disable systemd socket activation (#769)

* disable systemd socket activation Signed-off-by: Sebastian Gumprich <[email protected]> * move start to after deactivation so it can start --------- Signed-off-by: Sebastian Gumprich <[email protected]>
2024-06-18 15:56:09 +02:00
1 parent 8dab761c52
commit 19ca997bd6
@@ -0,0 +1,18 @@
+---
+- name: Remove ssh service systemd-socket file
+  ansible.builtin.file:
+    path: /etc/systemd/system/ssh.service.d/00-socket.conf
+    state: absent
+
+- name: Disable systemd-socket activation
+  ansible.builtin.systemd:
+    name: ssh.socket
+    state: stopped
+    enabled: false
+    masked: true
+
+- name: Enable normal sshd start
+  ansible.builtin.systemd:
+    name: ssh.service
+    state: started
+    enabled: true
@@ -32,6 +32,15 @@
  ansible.builtin.set_fact:
    sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"

+# see https://github.com/dev-sec/ansible-collection-hardening/issues/763
+- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated
+  ansible.builtin.include_tasks: disable-systemd-socket.yml
+  when:
+    - ssh_server_hardening | bool
+    - ssh_server_enabled | bool
+    - (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or
+      (ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>='))
+
 - name: Set default for ssh_host_key_files if not supplied
  ansible.builtin.include_tasks: crypto_hostkeys.yml
  when: