48 lines
2.1 KiB
YAML
48 lines
2.1 KiB
YAML
---
|
|
- name: "Restrictions | Configure SSH security restrictions"
|
|
loop:
|
|
- { regexp: '^#?Protocol\s+', line: 'Protocol 2' }
|
|
- { regexp: '^#?\s*PermitRootLogin\s+', line: 'PermitRootLogin no' }
|
|
- { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
|
|
- { regexp: '^#?IgnoreRhosts', line: 'IgnoreRhosts yes' }
|
|
- { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
|
|
- { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
|
|
- { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' }
|
|
- { regexp: '^#?\s*AllowAgentForwarding\s+', line: 'AllowAgentForwarding {{ sshd_allow_agent_forwarding | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*AllowTcpForwarding\s+', line: 'AllowTcpForwarding {{ sshd_allow_tcp_forwarding | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*GatewayPorts\s+', line: 'GatewayPorts {{ sshd_gateway_ports | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*PermitTunnel\s+', line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no") }}' }
|
|
- { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' }
|
|
- { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' }
|
|
notify: "Restart ssh"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "{{ item.regexp }}"
|
|
line: "{{ item.line }}"
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
|
|
- name: "Restrictions | disable Debian banner"
|
|
when: "ansible_os_family == 'Debian'"
|
|
notify: "Restart ssh"
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?DebianBanner\s+'
|
|
line: "DebianBanner no"
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
|
|
- name: "Restrictions | toggle PAM"
|
|
notify: Restart sshd
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^#?UsePAM'
|
|
line: "UsePAM {{ sshd_disable_pam | ternary('no', 'yes') }}"
|
|
validate: sshd -f %s -t
|
|
|
|
- name: "Restrictions | ensure the SSHD config is restricted to the root user"
|
|
notify: Restart sshd
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|