1
0
Fork 0
mirror of https://github.com/roles-ansible/ansible_role_sshd.git synced 2024-08-16 11:59:49 +02:00
ansible_role_sshd/tasks/main.yml
2020-04-13 17:59:47 +02:00

76 lines
1.9 KiB
YAML

---
- name: combine sshd variable
set_fact:
sshd: "{{ _sshd|combine(sshd, recursive=True) }}"
- include_tasks: versioncheck.yml
when: submodules_versioncheck|bool
- name: set sshd_service variable
block:
- name: read os specific variable
include_vars: "vars/sshd_{{ ansible_distribution | lower }}.yml"
rescue:
- name: read default variable
include_vars: vars/sshd_default.yml
- name: Collect all users and groups allowed to login via ssh
set_fact:
sshd_allowed_users: '{{ sshd.allowed_users + users.keys() | default({}) | sort }}'
sshd_allowed_groups: '{{ sshd.allowed_groups + users.keys() | default({}) | sort }}'
- name: Generate new ssh host key pair if necessary
become: yes
command: ssh-keygen -t ecdsa -f 'ssh_host_{{ item }}_key' -P '' -q
args:
chdir: '/etc/ssh/'
creates: 'ssh_host_{{ item }}_key.pub'
notify:
- systemctrl restart ssh
with_items: "{{ sshd.key_types }}"
when:
- sshd.manage_key_types | bool
- name: Remove unwanted host keys
become: yes
file:
path: '/etc/ssh/ssh_host_{{ item }}_key'
state: absent
with_items:
- rsa
- dsa
notify:
- systemctrl restart ssh
- name: make sure the correct keys are available
file:
path: '/etc/ssh/ssh_host_{{ item }}_key'
state: absent
become: yes
with_items:
- "{{ sshd_key_types_list | difference( sshd.key_types ) }}"
notify:
- systemctrl restart ssh
- name: make sure the correct pubkeys are available
file:
path: '/etc/ssh/ssh_host_{{ item }}_key.pub'
state: absent
become: yes
with_items:
- "{{ sshd_key_types_list | difference( sshd.key_types ) }}"
notify:
- systemctrl restart ssh
- name: Copy sshd configuration
become: yes
template:
src: sshd_config.j2
dest: '/etc/ssh/sshd_config'
owner: root
group: root
mode: 'u=rw,g=r,o=r'
validate: /usr/sbin/sshd -t -f %s
backup: yes
notify:
- systemctrl restart ssh