Ansible can open multiple connections and it's possible for a new socket
to open before activation is fully disabled, leaving a zombie sshd
process. At least that is the guess. Ubuntu 24.04 suffers from this.
Reload the configuration after disabling socket activation to not enable
it again.
Signed-off-by: Tatu Argillander <[email protected]>
* Provide granular noop for shh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to noop some configuration with a few new
boolean variables.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
* Provide granula noop for ssh configuration
We would like to have more fine grained options on applying or not specific configurations.
This commit let the user choose to disable configurations for `ssh_host_key_config`,
`ssh_ciphers_config`, `ssh_host_key_config`, `ssh_macs_config` by setting them
to False.
Motivation for theses options are we may configure ourselves some (ssh host key
regeneration in a templating system) or we are not ready for others (ssh_kex
will break dist-upgrades, letting the operator without ssh).
Signed-off-by: seven beep <[email protected]>
---------
Signed-off-by: seven beep <[email protected]>
* disable systemd socket activation
Signed-off-by: Sebastian Gumprich <[email protected]>
* move start to after deactivation so it can start
---------
Signed-off-by: Sebastian Gumprich <[email protected]>
This role fails with `The task includes an option with an undefined variable` on OpenBSD because `distributiuon_major_version` is not set on OpenBSD.
We should either default to "" if the variable is not set, or remove `vars/OpenBSD.yml`. I would prefer the former :)
Signed-off-by: Dennis Eriksen <[email protected]>
Signed-off-by: Dennis Eriksen <[email protected]>
* add VM tests for ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* remove VM tests from ssh_hardening
Signed-off-by: Martin Schurz <[email protected]>
* run ssh_hardening test as unprivileged user
Signed-off-by: Martin Schurz <[email protected]>
* add link for documentation
Signed-off-by: Martin Schurz <[email protected]>
* use different config
Signed-off-by: Martin Schurz <[email protected]>
* remove become
Signed-off-by: Martin Schurz <[email protected]>
* re-add become
Signed-off-by: Martin Schurz <[email protected]>
* move become into role
Signed-off-by: Martin Schurz <[email protected]>
* indentation
Signed-off-by: Martin Schurz <[email protected]>
* try args apply
Signed-off-by: Martin Schurz <[email protected]>
* fix linting
Signed-off-by: Martin Schurz <[email protected]>
* add documentation
Signed-off-by: Martin Schurz <[email protected]>
Signed-off-by: Martin Schurz <[email protected]>
* fix filter error in ansible.builtin.file mode parameter
* Change cinc supermarket
* fix link to baseline
* fix typo
Co-authored-by: Sebastian Gumprich <[email protected]>
* use os_family instead of distribution for debian systems
Signed-off-by: rndmh3ro <[email protected]>
* remove tasks related to rhel6 or debian 6
Signed-off-by: rndmh3ro <[email protected]>
* add rocky linux 8 tests and make sure that all relevant tasks are executed
Signed-off-by: rndmh3ro <[email protected]>
* fix missing quote
Signed-off-by: rndmh3ro <[email protected]>
when our collection is used with tags, the os dependent variables are
not resolved. This task should run every time, so the behaviour is
correct.
Signed-off-by: Martin Schurz <[email protected]>
tihis fixes a problem with Ansible 2.9 where the default openssh_keypair
is not supporting every option we need
Signed-off-by: Martin Schurz <[email protected]>
* regenerate RSA key with size 4096 bits
Signed-off-by: Sina Tak Tehrani <[email protected]>
* fixed lint problem
Signed-off-by: Sina Tak Tehrani <[email protected]>
* fixed E301 lint error
Signed-off-by: Sina Tak Tehrani <[email protected]>
* added host keys related vars
Signed-off-by: Sina Tak Tehrani <[email protected]>
* used openssh_keypair module
Signed-off-by: Sina Tak Tehrani <[email protected]>
* changed RSA private key mode to 0640
Signed-off-by: Sina Tak Tehrani <[email protected]>
* specified condition to prevent wrong file mode on debian-based OS
Signed-off-by: Sina Tak Tehrani <[email protected]>
* change inclusion of os specific defaults
we now include the os specific options into a separate variable and
merge this with the default ansible namespace, when the corresponding
keys do not already exist (eg. are defined by default oder by user)
Signed-off-by: Martin Schurz <[email protected]>
* simplify check for os specific variables
Signed-off-by: Martin Schurz <[email protected]>
* add test for variable override
Signed-off-by: Martin Schurz <[email protected]>
* move tests to verify stage
Signed-off-by: Martin Schurz <[email protected]>
* correct grep
Signed-off-by: Martin Schurz <[email protected]>
* linting
Signed-off-by: Martin Schurz <[email protected]>
* fix typo
Signed-off-by: Martin Schurz <[email protected]>
* Revert "Merge pull request #351 from sprat/fix-umask"
This reverts commit 9e8e0bc8fb, reversing
changes made to 98c7553016.
Signed-off-by: Martin Schurz <[email protected]>
* move immutable ssh vars to internal vars
Signed-off-by: Martin Schurz <[email protected]>
* move vars to OS files
Signed-off-by: Martin Schurz <[email protected]>
* change default handling for all roles
Signed-off-by: Martin Schurz <[email protected]>
* fix issues
Signed-off-by: Martin Schurz <[email protected]>
* add documentation
Signed-off-by: Martin Schurz <[email protected]>
* Update main.yml
Co-authored-by: Sebastian Gumprich <[email protected]>
Tatu Argillander