sshd config working
This commit is contained in:
+1
-1
@@ -1,3 +1,3 @@
|
||||
ansible_become_method: ansible.builtin.sudo
|
||||
ansible_sudo_pass: "{{ lookup('community.general.passwordstore', ('ansible/become-passwords/' + ansible_ssh_host)) }}"
|
||||
ansible_sudo_user: root
|
||||
ansible_sudo_pass: "{{ lookup('community.general.passwordstore', 'ansible/become-password') }}"
|
||||
@@ -0,0 +1,3 @@
|
||||
ansible_connection: ansible.builtin.ssh
|
||||
ansible_ssh_port: 22
|
||||
ansible_ssh_user: ladmin
|
||||
@@ -1,4 +1 @@
|
||||
ansible_connection: ansible.builtin.ssh
|
||||
ansible_ssh_host: ch01.balsillie.house
|
||||
ansible_ssh_port: 22
|
||||
ansible_ssh_user: ladmin
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: ch02.balsillie.house
|
||||
@@ -0,0 +1 @@
|
||||
ansible_ssh_host: dl01.balsillie.house
|
||||
@@ -1,8 +1,16 @@
|
||||
all:
|
||||
children:
|
||||
archlinux_servers:
|
||||
children:
|
||||
container_hosts:
|
||||
download_clients:
|
||||
container_hosts:
|
||||
hosts:
|
||||
ch01.balsillie.house:
|
||||
ch02.balsillie.house:
|
||||
download_clients:
|
||||
hosts:
|
||||
dl01.balsillie.house:
|
||||
firewalls:
|
||||
hosts:
|
||||
firewall.balsillie.house:
|
||||
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
|
||||
- name: Configure ssh and firewall
|
||||
hosts:
|
||||
- archlinux_servers
|
||||
gather_facts: false
|
||||
become: true
|
||||
pre_tasks:
|
||||
|
||||
- name: Set IP facts
|
||||
become: false
|
||||
ansible.builtin.set_fact:
|
||||
ipv4_address: "{{ query('community.dns.lookup', inventory_hostname, type='A', nxdomain_handling = 'fail') | first }}"
|
||||
ipv6_address: "{{ query('community.dns.lookup', inventory_hostname, type='AAAA', nxdomain_handling = 'fail') | first }}"
|
||||
|
||||
- name: Install basic utilities
|
||||
community.general.pacman:
|
||||
name:
|
||||
- nano
|
||||
- curl
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
roles:
|
||||
- sshd
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
|
||||
- name: Configure container hosts
|
||||
hosts:
|
||||
- ch01.balsillie.house
|
||||
gather_facts: false
|
||||
tasks:
|
||||
|
||||
- name: Ping
|
||||
become: true
|
||||
ansible.builtin.ping:
|
||||
data: "pong"
|
||||
@@ -0,0 +1,3 @@
|
||||
[Unit]
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
@@ -0,0 +1,14 @@
|
||||
#code: language=ansible
|
||||
|
||||
- name: Restart sshd
|
||||
ansible.builtin.systemd_service:
|
||||
daemon_reload: true
|
||||
name: sshd.service
|
||||
scope: system
|
||||
state: restarted
|
||||
|
||||
- name: Restart systemd-networkd
|
||||
ansible.builtin.systemd_service:
|
||||
name: systemd-networkd.service
|
||||
scope: system
|
||||
state: restarted
|
||||
@@ -0,0 +1,135 @@
|
||||
#code: language=ansible
|
||||
|
||||
- name: Disable link local addressing
|
||||
ansible.builtin.lineinfile:
|
||||
backrefs: false
|
||||
backup: true
|
||||
create: false
|
||||
encoding: "utf-8"
|
||||
firstmatch: true
|
||||
group: root
|
||||
insertafter: '^\[Network\]\s*$'
|
||||
line: "LinkLocalAddressing=no"
|
||||
mode: "0664"
|
||||
owner: root
|
||||
path: "/etc/systemd/network/10-cloud-init-eth0.network"
|
||||
regexp: '^LinkLocalAddressing\s*=.*$'
|
||||
state: present
|
||||
notify:
|
||||
- Restart systemd-networkd
|
||||
|
||||
- name: Set link wait-online requirements
|
||||
ansible.builtin.blockinfile:
|
||||
append_newline: true
|
||||
backup: true
|
||||
block: |
|
||||
[Link]
|
||||
ActivationPolicy=always-up
|
||||
RequiredForOnline=yes
|
||||
RequiredFamilyForOnline=both
|
||||
create: false
|
||||
group: root
|
||||
insertbefore: '^\[Network\]\s*$'
|
||||
mode: "0664"
|
||||
owner: root
|
||||
path: "/etc/systemd/network/10-cloud-init-eth0.network"
|
||||
prepend_newline: true
|
||||
state: present
|
||||
|
||||
- name: Disable global systemd-networkd-wait-online
|
||||
ansible.builtin.systemd_service:
|
||||
enabled: false
|
||||
name: systemd-networkd-wait-online.service
|
||||
scope: system
|
||||
state: stopped
|
||||
|
||||
- name: Enable instantiated systemd-networkd-wait-online
|
||||
ansible.builtin.systemd_service:
|
||||
enabled: true
|
||||
name: systemd-networkd-wait-online@eth0.service
|
||||
scope: system
|
||||
state: started
|
||||
|
||||
- name: Create sshd.service override directory
|
||||
ansible.builtin.file:
|
||||
group: root
|
||||
mode: "0775"
|
||||
owner: root
|
||||
path: /etc/systemd/system/sshd.service.d
|
||||
state: directory
|
||||
|
||||
- name: Create sshd.service override config
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/system/sshd.service.d/sshd_override.conf
|
||||
group: root
|
||||
mode: "0664"
|
||||
owner: root
|
||||
remote_src: false
|
||||
src: "{{ role_path }}/files/sshd_override.conf"
|
||||
notify:
|
||||
- Restart sshd
|
||||
|
||||
- name: Configure sshd_config
|
||||
ansible.builtin.lineinfile:
|
||||
backrefs: false
|
||||
create: true
|
||||
encoding: "utf-8"
|
||||
firstmatch: false
|
||||
group: root
|
||||
line: "{{ item.line }}"
|
||||
mode: "0664"
|
||||
owner: root
|
||||
path: "/etc/ssh/sshd_config"
|
||||
regexp: "{{ item.pattern }}"
|
||||
state: present
|
||||
loop: "{{ sshd_config_lines }}"
|
||||
loop_control:
|
||||
label: "{{ item.label }}"
|
||||
notify:
|
||||
- Restart sshd
|
||||
|
||||
- name: Install UFW
|
||||
community.general.pacman:
|
||||
name:
|
||||
- ufw
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Configure UFW IPv4 rules
|
||||
community.general.ufw:
|
||||
comment: "{{ item.comment }}"
|
||||
direction: "in"
|
||||
from_ip: "{{ item.source }}"
|
||||
log: true
|
||||
proto: tcp
|
||||
rule: "allow"
|
||||
to_ip: "{{ ipv4_address }}"
|
||||
to_port: "22"
|
||||
loop: "{{ sshd_ufw_ipv4_rules }}"
|
||||
loop_control:
|
||||
label: "{{ item.comment }}"
|
||||
|
||||
- name: Configure UFW IPv6 rules
|
||||
community.general.ufw:
|
||||
comment: "{{ item.comment }}"
|
||||
direction: "in"
|
||||
from_ip: "{{ item.source }}"
|
||||
log: true
|
||||
proto: tcp
|
||||
rule: "allow"
|
||||
to_ip: "{{ ipv6_address }}"
|
||||
to_port: "22"
|
||||
loop: "{{ sshd_ufw_ipv6_rules }}"
|
||||
loop_control:
|
||||
label: "{{ item.comment }}"
|
||||
|
||||
- name: Enable UFW
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
|
||||
- name: Enable and start UFW service
|
||||
ansible.builtin.systemd_service:
|
||||
enabled: true
|
||||
name: ufw.service
|
||||
scope: system
|
||||
state: started
|
||||
@@ -0,0 +1,58 @@
|
||||
#code: language=ansible
|
||||
|
||||
sshd_port: 22
|
||||
|
||||
sshd_config_lines:
|
||||
- label: PubkeyAuthentication
|
||||
pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
|
||||
line: 'PubkeyAuthentication yes'
|
||||
- label: HostbasedAuthentication
|
||||
pattern: '^\s*#*\s*HostbasedAuthentication\s*(yes|no)$'
|
||||
line: 'HostbasedAuthentication no'
|
||||
- label: IgnoreUserKnownHosts
|
||||
pattern: '^\s*#*\s*IgnoreUserKnownHosts\s*(yes|no)$'
|
||||
line: 'IgnoreUserKnownHosts no'
|
||||
- label: PasswordAuthentication
|
||||
pattern: '^\s*#*\s*PasswordAuthentication\s*(yes|no)$'
|
||||
line: 'PasswordAuthentication no'
|
||||
- label: KbdInteractiveAuthentication
|
||||
pattern: '^\s*#*\s*KbdInteractiveAuthentication\s*(yes|no)$'
|
||||
line: 'KbdInteractiveAuthentication no'
|
||||
- label: KerberosAuthentication
|
||||
pattern: '^\s*#*\s*KerberosAuthentication\s*(yes|no)$'
|
||||
line: 'KerberosAuthentication no'
|
||||
- label: GSSAPIAuthentication
|
||||
pattern: '^\s*#*\s*GSSAPIAuthentication\s*(yes|no)$'
|
||||
line: 'GSSAPIAuthentication no'
|
||||
- label: UsePAM
|
||||
pattern: '^\s*#*\s*UsePAM\s*(yes|no)$'
|
||||
line: 'UsePAM yes'
|
||||
- label: PermitRootLogin
|
||||
pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
|
||||
line: 'PermitRootLogin prohibit-password'
|
||||
- label: AddressFamily
|
||||
pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
|
||||
line: 'AddressFamily any'
|
||||
- label: ListenAddress (IPv4)
|
||||
pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
|
||||
line: "ListenAddress {{ ipv4_address }}"
|
||||
- label: ListenAddress (IPv6)
|
||||
pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address}})$"
|
||||
line: "ListenAddress {{ ipv6_address }}"
|
||||
- label: Port
|
||||
pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
|
||||
line: "Port {{ sshd_port }}"
|
||||
|
||||
sshd_ufw_ipv4_rules:
|
||||
- comment: SSH Clients v4
|
||||
source: 10.96.30.0/24
|
||||
- comment: SSH Servers v4
|
||||
source: 10.96.10.0/24
|
||||
- comment: SSH VPN v4
|
||||
source: 192.168.200.0/24
|
||||
|
||||
sshd_ufw_ipv6_rules:
|
||||
- comment: "SSH Clients v6"
|
||||
source: "2600:4040:593d:8b30::/64"
|
||||
- comment: "SSH Servers v6"
|
||||
source: "2600:4040:593d:8b10::/64"
|
||||
Reference in New Issue
Block a user