88 lines
2.5 KiB
YAML
88 lines
2.5 KiB
YAML
---
|
|
|
|
- name: Verify
|
|
hosts: all
|
|
gather_facts: false
|
|
any_errors_fatal: true
|
|
|
|
pre_tasks:
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Set up users and keys for testing
|
|
loop:
|
|
- testusr
|
|
- testusr_notallowed
|
|
loop_control:
|
|
loop_var: username
|
|
ansible.builtin.include_tasks: mkuser.yml
|
|
|
|
tasks:
|
|
- name: Ensure sshd is running
|
|
vars:
|
|
sshd_state: "{{ ansible_facts.services['ssh.service'].state | default('unknown') }}"
|
|
ansible.builtin.assert:
|
|
that: sshd_state == 'running'
|
|
success_msg: "OK, sshd state: '{{ sshd_state }}'"
|
|
fail_msg: "FAIL, sshd state: '{{ sshd_state }}'"
|
|
|
|
- name: Ensure sshd_config syntax is OK
|
|
changed_when: false
|
|
ansible.builtin.command:
|
|
cmd: sshd -t -f /etc/ssh/sshd_config
|
|
|
|
- name: Ensure main parameteres are applied
|
|
args:
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
ansible.builtin.shell: |
|
|
set -o pipefail ;
|
|
sshd -T | egrep -i '
|
|
^protocol 2|
|
|
^permitrootlogin no|
|
|
^passwordauthentication no|
|
|
^pubkeyauthentication yes
|
|
'
|
|
|
|
- name: Get sshd_config stats
|
|
register: sshd_conf
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/sshd_config
|
|
|
|
- name: Ensure sshd_config file is secure
|
|
vars:
|
|
uid: "{{ sshd_conf.stat.uid }}"
|
|
gid: "{{ sshd_conf.stat.gid }}"
|
|
mode: "{{ sshd_conf.stat.mode }}"
|
|
ansible.builtin.assert:
|
|
that:
|
|
- uid == '0'
|
|
- gid == '0'
|
|
- mode == '0600'
|
|
success_msg: "OK, sshd_config file uid: '{{ uid }}', gid: '{{ gid }}', mode: '{{ mode }}'"
|
|
fail_msg: "FAIL, sshd_config file uid: '{{ uid }}', gid: '{{ gid }}', mode: '{{ mode }}'"
|
|
|
|
- name: Test ssh connection with an allowed user
|
|
changed_when: false
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
ssh
|
|
-o StrictHostKeyChecking=no
|
|
-o UserKnownHostsFile=/dev/null
|
|
-i /home/testusr/.ssh/id_rsa
|
|
testusr@localhost
|
|
hostname
|
|
|
|
- name: Test ssh connection with a disallowed user
|
|
register: sshd_verify_conn_result
|
|
changed_when: false
|
|
failed_when: sshd_verify_conn_result.rc == 0
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
ssh
|
|
-o StrictHostKeyChecking=no
|
|
-o UserKnownHostsFile=/dev/null
|
|
-i /home/testusrnotallowed/.ssh/id_rsa
|
|
testusrnotallowed@localhost
|
|
hostname
|