0
\$\begingroup\$

This is the Ansible role that installs and configures SSH service. What do you think about it? Is there something to improve? Thanks

defaults/main.yml

---
# ssh daemon settings
sshd_listen_port: 22
sshd_address_family: any
sshd_listen_address:
  ipv4: '0.0.0.0'
  ipv6: '::'
sshd_protocol_2: 'yes'
sshd_host_key: ed25519
sshd_syslog_facility: AUTH
sshd_log_level: VERBOSE
sshd_login_gracetime: 2m
sshd_permit_root_login: 'no'
sshd_strict_modes: 'yes'
sshd_max_auth_tries: 2
sshd_max_sessions: 2
sshd_pubkey_auth: 'yes'
sshd_ignore_rhosts: 'yes'
sshd_passwd_auth: 'no'
sshd_permit_empty_passwords: 'no'
sshd_agent_forwarding: 'no'
sshd_tcp_forwarding: 'no'
sshd_gateway_ports: 'no'
sshd_x11_forwarding: 'no'
sshd_print_lastlog: 'yes'
sshd_tcp_keep_alive: 'no'
sshd_permit_user_env: 'no'
sshd_compression: 'no'
sshd_client_alive_count_max: 2
sshd_use_dns: 'no'
sshd_permit_tunnel: 'no'
sshd_allow_users: ''
sshd_allow_groups: wheel
sshd_ipv4_only: 'no'
sshd_use_pam: 'yes'

# ssh service settings
sshd_service_name: sshd
sshd_service_state: restarted
sshd_service_enabled: yes

# other sshd settings
sshd_config_user: root
sshd_config_group: root
sshd_package_name: openssh-server

handlers/main.yml

---
- name: Restart SSH service
  service:
    name: '{{ sshd_service_name }}'
    state: '{{ sshd_service_state }}'
    enabled: '{{ sshd_service_enabled }}'
  become: yes

meta/main.yml

---
galaxy_info:
  author: lester29
  description: Configure SSH service
  license: GPL-3.0-only
  min_ansible_version: '2.1'
  platforms:
    - name: ArchLinux
      versions:
        - all
    - name: Debian
      versions:
        - bookworm
    - name: Ubuntu
      versions:
        - 'jammy'
    - name: OpenBSD
      versions:
        - '7.3'
  galaxy_tags:
    - ssh
    - hardening
    - security
dependencies: []

molecule/default/converge.yml

---
- name: Converge
  hosts: all
  tasks:
    - name: Include sshd
      include_role:
        name: sshd

molecule/default/molecule.yml

---
dependency:
  name: galaxy

driver:
  name: docker

platforms:
  - name: molecule-ubuntu
    image: lester29/ubuntu-ansible:22.04
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    cgroupns_mode: host
    privileged: yes
    pre_build_image: yes

  - name: molecule-debian
    image: lester29/debian-ansible:bookworm
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    cgroupns_mode: host
    privileged: yes
    pre_build_image: yes

  - name: molecule-centos
    image: lester29/centos-ansible:stream9
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    cgroupns_mode: host
    privileged: yes
    pre_build_image: yes

provisioner:
  name: ansible
  inventory:
    group_vars:
      all:
        sshd_service_name: '{{ "ssh" if ansible_distribution == "Debian" else "sshd" }}'

verifier:
  name: ansible

molecule/default/requirements.yml

---
collections:
  - community.docker
  - ansible.posix

molecule/default/verify.yml

---
- name: Verify
  hosts: all
  gather_facts: no
  tasks:
    - name: Get sshd service status
      systemd:
        name: '{{ sshd_service_name }}'
      register: sshd_service_state

    - name: Check if sshd is running
      ansible.builtin.assert:
        that: sshd_service_state['status']['SubState'] == 'running'

tasks/main.yml

---
- name: Include OS specific variables
  include_vars: '{{ ansible_os_family }}.yml'

- name: Install ssh server package
  package:
    name: '{{ sshd_package_name }}'
    state: present

- name: Set permissions to /etc/ssh/sshd_config
  file:
    path: /etc/ssh/sshd_config
    owner: '{{ sshd_config_user }}'
    group: '{{ sshd_config_group }}'
    mode: '0600'

- name: 'Set SSH port to {{ sshd_listen_port }}'
  lineinfile:
    path: '/etc/ssh/sshd_config'
    regexp: '^#*Port.*$'
    line: 'Port {{ sshd_listen_port }}'

- name: 'Set SSH address family to {{ sshd_address_family }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*AddressFamily.*$'
    line: 'AddressFamily {{ sshd_address_family }}'

- name: Set SSH IPv4 listen address
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*ListenAddress\s+0\.0\.0\.0$'
    line: 'ListenAddress {{ sshd_listen_address.ipv4 }}'

- name: Set SSH IPv6 listen address
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*ListenAddress\s+::$'
    line: 'ListenAddress {{ sshd_listen_address.ipv6 }}'
  when: not sshd_ipv4_only

- name: Configure SSH to use Protocol 2
  lineinfile:
    path: /etc/ssh/sshd_config
    line: 'Protocol 2'
    state: present
  when: sshd_protocol_2

- name: 'Set host key to use algorithm {{ sshd_host_key }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*HostKey\s+/etc/ssh/ssh_host_{{ sshd_host_key }}_key$'
    line: 'HostKey /etc/ssh/ssh_host_{{ sshd_host_key }}_key'

- name: 'Set SyslogFacility to {{ sshd_syslog_facility }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*SyslogFacility.*$'
    line: 'SyslogFacility {{ sshd_syslog_facility }}'

- name: 'Set LogLevel to {{ sshd_log_level }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*LogLevel.*$'
    line: 'LogLevel {{ sshd_log_level }}'

- name: 'Set LoginGraceTime to {{ sshd_login_gracetime }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*LoginGraceTime.*$'
    line: 'LoginGraceTime {{ sshd_login_gracetime }}'

- name: 'Set PermitRootLogin to {{ sshd_permit_root_login | string }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PermitRootLogin.*$'
    line: 'PermitRootLogin {{ sshd_permit_root_login | string }}'

- name: 'Set StrictModes to {{ sshd_strict_modes | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*StrictModes.*$'
    line: 'StrictModes {{ sshd_strict_modes | ternary("yes", "no", omit) }}'

- name: 'Set MaxAuthTries to {{ sshd_max_auth_tries }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*MaxAuthTries.*$'
    line: 'MaxAuthTries {{ sshd_max_auth_tries }}'

- name: 'Set MaxSessions to {{ sshd_max_sessions }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*MaxSessions.*$'
    line: 'MaxSessions {{ sshd_max_sessions }}'

- name: 'Set PubkeyAuthentication to {{ sshd_pubkey_auth | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PubkeyAuthentication.*$'
    line: 'PubkeyAuthentication {{ sshd_pubkey_auth | ternary("yes", "no", omit) }}'

- name: 'Set IgnoreRhosts to {{ sshd_ignore_rhosts | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*IgnoreRhosts.*$'
    line: 'IgnoreRhosts {{ sshd_ignore_rhosts | ternary("yes", "no", omit) }}'

- name: 'Set PasswordAuthentication to {{ sshd_passwd_auth | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PasswordAuthentication.*$'
    line: 'PasswordAuthentication {{ sshd_passwd_auth | ternary("yes", "no", omit) }}'

- name: 'Set PermitEmptyPasswords to {{ sshd_permit_empty_passwords | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PermitEmptyPasswords.*$'
    line: 'PermitEmptyPasswords {{ sshd_permit_empty_passwords | ternary("yes", "no", omit) }}'

- name: Set UsePAM to yes
  when: sshd_use_pam
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*UsePAM.*$'
    line: 'UsePAM yes'

- name: 'Set AllowAgentForwarding forwarding to {{ sshd_agent_forwarding | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*AllowAgentForwarding.*$'
    line: 'AllowAgentForwarding {{ sshd_agent_forwarding | ternary("yes", "no", omit) }}'

- name: 'Set AllowTcpForwarding to {{ sshd_tcp_forwarding | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*AllowTcpForwarding\s+yes$'
    line: 'AllowTcpForwarding {{ sshd_tcp_forwarding | ternary("yes", "no", omit) }}'

- name: 'Set GatewayPorts to {{ sshd_gateway_ports | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*GatewayPorts.*$'
    line: 'GatewayPorts {{ sshd_gateway_ports | ternary("yes", "no", omit) }}'

- name: 'Set X11 forwarding to {{ sshd_x11_forwarding | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*X11Forwarding.*$'
    line: 'X11Forwarding {{ sshd_x11_forwarding | ternary("yes", "no", omit) }}'

- name: 'Set PrintLastLog to {{ sshd_print_lastlog | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PrintLastLog.*$'
    line: 'PrintLastLog {{ sshd_print_lastlog | ternary("yes", "no", omit) }}'

- name: 'Set TCPKeepAlive to {{ sshd_tcp_keep_alive | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*TCPKeepAlive.*$'
    line: 'TCPKeepAlive {{ sshd_tcp_keep_alive | ternary("yes", "no", omit) }}'

- name: 'Set PermitUserEnvironment to {{ sshd_permit_user_env | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PermitUserEnvironment.*$'
    line: 'PermitUserEnvironment {{ sshd_permit_user_env | ternary("yes", "no", omit) }}'

- name: 'Set Compression to {{ sshd_compression | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*Compression.*$'
    line: 'Compression {{ sshd_compression | ternary("yes", "no", omit) }}'

- name: 'Set ClientAliveCountMax to {{ sshd_client_alive_count_max }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*ClientAliveCountMax.*$'
    line: 'ClientAliveCountMax {{ sshd_client_alive_count_max }}'

- name: 'Set UseDNS to {{ sshd_use_dns | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*UseDNS.*$'
    line: 'UseDNS {{ sshd_use_dns | ternary("yes", "no", omit) }}'

- name: 'Set PermitTunnel to {{ sshd_permit_tunnel | ternary("yes", "no", omit) }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#*PermitTunnel.*$'
    line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no", omit) }}'

- name: 'Set AllowUsers to {{ sshd_allow_users }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    line: 'AllowUsers {{ sshd_allow_users }}'
    insertafter: '^#*\s*VersionAddendum\s+none$'
    state: present
  when: sshd_allow_users

- name: 'Set AllowGroups to {{ sshd_allow_groups }}'
  lineinfile:
    path: /etc/ssh/sshd_config
    line: 'AllowGroups {{ sshd_allow_groups }}'
    insertafter: 'AllowUsers'
    state: present
  when: sshd_allow_groups
  notify: Restart SSH service

vars/Archlinux.yml

---
sshd_package_name: openssh

vars/Debian.yml

---
sshd_service_name: ssh
sshd_package_name: openssh-server

vars/OpenBSD.yml

---
sshd_config_user: root
sshd_config_group: wheel
sshd_use_pam: no

vars/RedHat.yml

---
sshd_package_name: openssh-server
\$\endgroup\$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.