Update Debian compatibility (#784)

* Update Ubuntu compatability Signed-off-by: Martin Schurz <[email protected]> * reload systemd when disabling ssh socket Signed-off-by: Martin Schurz <[email protected]> * manage systemd files Signed-off-by: Martin Schurz <[email protected]> * Create privsep directory for Debian Signed-off-by: Martin Schurz <[email protected]> * Use working Ubuntu 24.04 image for vm tests Signed-off-by: Martin Schurz <[email protected]> * Remove deprecated Debian 10 Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>
2024-08-06 13:11:32 +02:00
1 parent 118a0f07f6
commit 69ab9e47ad
@@ -1,8 +1,12 @@
 ---
 - name: Remove ssh service systemd-socket file
  ansible.builtin.file:
-    path: /etc/systemd/system/ssh.service.d/00-socket.conf
+    path: "{{ item }}"
    state: absent
+  loop:
+    - /etc/systemd/system/ssh.service.d/00-socket.conf
+    - /etc/systemd/system/ssh.service.requires/ssh.socket
+    - /etc/systemd/system/sockets.target.wants/ssh.socket

 - name: Disable systemd-socket activation
  ansible.builtin.systemd:
@@ -17,6 +17,18 @@
    - (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or
      (ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>='))

+- name: Ensure privilege separation directory exists
+  ansible.builtin.file:
+    path: /run/sshd
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+  when:
+    - ssh_server_hardening | bool
+    - ssh_server_enabled | bool
+    - ansible_facts.os_family == 'Debian'
+
 - name: Enable or disable sshd service
  ansible.builtin.service:
    name: "{{ sshd_service_name }}"