From 482256a59d80f80e686aeec09d5ebbeb64fdfb31 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Sun, 31 Jul 2022 17:22:00 +0300
Subject: ssh-dev: set host identity

Sponsored-by: author
---
 ansible/ssh-dev.yml | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

(limited to 'ansible/ssh-dev.yml')

diff --git a/ansible/ssh-dev.yml b/ansible/ssh-dev.yml
index 889c72b..d05cca4 100644
--- a/ansible/ssh-dev.yml
+++ b/ansible/ssh-dev.yml
@@ -5,6 +5,41 @@
     - role: sane_debian_system
     - role: unix_users
   tasks:
+    - name: "Set SSH host identity"
+      when: sshd_host_key is defined and sshd_host_cert is defined
+      copy:
+        content: |
+          {{ sshd_host_key }}
+        dest: /etc/ssh/ssh_host_key
+        owner: root
+        group: root
+        mode: 0600
+      notify: sshd_restart
+
+    - name: "Set SSH host certificate"
+      when: sshd_host_key is defined and sshd_host_cert is defined
+      copy:
+        content: |
+          {{ sshd_host_cert }}
+        dest: /etc/ssh/ssh_host_key-cert.pub
+      notify: sshd_restart
+
+    - name: "Configure SSH server host key"
+      when: sshd_host_key is defined and sshd_host_cert is defined
+      copy:
+        content: |
+          HostKeyAlgorithms ssh-ed25519
+          HostKey /etc/ssh/ssh_host_key
+          HostCertificate /etc/ssh/ssh_host_key-cert.pub
+        dest: /etc/ssh/sshd_config.d/host_id.conf
+      notify: sshd_restart
+
+    - name: "Remove obsolete SSH host keys and certificates"
+      when: sshd_host_key is defined and sshd_host_cert is defined
+      shell: |
+        find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
+      notify: sshd_restart
+
     - name: "Configure SSH server port"
       when: sshd_port is defined
       copy:
@@ -12,23 +47,28 @@
           Port {{ sshd_port }}
         dest: /etc/ssh/sshd_config.d/port.conf
       notify: sshd_restart
+
     - name: "Configure user CA for SSH server"
       when: sshd_user_ca_pub is defined
       copy:
         content: |
           {{ sshd_user_ca_pub }}
         dest: /etc/ssh/user_ca_pubs
+      notify: sshd_restart
+
     - name: "Configure SSH server to accept user CA"
       when: sshd_user_ca_pub is defined
       copy:
         content: |
           TrustedUserCAKeys /etc/ssh/user_ca_pubs
         dest: /etc/ssh/sshd_config.d/user_ca.conf
+      notify: sshd_restart
+
   handlers:
     - name: sshd_restart
       systemd:
         name: ssh
-        state: reloaded
+        state: restarted
   vars:
     ansible_python_interpreter: /usr/bin/python3
 
@@ -44,3 +84,13 @@
     sshd_port: 22
     sshd_user_ca_pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdSnGI91exKItWsZi0XFVQWluS0FUdd12FLjuQk1FxG liw User CA v1
 
+    sshd_host_key: |
+      -----BEGIN OPENSSH PRIVATE KEY-----
+      b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+      QyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuAAAAJD/iISQ/4iE
+      kAAAAAtzc2gtZWQyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuA
+      AAAEAsqoHFGyZZzwgNSfofP9NAwwMJMaKltYXkwBMfONIZ1vj3Fh2aN9WnR3KWIe8syz69
+      mc8VVnjnLI+9YBVV4eG4AAAACmxpd0Bzb2xhY2UBAgM=
+      -----END OPENSSH PRIVATE KEY-----
+    sshd_host_cert: ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIEJUVm2WJkZ0r+KFXpk2RHb7qMZHTKUwLdTyxb9AuREpAAAAIPj3Fh2aN9WnR3KWIe8syz69mc8VVnjnLI+9YBVV4eG4AAAAAAAAAAAAAAACAAAAIGhvc3QgY2VydGlmaWNhdGUgZm9yIC1udGVzdCBvbmx5AAAACAAAAAR0ZXN0AAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgvfQa9RoKfpcBZturxQz5/vrj0Gc76JzMW0rOKmYK90gAAABTAAAAC3NzaC1lZDI1NTE5AAAAQM5t7a4I4/IQPimHYXcj64iiAcCqzTSJcoQBrUwrTspGi5O1/3ibmbShwZJihmcYpCpFMTmA2nvO5+cqguSIlAo= liw@solace
+
-- 
cgit v1.2.1