add role argument spec for os, ssh, mysql (#687)
* add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * add role argument spec for os, ssh, mysql Signed-off-by: Sebastian Gumprich <[email protected]> * remove variable in variable as it cannot be used in argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * fix wrong syntax * fix spelling errors Signed-off-by: Sebastian Gumprich <[email protected]> * cannot use vars before arg-spec validation Signed-off-by: Sebastian Gumprich <[email protected]> * yamllint the arg-spec Signed-off-by: Sebastian Gumprich <[email protected]> * add back variable Signed-off-by: Sebastian Gumprich <[email protected]> * remove redundant setting in tests * fix descriptions in mysql hardening to betterreflect what they do Signed-off-by: Sebastian Gumprich <[email protected]> * remove duplicate empty line Signed-off-by: Sebastian Gumprich <[email protected]> * set correct defaults on to ssl options Signed-off-by: Sebastian Gumprich <[email protected]> * remove left-over hidepid argument spec Signed-off-by: Sebastian Gumprich <[email protected]> * remove license and author infos, this lives in the collection readme Signed-off-by: Sebastian Gumprich <[email protected]> * fix styling Signed-off-by: Sebastian Gumprich <[email protected]> * update some descriptions and sort them in the readme Signed-off-by: Sebastian Gumprich <[email protected]> * some more linting Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]> Co-authored-by: Sebastian Gumprich <[email protected]>
This commit is contained in:
Sebastian GumprichandSebastian Gumprich authored and GitHub committed
1 parent
96ba9d1d8d
commit
f295397611
14 files changed
+2946
-930
No files matched your search
@@ -0,0 +1,354 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: The main entry point for the ssh hardening role.
|
||||
version_added: 8.8.0
|
||||
options:
|
||||
network_ipv6_enable:
|
||||
default: true
|
||||
type: bool
|
||||
description: '`false` if IPv6 is not needed. `ssh_listen_to` must also be
|
||||
set to listen to IPv6 addresses (for example `[::]`).'
|
||||
ssh_client_config_file:
|
||||
default: /etc/ssh/ssh_config
|
||||
description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
|
||||
ssh_server_config_file:
|
||||
default: /etc/ssh/sshd_config
|
||||
description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
|
||||
ssh_server_ports:
|
||||
default: ['22']
|
||||
type: list
|
||||
description: ports on which ssh-server should listen.
|
||||
ssh_client_port:
|
||||
default: '22'
|
||||
description: Specifies the port number to connect on the remote host.
|
||||
ssh_listen_to:
|
||||
default: [0.0.0.0]
|
||||
type: list
|
||||
description: one or more ip addresses, to which ssh-server should listen to.
|
||||
Default is all IPv4 addresses, but should be configured to specific addresses
|
||||
for security reasons
|
||||
ssh_host_key_files:
|
||||
default: []
|
||||
type: list
|
||||
description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key',
|
||||
'/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the
|
||||
installed sshd version.
|
||||
ssh_host_rsa_key_size:
|
||||
default: 4096
|
||||
description: Specifies the number of bits in the private host RSA key to create.
|
||||
ssh_host_key_algorithms:
|
||||
default: []
|
||||
type: list
|
||||
description: Host key algorithms that the server offers. If empty the default
|
||||
list will be used. Otherwise overrides the setting with specified list of
|
||||
algorithms. Check `man sshd_config`, `ssh -Q HostKeyAlgorithms` or other
|
||||
sources for supported algorithms - make sure you check the correct version
|
||||
ssh_client_host_key_algorithms:
|
||||
default: []
|
||||
type: list
|
||||
description: Specifies the host key algorithms that the client wants to use
|
||||
in order of preference. If empty the default list will be used. Otherwise
|
||||
overrides the setting with specified list of algorithms. Check `man ssh_config`,
|
||||
`ssh -Q HostKeyAlgorithms` or other sources for supported algorithms - make
|
||||
sure you check the correct version!
|
||||
ssh_client_alive_interval:
|
||||
default: 600
|
||||
description: specifies an interval for sending keepalive messages.
|
||||
ssh_client_alive_count:
|
||||
default: 3
|
||||
description: Defines the number of acceptable unanswered client alive messages
|
||||
before disconnecting clients.
|
||||
ssh_permit_tunnel:
|
||||
default: false
|
||||
type: bool
|
||||
description: '`true` if SSH Port Tunneling is required.'
|
||||
ssh_remote_hosts:
|
||||
default: []
|
||||
type: list
|
||||
description: one or more hosts and their custom options for the ssh-client.
|
||||
Default is empty. See examples in `defaults/main.yml`
|
||||
ssh_permit_root_login:
|
||||
default: 'no'
|
||||
description: Disable root-login. Set to `'without-password'` or `'yes'` to
|
||||
enable root-login - The quotes are required!
|
||||
ssh_allow_tcp_forwarding:
|
||||
default: 'no'
|
||||
description: Set to `'no'` or `false` to disable TCP Forwarding. Set to `'yes'`
|
||||
or`True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version,
|
||||
you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
|
||||
ssh_gateway_ports:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable binding forwarded ports to non-loopback
|
||||
addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified`
|
||||
to allow the client to specify which address to bind to.
|
||||
ssh_allow_agent_forwarding:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable Agent Forwarding. Set to `true` to
|
||||
allow Agent Forwarding.
|
||||
ssh_x11_forwarding:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable X11 Forwarding. Set to `true` to allow
|
||||
X11 Forwarding.
|
||||
ssh_pam_support:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `true` if SSH has PAM support.
|
||||
ssh_use_pam:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable pam authentication.
|
||||
ssh_gssapi_support:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `true` to enable GSSAPI authentication (both client and
|
||||
server).
|
||||
ssh_gssapi_delegation:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `true` to enable GSSAPI credential forwarding.
|
||||
ssh_kerberos_support:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `true` if SSH has Kerberos support.
|
||||
ssh_deny_users:
|
||||
default: ''
|
||||
description: if specified, login is disallowed for user names that match one
|
||||
of the patterns.
|
||||
ssh_allow_users:
|
||||
default: ''
|
||||
description: if specified, login is allowed only for user names that match
|
||||
one of the patterns.
|
||||
ssh_deny_groups:
|
||||
default: ''
|
||||
description: if specified, login is disallowed for users whose primary group
|
||||
or supplementary group list matches one of the patterns.
|
||||
ssh_allow_groups:
|
||||
default: ''
|
||||
description: if specified, login is allowed only for users whose primary group
|
||||
or supplementary group list matches one of the patterns.
|
||||
ssh_authorized_keys_file:
|
||||
default: ''
|
||||
description: change default file that contains the public keys that can be
|
||||
used for user authentication
|
||||
ssh_trusted_user_ca_keys_file:
|
||||
default: ''
|
||||
description: specifies the file containing trusted certificate authorities
|
||||
public keys used to sign user certificates.
|
||||
ssh_trusted_user_ca_keys:
|
||||
default: []
|
||||
type: list
|
||||
description: set the trusted certificate authorities public keys used to sign
|
||||
user certificates. Only used if `ssh_trusted_user_ca_keys_file` is set.
|
||||
ssh_authorized_principals_file:
|
||||
default: ''
|
||||
description: specifies the file containing principals that are allowed. Only
|
||||
used if `ssh_trusted_user_ca_keys_file` is set.
|
||||
ssh_authorized_principals:
|
||||
default: []
|
||||
type: list
|
||||
description: list of hashes containing file paths and authorized principals,
|
||||
see `default_cstom.yml` for all options. Only used if `ssh_authorized_principals_file`
|
||||
is set
|
||||
ssh_print_motd:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable printing of the MOTD.
|
||||
ssh_print_pam_motd:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable printing of the MOTD via pam (Debian
|
||||
and Ubuntu).
|
||||
ssh_print_last_log:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `false` to disable display of last login information.
|
||||
sftp_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable sftp configuration.
|
||||
sftp_umask:
|
||||
default: '0027'
|
||||
description: Specifies the umask for sftp.
|
||||
sftp_chroot:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable chroot for sftp.
|
||||
sftp_chroot_dir:
|
||||
default: /home/%u
|
||||
description: change default stp chroot location
|
||||
ssh_client_roaming:
|
||||
default: false
|
||||
type: bool
|
||||
description: enable experimental client roaming.
|
||||
sshd_moduli_file:
|
||||
default: /etc/ssh/moduli
|
||||
description: path to the SSH moduli file.
|
||||
sshd_moduli_minimum:
|
||||
default: 2048
|
||||
description: remove Diffie-Hellman parameters smaller than the defined size
|
||||
to mitigate logjam.
|
||||
ssh_challengeresponseauthentication:
|
||||
default: false
|
||||
type: bool
|
||||
description: Specifies whether challenge-response authentication is allowed
|
||||
(e.g. via PAM).
|
||||
ssh_client_password_login:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `true` to allow password-based authentication with the
|
||||
ssh client.
|
||||
ssh_server_password_login:
|
||||
default: false
|
||||
type: bool
|
||||
description: 'Set to `true` to allow password-based authentication to the
|
||||
ssh server. You probably also need to change `sshd_authenticationmethods`
|
||||
to include `password` if you set `ssh_server_password_login`: `true`.'
|
||||
ssh_banner:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `true` to print a banner on login.
|
||||
ssh_banner_path:
|
||||
default: /etc/sshd/banner.txt
|
||||
description: path to the SSH banner file.
|
||||
ssh_client_hardening:
|
||||
default: true
|
||||
type: bool
|
||||
description: '`false` to stop harden the client.'
|
||||
ssh_client_compression:
|
||||
default: false
|
||||
type: bool
|
||||
description: Specifies whether the client requests compression.
|
||||
ssh_compression:
|
||||
default: false
|
||||
type: bool
|
||||
description: Specifies whether server-side compression is enabled after the
|
||||
user has authenticated successfully.
|
||||
ssh_login_grace_time:
|
||||
default: 30s
|
||||
description: specifies the time allowed for successful authentication to the
|
||||
SSH server.
|
||||
ssh_max_auth_retries:
|
||||
default: 2
|
||||
description: Specifies the maximum number of authentication attempts permitted
|
||||
per connection.
|
||||
ssh_max_sessions:
|
||||
default: 10
|
||||
description: Specifies the maximum number of open sessions permitted from
|
||||
a given connection.
|
||||
ssh_print_debian_banner:
|
||||
default: false
|
||||
type: bool
|
||||
description: Set to `true` to print debian specific banner.
|
||||
ssh_server_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Set to `false` to disable the opensshd server.
|
||||
ssh_server_hardening:
|
||||
default: true
|
||||
type: bool
|
||||
description: '`false` to stop harden the server.'
|
||||
ssh_server_match_address:
|
||||
default: ''
|
||||
description: Introduces a conditional block. If all of the criteria on the
|
||||
Match line are satisfied, the keywords on the following lines override those
|
||||
set in the global section of the config file, until either another Match
|
||||
line or the end of the file.
|
||||
ssh_server_match_group:
|
||||
default: ''
|
||||
description: Introduces a conditional block. If all of the criteria on the
|
||||
Match line are satisfied, the keywords on the following lines override those
|
||||
set in the global section of the config file, until either another Match
|
||||
line or the end of the file.
|
||||
ssh_server_match_user:
|
||||
default: ''
|
||||
description: Introduces a conditional block. If all of the criteria on the
|
||||
Match line are satisfied, the keywords on the following lines override those
|
||||
set in the global section of the config file, until either another Match
|
||||
line or the end of the file.
|
||||
ssh_server_match_local_port:
|
||||
default: ''
|
||||
description: Introduces a conditional block. If all of the criteria on the
|
||||
Match line are satisfied, the keywords on the following lines override those
|
||||
set in the global section of the config file, until either another Match
|
||||
line or the end of the file.
|
||||
ssh_server_permit_environment_vars:
|
||||
default: 'no'
|
||||
description: "`yes` to specify that ~/.ssh/environment and environment= options\
|
||||
\ in ~/.ssh/authorized_keys are processed by sshd. With openssh version\
|
||||
\ 7.8 it is possible to specify a whitelist of environment variable names\
|
||||
\ in addition to global 'yes' or 'no' settings."
|
||||
ssh_server_accept_env_vars:
|
||||
default: ''
|
||||
description: Specifies what environment variables sent by the client will
|
||||
be copied into the session's environment, multiple environment variables
|
||||
may be separated by whitespace.
|
||||
ssh_use_dns:
|
||||
default: false
|
||||
type: bool
|
||||
description: Specifies whether sshd should look up the remote host name, and
|
||||
to check that the resolved host name for the remote IP address maps back
|
||||
to the very same IP address.
|
||||
ssh_server_revoked_keys:
|
||||
default: []
|
||||
type: list
|
||||
description: a list of revoked public keys that the ssh server will always
|
||||
reject, useful to revoke known weak or compromised keys.
|
||||
ssh_max_startups:
|
||||
default: 10:30:60
|
||||
description: Specifies the maximum number of concurrent unauthenticated connections
|
||||
to the SSH daemon.
|
||||
ssh_macs:
|
||||
default: []
|
||||
type: list
|
||||
description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
|
||||
ssh_kex:
|
||||
default: []
|
||||
type: list
|
||||
description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
|
||||
ssh_ciphers:
|
||||
default: []
|
||||
type: list
|
||||
description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
|
||||
ssh_custom_options:
|
||||
default: []
|
||||
description: Custom lines for SSH client configuration.
|
||||
sshd_custom_options:
|
||||
default: []
|
||||
type: list
|
||||
description: Custom lines for SSH daemon configuration.
|
||||
sshd_syslog_facility:
|
||||
default: AUTH
|
||||
description: The facility code that is used when logging messages from sshd.
|
||||
type: str
|
||||
sshd_log_level:
|
||||
default: VERBOSE
|
||||
description: the verbosity level that is used when logging messages from sshd.
|
||||
sshd_strict_modes:
|
||||
default: true
|
||||
type: bool
|
||||
description: Check file modes and ownership of the user's files and home directory
|
||||
before accepting login.
|
||||
sshd_authenticationmethods:
|
||||
default: publickey
|
||||
description: Specifies the authentication methods that must be successfully
|
||||
completed for a user to be granted access. Make sure to set all required
|
||||
variables for your selected authentication method. Defaults found in `defaults/main.yml`
|
||||
ssh_custom_selinux_dir:
|
||||
default: /etc/selinux/local-policies
|
||||
description: directory where to store the ssh_password policy
|
||||
ssh_hardening_enabled:
|
||||
default: true
|
||||
type: bool
|
||||
description: Whether to run the hardening
|
||||
ssh_host_certificates:
|
||||
default: []
|
||||
type: list
|
||||
description: Host certificates to look for when starting sshd
|
||||
ssh_ps59:
|
||||
default: sandbox
|
||||
description: Specifies whether sshd separates privileges by creating an unprivileged
|
||||
child process to deal with incoming network traffic.
|
||||
Reference in new issue
Block a user