change inclusion of os specific defaults (#353)

* change inclusion of os specific defaults we now include the os specific options into a separate variable and merge this with the default ansible namespace, when the corresponding keys do not already exist (eg. are defined by default oder by user) Signed-off-by: Martin Schurz <[email protected]> * simplify check for os specific variables Signed-off-by: Martin Schurz <[email protected]> * add test for variable override Signed-off-by: Martin Schurz <[email protected]> * move tests to verify stage Signed-off-by: Martin Schurz <[email protected]> * correct grep Signed-off-by: Martin Schurz <[email protected]> * linting Signed-off-by: Martin Schurz <[email protected]> * fix typo Signed-off-by: Martin Schurz <[email protected]> * Revert "Merge pull request #351 from sprat/fix-umask" This reverts commit 9e8e0bc8fb, reversing changes made to 98c7553016. Signed-off-by: Martin Schurz <[email protected]> * move immutable ssh vars to internal vars Signed-off-by: Martin Schurz <[email protected]> * move vars to OS files Signed-off-by: Martin Schurz <[email protected]> * change default handling for all roles Signed-off-by: Martin Schurz <[email protected]> * fix issues Signed-off-by: Martin Schurz <[email protected]> * add documentation Signed-off-by: Martin Schurz <[email protected]> * Update main.yml Co-authored-by: Sebastian Gumprich <[email protected]>
2020-12-20 20:46:57 +01:00
1 parent 83e29b01f5
commit a75e2c028b
@@ -5,6 +5,14 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root

+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
 # CRYPTO_POLICY is not supported on Archlinux
 # and the package check only works in Ansible >2.10
 sshd_disable_crypto_policy: false
@@ -7,3 +7,13 @@ ssh_group: root
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -7,3 +7,15 @@ ssh_group: root
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -4,3 +4,13 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -5,7 +5,12 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel

-ssh_gssapi_support: false
+# true if SSH support Kerberos
 ssh_kerberos_support: false
+
+# true if SSH has PAM support
 ssh_pam_support: false
+
 sshd_moduli_file: '/etc/moduli'
+
+sshd_disable_crypto_policy: false
@@ -1,9 +0,0 @@
---
-sshd_path: /usr/sbin/sshd
-ssh_host_keys_dir: '/etc/ssh'
-sshd_service_name: sshd
-ssh_owner: root
-ssh_group: root
-ssh_selinux_packages:
-  - policycoreutils-python
-  - checkpolicy
@@ -7,3 +7,15 @@ ssh_group: root
 ssh_selinux_packages:
  - policycoreutils-python
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -7,3 +7,15 @@ ssh_group: root
 ssh_selinux_packages:
  - python3-policycoreutils
  - checkpolicy
+
+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+# disable CRYPTO_POLICY to take settings from sshd configuration
+# see: https://access.redhat.com/solutions/4410591
+sshd_disable_crypto_policy: true
@@ -5,4 +5,12 @@ sshd_service_name: ssh
 ssh_owner: root
 ssh_group: root

+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
 ssh_pam_support: false
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
+sshd_disable_crypto_policy: false
@@ -5,4 +5,12 @@ sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root

+# true if SSH support Kerberos
+ssh_kerberos_support: true
+
+# true if SSH has PAM support
+ssh_pam_support: true
+
+sshd_moduli_file: '/etc/ssh/moduli'
+
 sshd_disable_crypto_policy: false
@@ -0,0 +1,52 @@
+---
+ssh_macs_53_default:
+  - hmac-ripemd160
+  - hmac-sha1
+
+ssh_macs_53_el_6_5_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_macs_59_default:
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - hmac-ripemd160
+
+ssh_macs_66_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_macs_76_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_ciphers_53_default:
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_ciphers_66_default:
+  - [email protected]
+  - [email protected]
+  - [email protected]
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_kex_59_default:
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_66_default:
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256
+
+ssh_kex_80_default:
+  - [email protected]
+  - [email protected]
+  - diffie-hellman-group-exchange-sha256