From 1d8a2f42fc9f8f917bc7e32cb050b18ed5309bf8 Mon Sep 17 00:00:00 2001 From: Wilfried OLLIVIER Date: Thu, 31 Jan 2019 15:12:04 +0100 Subject: [PATCH] Bootstrap ssh role --- README.md | 35 ++++++++++++++++ handlers/main.yml | 7 ++++ meta/main.yml | 19 +++++++++ tasks/main.yml | 8 ++++ templates/sshd_config.j2 | 88 ++++++++++++++++++++++++++++++++++++++++ tests/inventory | 1 + tests/test.yml | 5 +++ vars/main.yml | 4 ++ 8 files changed, 167 insertions(+) create mode 100644 README.md create mode 100644 handlers/main.yml create mode 100644 meta/main.yml create mode 100644 tasks/main.yml create mode 100644 templates/sshd_config.j2 create mode 100644 tests/inventory create mode 100644 tests/test.yml create mode 100644 vars/main.yml diff --git a/README.md b/README.md new file mode 100644 index 0000000..b6047a9 --- /dev/null +++ b/README.md @@ -0,0 +1,35 @@ +galaxy-ssh +========== + +Update ssh config + +Requirements +------------ + +None + +Role Variables +-------------- + +- sshd_port: port where sshd should listen + +Dependencies +------------ + +None + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: galaxy-ssh, sshd_port: 42 } + +Run tests +--------- + +Ensure galaxy-vagrant is up + + ansible-playbook -i tests/inventory tests/test.yml diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..d079b36 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,7 @@ +--- +# handlers file for galaxy-ssh + +- name: reload ssh + systemd: + name: sshd + state: reloaded diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..da54465 --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,19 @@ +galaxy_info: + author: Wilfried OLLIVIER + description: Setup SSH + company: none + + license: WTFPL + + min_ansible_version: 2.4 + + platforms: + - name: Debian + versions: + - Stretch + + galaxy_tags: + - debian + - ssh + +dependencies: [] diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..3241dc4 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,8 @@ +--- +# tasks file for galaxy-ssh + +- name: Updage ssh config + template: + src: sshd_config.j2 + dest: /etc/ssh/sshd_config + notify: reload ssh \ No newline at end of file diff --git a/templates/sshd_config.j2 b/templates/sshd_config.j2 new file mode 100644 index 0000000..ffb9522 --- /dev/null +++ b/templates/sshd_config.j2 @@ -0,0 +1,88 @@ +# Package generated configuration file +# See the sshd_config(5) manpage for details + +# What ports, IPs and protocols we listen for +Port {{ sshd_port }} +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 768 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin without-password +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes +AuthorizedKeysFile %h/.ssh/authorized_keys + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +#PasswordAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosGetAFSToken no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +X11Forwarding no +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +#MaxStartups 10:30:60 +#Banner /etc/issue.net + +# Allow client to pass locale environment variables +# AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes +UseDNS no diff --git a/tests/inventory b/tests/inventory new file mode 100644 index 0000000..38d0757 --- /dev/null +++ b/tests/inventory @@ -0,0 +1 @@ +galaxy-vagrant.example.com diff --git a/tests/test.yml b/tests/test.yml new file mode 100644 index 0000000..51745eb --- /dev/null +++ b/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: galaxy-vagrant.example.com + remote_user: root + roles: + - { role: ../galaxy-ssh, sshd_port: 22 } \ No newline at end of file diff --git a/vars/main.yml b/vars/main.yml new file mode 100644 index 0000000..dd70de4 --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,4 @@ +--- +# vars file for galaxy-ssh + +sshd_port: 22 \ No newline at end of file