Martin SchurzandJonathan Wright
b87188c619
* Add support for current versions of Debian and EL Signed-off-by: Martin Schurz <[email protected]> * Add conditions for EL8 Signed-off-by: Martin Schurz <[email protected]> * Fix Audit in AlmaLinux Signed-off-by: Martin Schurz <[email protected]> * Fix broken SSH host key config in rhel/almalinux 10 Signed-off-by: Jonathan Wright <[email protected]> * Generate SSH Keys on EL10 Signed-off-by: Martin Schurz <[email protected]> * Generate SSH Keys for tests via Systemd Signed-off-by: Martin Schurz <[email protected]> * Fixup tests Signed-off-by: Martin Schurz <[email protected]> * Remove auditd conditions Signed-off-by: Martin Schurz <[email protected]> * Add path to audit handler Signed-off-by: Martin Schurz <[email protected]> * Install init scripts Signed-off-by: Martin Schurz <[email protected]> * Update main README --------- Signed-off-by: Martin Schurz <[email protected]> Signed-off-by: Jonathan Wright <[email protected]> Co-authored-by: Jonathan Wright <[email protected]>
81 lines
2.3 KiB
YAML
81 lines
2.3 KiB
YAML
---
|
|
- name: Wrapper playbook for kitchen testing "ansible-ssh-hardening" with default settings
|
|
hosts: all
|
|
become: true
|
|
environment:
|
|
http_proxy: "{{ lookup('env', 'http_proxy') | default(omit) }}"
|
|
https_proxy: "{{ lookup('env', 'https_proxy') | default(omit) }}"
|
|
no_proxy: "{{ lookup('env', 'no_proxy') | default(omit) }}"
|
|
tasks:
|
|
- name: Use python3
|
|
ansible.builtin.set_fact:
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
when: ansible_facts.distribution == 'Fedora'
|
|
|
|
- name: Install dnf packages # noqa ignore-errors
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- openssh-clients
|
|
- openssh-server
|
|
state: present
|
|
update_cache: true
|
|
ignore_errors: true
|
|
|
|
- name: Install libselinux-python # noqa ignore-errors
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- libselinux-python
|
|
state: present
|
|
update_cache: true
|
|
ignore_errors: true
|
|
|
|
- name: Install procps-ng # noqa ignore-errors
|
|
ansible.builtin.dnf:
|
|
name:
|
|
- procps-ng
|
|
state: present
|
|
update_cache: true
|
|
ignore_errors: true
|
|
|
|
- name: Install apt packages # noqa ignore-errors
|
|
ansible.builtin.apt:
|
|
name:
|
|
- openssh-client
|
|
- openssh-server
|
|
state: present
|
|
update_cache: true
|
|
ignore_errors: true
|
|
|
|
- name: Install required tools on SuSE
|
|
# cannot use zypper module, since it depends on python-xml
|
|
ansible.builtin.command: zypper -n install python-xml
|
|
changed_when: false
|
|
when: ansible_facts.os_family == 'Suse'
|
|
|
|
- name: Install packages on SuSE
|
|
community.general.zypper:
|
|
name:
|
|
- openssh
|
|
when: ansible_facts.os_family == 'Suse'
|
|
|
|
- name: Install required tools on Arch
|
|
community.general.pacman:
|
|
name:
|
|
- openssh
|
|
- awk
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts.os_family == 'Archlinux'
|
|
|
|
- name: Install required tools on Alpine
|
|
community.general.apk:
|
|
name:
|
|
- openssh
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_facts.os_family == 'Alpine'
|
|
|
|
- name: Create ssh host keys # noqa ignore-errors no-changed-when
|
|
ansible.builtin.command: ssh-keygen -A
|
|
ignore_errors: true
|