* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
* disable systemd socket activation
Signed-off-by: Sebastian Gumprich <[email protected]>
* move start to after deactivation so it can start
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* add role argument spec for os, ssh, mysql
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove variable in variable as it cannot be used in argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix wrong syntax
* fix spelling errors
Signed-off-by: Sebastian Gumprich <[email protected]>
* cannot use vars before arg-spec validation
Signed-off-by: Sebastian Gumprich <[email protected]>
* yamllint the arg-spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* add back variable
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove redundant setting in tests
* fix descriptions in mysql hardening to betterreflect what they do
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove duplicate empty line
Signed-off-by: Sebastian Gumprich <[email protected]>
* set correct defaults on to ssl options
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove left-over hidepid argument spec
Signed-off-by: Sebastian Gumprich <[email protected]>
* remove license and author infos, this lives in the collection readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* fix styling
Signed-off-by: Sebastian Gumprich <[email protected]>
* update some descriptions and sort them in the readme
Signed-off-by: Sebastian Gumprich <[email protected]>
* some more linting
Signed-off-by: Sebastian Gumprich <[email protected]>
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
Co-authored-by: Sebastian Gumprich <[email protected]>
* add VM tests for ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* remove VM tests from ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* run ssh_hardening test as unprivileged user
Signed-off-by: Martin Schurz <[email protected]>
* add link for documentation
Signed-off-by: Martin Schurz <[email protected]>
* use different config
Signed-off-by: Martin Schurz <[email protected]>
* remove become
Signed-off-by: Martin Schurz <[email protected]>
* re-add become
Signed-off-by: Martin Schurz <[email protected]>
* move become into role
Signed-off-by: Martin Schurz <[email protected]>
* indentation
Signed-off-by: Martin Schurz <[email protected]>
* try args apply
Signed-off-by: Martin Schurz <[email protected]>
* fix linting
Signed-off-by: Martin Schurz <[email protected]>
* add documentation
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
* ssh: Client HostKeyAlgorithms configuration variable
Introduce a new variable ssh_client_host_key_algorithms to be able to configure
it for the client like for the server.
This fixes#441
Signed-off-by: Paul Seidler <[email protected]>
* sshd: Adapt the ssh_host_key_algorithms description
Linking to the latest version may lead to a broken config so be a bit more
dynamic
Signed-off-by: Paul Seidler <[email protected]>
Ansible does not work with FQCN and collections sepcified for including
roles. It is currently expecting to only get the role name in this
context.
Verified with Ansible 2.10.5
Signed-off-by: Martin Schurz <[email protected]>
* Removed Protocol statement in later versions of sshd, since the code for SSH-1 has been removed in sshd.
Signed-off-by: Farid Joubbi <[email protected]>
* Prettified the generated ssh_config. No functional changes, removed spaces and orphan comments.
Signed-off-by: Farid Joubbi <[email protected]>
* Removed Protocol statement in later versions of sshd, since the code for SSH-1 has been removed in sshd.
Signed-off-by: Farid Joubbi <[email protected]>
* Removed blank lines and prettified ssh_config.
Signed-off-by: Farid Joubbi <[email protected]>
* Added note about setting sshd_authenticationmethods if ssh_server_password_login.
Signed-off-by: Farid Joubbi <[email protected]>
* Backticked true.
Signed-off-by: Farid Joubbi <[email protected]>
dev-sec CI