77 lines
1.9 KiB
YAML
77 lines
1.9 KiB
YAML
---
|
|
|
|
- name: Verify
|
|
hosts: all
|
|
gather_facts: false
|
|
any_errors_fatal: true
|
|
|
|
tasks:
|
|
- name: Gather service facts
|
|
ansible.builtin.service_facts:
|
|
|
|
- name: Ensure sshd is running
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_facts.services['ssh.service'].state == 'running'
|
|
|
|
- name: Ensure sshd_config syntax is OK
|
|
ansible.builtin.command: sshd -t -f /etc/ssh/sshd_config
|
|
changed_when: false
|
|
|
|
- name: Ensure main parameteres are applied
|
|
ansible.builtin.shell: |
|
|
set -o pipefail ;
|
|
sshd -T | egrep -i '
|
|
^protocol 2|
|
|
^permitrootlogin no|
|
|
^passwordauthentication no|
|
|
^pubkeyauthentication yes
|
|
'
|
|
args:
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
|
|
- name: Get sshd_config stats
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/sshd_config
|
|
register: sshd_conf
|
|
|
|
- name: Ensure sshd_config file is secure
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sshd_conf.stat.uid == 0
|
|
- sshd_conf.stat.gid == 0
|
|
- sshd_conf.stat.mode == '0600'
|
|
|
|
- name: Create test user
|
|
ansible.builtin.user:
|
|
name: test
|
|
create_home: true
|
|
shell: /bin/bash
|
|
|
|
- name: Create .ssh directory
|
|
ansible.builtin.file:
|
|
path: /home/test/.ssh/
|
|
state: directory
|
|
mode: '0700'
|
|
owner: test
|
|
group: test
|
|
|
|
- name: Generate ssh keys
|
|
community.crypto.openssh_keypair:
|
|
path: /home/test/.ssh/id_rsa
|
|
owner: test
|
|
group: test
|
|
mode: '0600'
|
|
register: sshd_key_result
|
|
|
|
- name: Put public key to test user
|
|
ansible.posix.authorized_key:
|
|
user: test
|
|
key: "{{ sshd_key_result.public_key }}"
|
|
state: present
|
|
|
|
- name: Test ssh connection
|
|
ansible.builtin.command: ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /home/test/.ssh/id_rsa test@localhost hostname
|
|
changed_when: false
|