krincap/gitlab-mirror
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use full path in config validation consistently

Browse Source
This commit is contained in:
Alexander Gorelyshev
2026-06-08 14:15:09 +04:00
parent 37222f515e
commit b246eae017
4 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
roles/sshd/tasks/algorithms.yml
View File

@@ -15,7 +15,7 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key' regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key'
line: 'HostKey /etc/ssh/ssh_host_ed25519_key' line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s
- name: "Algorithms | enable the RSA authentication algorithm" - name: "Algorithms | enable the RSA authentication algorithm"
notify: "Restart ssh" notify: "Restart ssh"
@@ -23,7 +23,7 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^HostKey /etc/ssh/ssh_host_rsa_key' regexp: '^HostKey /etc/ssh/ssh_host_rsa_key'
line: 'HostKey /etc/ssh/ssh_host_rsa_key' line: 'HostKey /etc/ssh/ssh_host_rsa_key'
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s
- name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)" - name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)"
notify: "Restart ssh" notify: "Restart ssh"
@@ -31,7 +31,7 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key' regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key'
state: absent state: absent
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s
- name: "Algorithms | disable the DSA algorithm (considered to be defunct)" - name: "Algorithms | disable the DSA algorithm (considered to be defunct)"
notify: "Restart ssh" notify: "Restart ssh"
@@ -39,4 +39,4 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^HostKey /etc/ssh/ssh_host_dsa_key' regexp: '^HostKey /etc/ssh/ssh_host_dsa_key'
state: absent state: absent
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s

2
roles/sshd/tasks/main.yml
View File

@@ -23,4 +23,4 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^#?LogLevel' regexp: '^#?LogLevel'
line: 'LogLevel VERBOSE' line: 'LogLevel VERBOSE'
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s

2
roles/sshd/tasks/restrictions.yml
View File

@@ -36,7 +36,7 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^#?UsePAM' regexp: '^#?UsePAM'
line: "UsePAM {{ sshd_disable_pam | ternary('no', 'yes') }}" line: "UsePAM {{ sshd_disable_pam | ternary('no', 'yes') }}"
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s
- name: "Restrictions | ensure the SSHD config is restricted to the root user" - name: "Restrictions | ensure the SSHD config is restricted to the root user"
notify: "Restart ssh" notify: "Restart ssh"

4
roles/sshd/tasks/whitelists.yml
View File

@@ -6,7 +6,7 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^#?\s*AllowUsers\s+' regexp: '^#?\s*AllowUsers\s+'
line: "AllowUsers {{ sshd_allow_users }}" line: "AllowUsers {{ sshd_allow_users }}"
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s
- name: "Configure AllowGroups" - name: "Configure AllowGroups"
when: sshd_allow_groups is defined when: sshd_allow_groups is defined
@@ -15,4 +15,4 @@
path: /etc/ssh/sshd_config path: /etc/ssh/sshd_config
regexp: '^#?\s*AllowGroups\s+' regexp: '^#?\s*AllowGroups\s+'
line: "AllowGroups {{ sshd_allow_groups }}" line: "AllowGroups {{ sshd_allow_groups }}"
validate: sshd -f %s -t validate: /usr/sbin/sshd -t -f %s