Sebastian Gumprich
f56d80b5d8
* Replace ssh_keys group in Fedora with root In Fedora 38, the `ssh_keys` group was removed. root is used now, in accordance to upstream. See: https://www.spinics.net/lists/fedora-devel/msg307707.html See: https://src.fedoraproject.org/rpms/openssh/pull-request/37# Signed-off-by: Sebastian Gumprich <[email protected]> * change host key mode and owner in fedora and rhel9 Signed-off-by: Sebastian Gumprich <[email protected]> * add missing host mode for rhel7 Signed-off-by: Sebastian Gumprich <[email protected]> * harden all ssh host keys Signed-off-by: Sebastian Gumprich <[email protected]> * skip linting rule Signed-off-by: Sebastian Gumprich <[email protected]> * correct grp for bsd is wheel Signed-off-by: Sebastian Gumprich <[email protected]> --------- Signed-off-by: Sebastian Gumprich <[email protected]>
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
---
|
|
- name: Replace default 2048 bits RSA keypair
|
|
community.crypto.openssh_keypair:
|
|
state: present
|
|
type: rsa
|
|
size: "{{ ssh_host_rsa_key_size }}"
|
|
path: "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
|
|
force: false
|
|
regenerate: partial_idempotence
|
|
|
|
- name: Set hostkeys according to openssh-version if openssh >= 5.3
|
|
ansible.builtin.set_fact:
|
|
ssh_host_key_files:
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
|
|
when: sshd_version is version('5.3', '>=')
|
|
|
|
- name: Set hostkeys according to openssh-version if openssh >= 6.0
|
|
ansible.builtin.set_fact:
|
|
ssh_host_key_files:
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
|
|
when: sshd_version is version('6.0', '>=')
|
|
|
|
- name: Set hostkeys according to openssh-version if openssh >= 6.3
|
|
ansible.builtin.set_fact:
|
|
ssh_host_key_files:
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_rsa_key"
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_ecdsa_key"
|
|
- "{{ ssh_host_keys_dir }}/ssh_host_ed25519_key"
|
|
when: sshd_version is version('6.3', '>=')
|
|
|
|
- name: Change host private key ownership, group and permissions
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
owner: "{{ ssh_host_keys_owner }}"
|
|
group: "{{ ssh_host_keys_group }}"
|
|
mode: "{{ ssh_host_keys_mode }}"
|
|
loop: "{{ ssh_host_key_files }}"
|