schurzi
69ab9e47ad
* Update Ubuntu compatability Signed-off-by: Martin Schurz <[email protected]> * reload systemd when disabling ssh socket Signed-off-by: Martin Schurz <[email protected]> * manage systemd files Signed-off-by: Martin Schurz <[email protected]> * Create privsep directory for Debian Signed-off-by: Martin Schurz <[email protected]> * Use working Ubuntu 24.04 image for vm tests Signed-off-by: Martin Schurz <[email protected]> * Remove deprecated Debian 10 Signed-off-by: Martin Schurz <[email protected]> --------- Signed-off-by: Martin Schurz <[email protected]>
36 lines
1.1 KiB
YAML
36 lines
1.1 KiB
YAML
---
|
|
|
|
- name: Install openssh package(s)
|
|
ansible.builtin.package:
|
|
name: "{{ pkg }}"
|
|
state: present
|
|
loop: "{{ ssh_pkgs }}"
|
|
loop_control:
|
|
loop_var: pkg
|
|
|
|
# see https://github.com/dev-sec/ansible-collection-hardening/issues/763
|
|
- name: Change Debian/Ubuntu systems so ssh starts traditionally instead of socket-activated
|
|
ansible.builtin.include_tasks: disable-systemd-socket.yml
|
|
when:
|
|
- ssh_server_hardening | bool
|
|
- ssh_server_enabled | bool
|
|
- (ansible_facts.distribution == 'Ubuntu' and ansible_facts.distribution_major_version is version('22.04', '>=')) or
|
|
(ansible_facts.os_family == 'Debian' and ansible_facts.distribution_major_version is version('12', '>='))
|
|
|
|
- name: Ensure privilege separation directory exists
|
|
ansible.builtin.file:
|
|
path: /run/sshd
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
when:
|
|
- ssh_server_hardening | bool
|
|
- ssh_server_enabled | bool
|
|
- ansible_facts.os_family == 'Debian'
|
|
|
|
- name: Enable or disable sshd service
|
|
ansible.builtin.service:
|
|
name: "{{ sshd_service_name }}"
|
|
enabled: "{{ ssh_server_service_enabled }}"
|