andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disable systemd socket activation (#769)

Browse Source 
* disable systemd socket activation

Signed-off-by: Sebastian Gumprich <[email protected]>

* move start to after deactivation so it can start

---------

Signed-off-by: Sebastian Gumprich <[email protected]>
This commit is contained in:
Sebastian Gumprich authored and GitHub committed 2024-06-18 15:56:09 +02:00
1 parent 8dab761c52
commit 19ca997bd6
3 files changed
+33
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/ssh_hardening/tasks/hardening.yml
+9
View File
@@ -32,6 +32,15 @@
ansible.builtin.set_fact:
sshd_version: "{{ sshd_version_raw.stderr | regex_replace('.*_([0-9]*.[0-9]).*', '\\1') }}"
# see https://github.com/dev-sec/ansible-collection-hardening/issues/763
- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated
ansible.builtin.include_tasks: disable-systemd-socket.yml
when:
- ssh_server_hardening | bool
- ssh_server_enabled | bool
- (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or
(ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>='))
- name: Set default for ssh_host_key_files if not supplied
ansible.builtin.include_tasks: crypto_hostkeys.yml
when: