45 lines
1.1 KiB
YAML
45 lines
1.1 KiB
YAML
---
|
|
|
|
- name: Verify
|
|
hosts: all
|
|
gather_facts: false
|
|
any_errors_fatal: true
|
|
|
|
tasks:
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Ensure sshd is running
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.services['ssh.service'].state == 'running'
|
|
|
|
- name: Ensure sshd_config syntax is OK
|
|
ansible.builtin.command: sshd -t -f /etc/ssh/sshd_config
|
|
changed_when: false
|
|
|
|
- name: Ensure main parameteres are applied
|
|
ansible.builtin.shell: |
|
|
set -o pipefail ;
|
|
sshd -T | egrep -i '
|
|
^protocol 2|
|
|
^permitrootlogin no|
|
|
^passwordauthentication no|
|
|
^pubkeyauthentication yes
|
|
'
|
|
args:
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
|
|
- name: Get sshd_config stats
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/sshd_config
|
|
register: sshd_conf
|
|
|
|
- name: Ensure sshd_config file is secure
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sshd_conf.stat.uid == 0
|
|
- sshd_conf.stat.gid == 0
|
|
- sshd_conf.stat.mode == '0600'
|