diff options
| -rw-r--r-- | ansible/ssh-dev.yml | 52 |
1 files changed, 51 insertions, 1 deletions
diff --git a/ansible/ssh-dev.yml b/ansible/ssh-dev.yml index 889c72b..d05cca4 100644 --- a/ansible/ssh-dev.yml +++ b/ansible/ssh-dev.yml @@ -5,6 +5,41 @@ - role: sane_debian_system - role: unix_users tasks: + - name: "Set SSH host identity" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + {{ sshd_host_key }} + dest: /etc/ssh/ssh_host_key + owner: root + group: root + mode: 0600 + notify: sshd_restart + + - name: "Set SSH host certificate" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + {{ sshd_host_cert }} + dest: /etc/ssh/ssh_host_key-cert.pub + notify: sshd_restart + + - name: "Configure SSH server host key" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + HostKeyAlgorithms ssh-ed25519 + HostKey /etc/ssh/ssh_host_key + HostCertificate /etc/ssh/ssh_host_key-cert.pub + dest: /etc/ssh/sshd_config.d/host_id.conf + notify: sshd_restart + + - name: "Remove obsolete SSH host keys and certificates" + when: sshd_host_key is defined and sshd_host_cert is defined + shell: | + find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete + notify: sshd_restart + - name: "Configure SSH server port" when: sshd_port is defined copy: @@ -12,23 +47,28 @@ Port {{ sshd_port }} dest: /etc/ssh/sshd_config.d/port.conf notify: sshd_restart + - name: "Configure user CA for SSH server" when: sshd_user_ca_pub is defined copy: content: | {{ sshd_user_ca_pub }} dest: /etc/ssh/user_ca_pubs + notify: sshd_restart + - name: "Configure SSH server to accept user CA" when: sshd_user_ca_pub is defined copy: content: | TrustedUserCAKeys /etc/ssh/user_ca_pubs dest: /etc/ssh/sshd_config.d/user_ca.conf + notify: sshd_restart + handlers: - name: sshd_restart systemd: name: ssh - state: reloaded + state: restarted vars: ansible_python_interpreter: /usr/bin/python3 @@ -44,3 +84,13 @@ sshd_port: 22 sshd_user_ca_pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdSnGI91exKItWsZi0XFVQWluS0FUdd12FLjuQk1FxG liw User CA v1 + sshd_host_key: | + -----BEGIN OPENSSH PRIVATE KEY----- + b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW + QyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuAAAAJD/iISQ/4iE + kAAAAAtzc2gtZWQyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuA + AAAEAsqoHFGyZZzwgNSfofP9NAwwMJMaKltYXkwBMfONIZ1vj3Fh2aN9WnR3KWIe8syz69 + mc8VVnjnLI+9YBVV4eG4AAAACmxpd0Bzb2xhY2UBAgM= + -----END OPENSSH PRIVATE KEY----- + sshd_host_cert: ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIEJUVm2WJkZ0r+KFXpk2RHb7qMZHTKUwLdTyxb9AuREpAAAAIPj3Fh2aN9WnR3KWIe8syz69mc8VVnjnLI+9YBVV4eG4AAAAAAAAAAAAAAACAAAAIGhvc3QgY2VydGlmaWNhdGUgZm9yIC1udGVzdCBvbmx5AAAACAAAAAR0ZXN0AAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgvfQa9RoKfpcBZturxQz5/vrj0Gc76JzMW0rOKmYK90gAAABTAAAAC3NzaC1lZDI1NTE5AAAAQM5t7a4I4/IQPimHYXcj64iiAcCqzTSJcoQBrUwrTspGi5O1/3ibmbShwZJihmcYpCpFMTmA2nvO5+cqguSIlAo= liw@solace + |