32 lines
1.6 KiB
YAML
32 lines
1.6 KiB
YAML
---
|
|
- name: "Authentication | Configure SSH authentication settings"
|
|
notify: Restart sshd
|
|
loop:
|
|
- { regexp: '^#?\s*PubkeyAuthentication\s+', line: 'PubkeyAuthentication yes' }
|
|
- { regexp: '^#?\s*PasswordAuthentication\s+', line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*PermitEmptyPasswords\s+', line: 'PermitEmptyPasswords no' }
|
|
- { regexp: '^#?\s*ChallengeResponseAuthentication\s+', line: 'ChallengeResponseAuthentication {{ sshd_challenge_response_auth | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*GSSAPIAuthentication\s+', line: 'GSSAPIAuthentication {{ sshd_gss_api_auth | ternary("yes", "no") }}' }
|
|
- {
|
|
regexp: '^#?\s*AuthenticationMethods\s+',
|
|
line: "{{ 'AuthenticationMethods publickey password' if sshd_password_auth else 'AuthenticationMethods publickey' }}"
|
|
}
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
|
|
- name: "Check if there is an SSH config forced by cloud-init"
|
|
register: sshd_cloud_init
|
|
ansible.builtin.stat:
|
|
path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
|
|
|
|
- name: "Authentication | override password authentication by cloud-init to '{{ sshd_password_auth | ternary('yes', 'no') }}'"
|
|
when: sshd_cloud_init.stat.exists
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/ssh/sshd_config.d/50-cloud-init.conf"
|
|
regexp: '^#?PasswordAuthentication'
|
|
line: 'PasswordAuthentication {{ sshd_password_auth | ternary("yes", "no") }}'
|