diff --git a/roles/ssh_hardening/defaults/main.yml b/roles/ssh_hardening/defaults/main.yml index ee60fecb..d70b8da6 100644 --- a/roles/ssh_hardening/defaults/main.yml +++ b/roles/ssh_hardening/defaults/main.yml @@ -1,4 +1,5 @@ --- + # true if IPv6 is needed network_ipv6_enable: true # sshd + ssh diff --git a/roles/ssh_hardening/tasks/disable-systemd-socket.yml b/roles/ssh_hardening/tasks/disable-systemd-socket.yml index c867fcbb..35f8988e 100644 --- a/roles/ssh_hardening/tasks/disable-systemd-socket.yml +++ b/roles/ssh_hardening/tasks/disable-systemd-socket.yml @@ -10,9 +10,3 @@ state: stopped enabled: false masked: true - -- name: Enable normal sshd start - ansible.builtin.systemd: - name: ssh.service - state: started - enabled: true diff --git a/roles/ssh_hardening/tasks/hardening.yml b/roles/ssh_hardening/tasks/hardening.yml index 59a82530..3b09c5c3 100644 --- a/roles/ssh_hardening/tasks/hardening.yml +++ b/roles/ssh_hardening/tasks/hardening.yml @@ -22,6 +22,9 @@ with_dict: "{{ os_vars }}" tags: always +- name: Install openssh package and configure the service + ansible.builtin.include_tasks: install.yml + - name: Get openssh-version ansible.builtin.command: ssh -V register: sshd_version_raw @@ -32,15 +35,6 @@ ansible.builtin.set_fact: sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}" -# see https://github.com/dev-sec/ansible-collection-hardening/issues/763 -- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated - ansible.builtin.include_tasks: disable-systemd-socket.yml - when: - - ssh_server_hardening | bool - - ssh_server_enabled | bool - - (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or - (ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>=')) - - name: Set default for ssh_host_key_files if not supplied ansible.builtin.include_tasks: crypto_hostkeys.yml when: diff --git a/roles/ssh_hardening/tasks/install.yml b/roles/ssh_hardening/tasks/install.yml new file mode 100644 index 00000000..f4232046 --- /dev/null +++ b/roles/ssh_hardening/tasks/install.yml @@ -0,0 +1,23 @@ +--- + +- name: Install openssh package(s) + ansible.builtin.package: + name: "{{ pkg }}" + state: present + loop: "{{ ssh_pkgs }}" + loop_control: + loop_var: pkg + +# see https://github.com/dev-sec/ansible-collection-hardening/issues/763 +- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated + ansible.builtin.include_tasks: disable-systemd-socket.yml + when: + - ssh_server_hardening | bool + - ssh_server_enabled | bool + - (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or + (ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>=')) + +- name: Enable or disable sshd service + ansible.builtin.service: + name: "{{ sshd_service_name }}" + enabled: "{{ ssh_server_service_enabled }}" diff --git a/roles/ssh_hardening/vars/Amazon_2.yml b/roles/ssh_hardening/vars/Amazon_2.yml index 7a345fb8..c14afcc3 100644 --- a/roles/ssh_hardening/vars/Amazon_2.yml +++ b/roles/ssh_hardening/vars/Amazon_2.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/Archlinux.yml b/roles/ssh_hardening/vars/Archlinux.yml index 7648010f..d18ecc51 100644 --- a/roles/ssh_hardening/vars/Archlinux.yml +++ b/roles/ssh_hardening/vars/Archlinux.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/Debian.yml b/roles/ssh_hardening/vars/Debian.yml index d062326e..90bc07fb 100644 --- a/roles/ssh_hardening/vars/Debian.yml +++ b/roles/ssh_hardening/vars/Debian.yml @@ -1,4 +1,7 @@ --- +ssh_pkgs: + - openssh-server + - openssh-client sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: ssh diff --git a/roles/ssh_hardening/vars/Fedora.yml b/roles/ssh_hardening/vars/Fedora.yml index 702989a7..2e2abd63 100644 --- a/roles/ssh_hardening/vars/Fedora.yml +++ b/roles/ssh_hardening/vars/Fedora.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/Fedora_37.yml b/roles/ssh_hardening/vars/Fedora_37.yml index fa0f3b6f..db037ebf 100644 --- a/roles/ssh_hardening/vars/Fedora_37.yml +++ b/roles/ssh_hardening/vars/Fedora_37.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/FreeBSD.yml b/roles/ssh_hardening/vars/FreeBSD.yml index 2967494d..7cad6e02 100644 --- a/roles/ssh_hardening/vars/FreeBSD.yml +++ b/roles/ssh_hardening/vars/FreeBSD.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh-portable sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/OpenBSD.yml b/roles/ssh_hardening/vars/OpenBSD.yml index d6ef2a10..5aa3bb17 100644 --- a/roles/ssh_hardening/vars/OpenBSD.yml +++ b/roles/ssh_hardening/vars/OpenBSD.yml @@ -1,4 +1,8 @@ --- +# It seems that OpenBSD comes with openssh in the base install so we can't +# really install it as a separated package. Feel free to patch this if it's +# not the expected way to handle that on OpenBSD +ssh_pkgs: [] sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/RedHat.yml b/roles/ssh_hardening/vars/RedHat.yml index f859c8fe..413db40f 100644 --- a/roles/ssh_hardening/vars/RedHat.yml +++ b/roles/ssh_hardening/vars/RedHat.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/RedHat_9.yml b/roles/ssh_hardening/vars/RedHat_9.yml index 2d956140..5bffd0c1 100644 --- a/roles/ssh_hardening/vars/RedHat_9.yml +++ b/roles/ssh_hardening/vars/RedHat_9.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/SmartOS.yml b/roles/ssh_hardening/vars/SmartOS.yml index 94849b68..7194c569 100644 --- a/roles/ssh_hardening/vars/SmartOS.yml +++ b/roles/ssh_hardening/vars/SmartOS.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/lib/ssh/sshd ssh_host_keys_dir: /var/ssh sshd_service_name: ssh diff --git a/roles/ssh_hardening/vars/Suse.yml b/roles/ssh_hardening/vars/Suse.yml index 8a797610..f77bf823 100644 --- a/roles/ssh_hardening/vars/Suse.yml +++ b/roles/ssh_hardening/vars/Suse.yml @@ -1,4 +1,6 @@ --- +ssh_pkgs: + - openssh sshd_path: /usr/sbin/sshd ssh_host_keys_dir: /etc/ssh sshd_service_name: sshd diff --git a/roles/ssh_hardening/vars/main.yml b/roles/ssh_hardening/vars/main.yml index 6c4bb2c9..87ef6b69 100644 --- a/roles/ssh_hardening/vars/main.yml +++ b/roles/ssh_hardening/vars/main.yml @@ -1,4 +1,5 @@ --- + ssh_macs_53_default: - hmac-ripemd160 - hmac-sha1