35 lines
1.8 KiB
YAML
35 lines
1.8 KiB
YAML
---
|
|
- name: "Authentication | configure SSH authentication settings"
|
|
notify: "Restart ssh"
|
|
loop:
|
|
- { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
|
|
- { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*PermitEmptyPasswords\s+', line: 'PermitEmptyPasswords no' }
|
|
- { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ sshd_challenge_response_auth | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ sshd_gss_api_auth | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?IgnoreRhosts', line: 'IgnoreRhosts yes' }
|
|
- { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
|
|
- { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
|
|
- {
|
|
regexp: '^#?\s*AuthenticationMethods\s+',
|
|
line: "{{ 'AuthenticationMethods publickey password' if sshd_password_auth else 'AuthenticationMethods publickey' }}"
|
|
}
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
|
|
- name: "Authentication | check if there is an SSH config forced by cloud-init"
|
|
register: sshd_cloud_init
|
|
ansible.builtin.stat:
|
|
path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
|
|
|
|
- name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'"
|
|
when: sshd_cloud_init.stat.exists
|
|
notify: "Restart ssh"
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
|
|
regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}'
|