change inclusion of os specific defaults (#353)

* change inclusion of os specific defaults we now include the os specific options into a separate variable and merge this with the default ansible namespace, when the corresponding keys do not already exist (eg. are defined by default oder by user) Signed-off-by: Martin Schurz <[email protected]> * simplify check for os specific variables Signed-off-by: Martin Schurz <[email protected]> * add test for variable override Signed-off-by: Martin Schurz <[email protected]> * move tests to verify stage Signed-off-by: Martin Schurz <[email protected]> * correct grep Signed-off-by: Martin Schurz <[email protected]> * linting Signed-off-by: Martin Schurz <[email protected]> * fix typo Signed-off-by: Martin Schurz <[email protected]> * Revert "Merge pull request #351 from sprat/fix-umask" This reverts commit 9e8e0bc8fb, reversing changes made to 98c7553016. Signed-off-by: Martin Schurz <[email protected]> * move immutable ssh vars to internal vars Signed-off-by: Martin Schurz <[email protected]> * move vars to OS files Signed-off-by: Martin Schurz <[email protected]> * change default handling for all roles Signed-off-by: Martin Schurz <[email protected]> * fix issues Signed-off-by: Martin Schurz <[email protected]> * add documentation Signed-off-by: Martin Schurz <[email protected]> * Update main.yml Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00
1 parent 83e29b01f5
commit a75e2c028b
@@ -79,9 +79,6 @@ ssh_allow_agent_forwarding: false   # sshd
 # false to disable X11 Forwarding. Set to true to allow X11 Forwarding.
 ssh_x11_forwarding: false   # sshd

-# true if SSH has PAM support
-ssh_pam_support: true
-
 # false to disable pam authentication.
 ssh_use_pam: true                   # sshd

@@ -91,9 +88,6 @@ sshd_authenticationmethods: 'publickey'
 # true if SSH support GSSAPI
 ssh_gssapi_support: false

-# true if SSH support Kerberos
-ssh_kerberos_support: true
-
 # if specified, login is disallowed for user names that match one of the patterns.
 ssh_deny_users: ''                  # sshd

@@ -192,62 +186,9 @@ ssh_macs: []
 ssh_ciphers: []
 ssh_kex: []

-ssh_macs_53_default:
-  - hmac-ripemd160
-  - hmac-sha1
-
-ssh_macs_53_el_6_5_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_macs_59_default:
-  - hmac-sha2-512
-  - hmac-sha2-256
-  - hmac-ripemd160
-
-ssh_macs_66_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_macs_76_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - hmac-sha2-512
-  - hmac-sha2-256
-
-ssh_ciphers_53_default:
-  - aes256-ctr
-  - aes192-ctr
-  - aes128-ctr
-
-ssh_ciphers_66_default:
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - aes256-ctr
-  - aes192-ctr
-  - aes128-ctr
-
-ssh_kex_59_default:
-  - diffie-hellman-group-exchange-sha256
-
-ssh_kex_66_default:
-  - [email protected]
-  - diffie-hellman-group-exchange-sha256
-
-ssh_kex_80_default:
-  - [email protected]
-  - [email protected]
-  - diffie-hellman-group-exchange-sha256
-
 # directory where to store ssh_password policy
 ssh_custom_selinux_dir: '/etc/selinux/local-policies'

-sshd_moduli_file: '/etc/ssh/moduli'
 sshd_moduli_minimum: 2048

 # disable ChallengeResponseAuthentication
@@ -271,7 +212,3 @@ sshd_syslog_facility: 'AUTH'
 sshd_log_level: 'VERBOSE'

 sshd_strict_modes: true
-
-# disable CRYPTO_POLICY to take settings from sshd configuration
-# see: https://access.redhat.com/solutions/4410591
-sshd_disable_crypto_policy: true