Regenerate RSA key with size 4096 bits (#376)

* regenerate RSA key with size 4096 bits

Signed-off-by: Sina Tak Tehrani <[email protected]>

* fixed lint problem

Signed-off-by: Sina Tak Tehrani <[email protected]>

* fixed E301 lint error

Signed-off-by: Sina Tak Tehrani <[email protected]>

* added host keys related vars

Signed-off-by: Sina Tak Tehrani <[email protected]>

* used openssh_keypair module

Signed-off-by: Sina Tak Tehrani <[email protected]>

* changed RSA private key mode to 0640

Signed-off-by: Sina Tak Tehrani <[email protected]>

* specified condition to prevent wrong file mode on debian-based OS

Signed-off-by: Sina Tak Tehrani <[email protected]>

roles/ssh_hardening/tasks/crypto_hostkeys.yml

@@ -1,4 +1,23 @@
 ---
+- name: replace default 2048 bits RSA keypair with 4096 bits keypair
+  openssh_keypair:
+    state: present
+    type: rsa
+    size: 4096
+    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
+    force: false
+    regenerate: partial_idempotence
+
+# In RHEL and Fedora, the 'ssh_keys' group is the group owner of the host private SSH keys.
+# Since the openssh_keypair module needs to read the key to provide idempotency, we need to set ownership and group based on specific OS vars.
+- name: change host private key ownership, group and permissions
+  file:
+    path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
+    owner: "{{ ssh_host_keys_owner }}"
+    group: "{{ ssh_host_keys_group }}"
+    mode: "0640"
+  when: "ansible_facts.distribution in ['CentOS', 'OracleLinux', 'RedHat']"
+
 - name: set hostkeys according to openssh-version if openssh >= 5.3
   set_fact:
     ssh_host_key_files:

roles/ssh_hardening/vars/Archlinux.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 
 # true if SSH support Kerberos
 ssh_kerberos_support: true

roles/ssh_hardening/vars/Debian.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: ssh
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 ssh_selinux_packages:
   - policycoreutils-python
   - checkpolicy

roles/ssh_hardening/vars/Fedora.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
   - python3-policycoreutils
   - checkpolicy

roles/ssh_hardening/vars/FreeBSD.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 
 # true if SSH support Kerberos
 ssh_kerberos_support: true

roles/ssh_hardening/vars/OpenBSD.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: wheel
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 
 # true if SSH support Kerberos
 ssh_kerberos_support: false

roles/ssh_hardening/vars/RedHat.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
   - policycoreutils-python
   - checkpolicy

roles/ssh_hardening/vars/RedHat_8.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'ssh_keys'
 ssh_selinux_packages:
   - python3-policycoreutils
   - checkpolicy

roles/ssh_hardening/vars/SmartOS.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/var/ssh'
 sshd_service_name: ssh
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 
 # true if SSH support Kerberos
 ssh_kerberos_support: true

roles/ssh_hardening/vars/Suse.yml

@@ -4,6 +4,8 @@ ssh_host_keys_dir: '/etc/ssh'
 sshd_service_name: sshd
 ssh_owner: root
 ssh_group: root
+ssh_host_keys_owner: 'root'
+ssh_host_keys_group: 'root'
 
 # true if SSH support Kerberos
 ssh_kerberos_support: true