }}"
|
|
- regexp: "^#?MaxAuthTries"
|
|
line: "MaxAuthTries {{ ssh_max_auth_tries }}"
|
|
- regexp: "^#?MaxSessions"
|
|
line: "MaxSessions {{ ssh_max_sessions }}"
|
|
- regexp: "^#?MaxStartups"
|
|
line: "MaxStartups {{ ssh_max_startups }}"
|
|
- regexp: "^#?Ciphers"
|
|
line: "Ciphers {{ ssh_ciphers }}"
|
|
- regexp: "^#?MACs"
|
|
line: "MACs {{ ssh_macs }}"
|
|
- regexp: "^#?KexAlgorithms"
|
|
line: "KexAlgorithms {{ ssh_kex_algorithms }}"
|
|
- regexp: "^#?PrintLastLog"
|
|
line: "PrintLastLog {{ PrintLastLog }}"
|
|
- regexp: '^\s*#?\s*AllowUsers'
|
|
line: "AllowUsers {{ ssh_allow_users }}"
|
|
- regexp: "^#?Banner"
|
|
line: "Banner /etc/issue.net"
|
|
loop_control:
|
|
loop_var: ssh_item
|
|
|
|
- name: Restart SSH service to apply changes
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: restarted
|