43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
---
|
|
# next task requires this directory to exist for sshd -t flag
|
|
- name: Ensure /run/sshd exists
|
|
ansible.builtin.file:
|
|
path: /run/sshd
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
# NOTE: order of preference for openssh-server ed25519 -> rsa
|
|
- name: "Algorithms | enable ed25519 authentication algorithm"
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^HostKey /etc/ssh/ssh_host_ed25519_key'
|
|
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
|
|
validate: sshd -f %s -t
|
|
|
|
- name: "Algorithms | enable the RSA authentication algorithm"
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^HostKey /etc/ssh/ssh_host_rsa_key'
|
|
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
|
|
validate: sshd -f %s -t
|
|
|
|
- name: "Algorithms | disable the ECDSA algorithm (deemed to be less safe)"
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key'
|
|
state: absent
|
|
validate: sshd -f %s -t
|
|
|
|
- name: "Algorithms | disable the DSA algorithm (considered to be defunct)"
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^HostKey /etc/ssh/ssh_host_dsa_key'
|
|
state: absent
|
|
validate: sshd -f %s -t
|