blob: d05cca4b243285cd15313f604d2ca13c9bcdf64f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
- hosts: ssh-dev
remote_user: debian
become: yes
roles:
- role: sane_debian_system
- role: unix_users
tasks:
- name: "Set SSH host identity"
when: sshd_host_key is defined and sshd_host_cert is defined
copy:
content: |
{{ sshd_host_key }}
dest: /etc/ssh/ssh_host_key
owner: root
group: root
mode: 0600
notify: sshd_restart
- name: "Set SSH host certificate"
when: sshd_host_key is defined and sshd_host_cert is defined
copy:
content: |
{{ sshd_host_cert }}
dest: /etc/ssh/ssh_host_key-cert.pub
notify: sshd_restart
- name: "Configure SSH server host key"
when: sshd_host_key is defined and sshd_host_cert is defined
copy:
content: |
HostKeyAlgorithms ssh-ed25519
HostKey /etc/ssh/ssh_host_key
HostCertificate /etc/ssh/ssh_host_key-cert.pub
dest: /etc/ssh/sshd_config.d/host_id.conf
notify: sshd_restart
- name: "Remove obsolete SSH host keys and certificates"
when: sshd_host_key is defined and sshd_host_cert is defined
shell: |
find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete
notify: sshd_restart
- name: "Configure SSH server port"
when: sshd_port is defined
copy:
content: |
Port {{ sshd_port }}
dest: /etc/ssh/sshd_config.d/port.conf
notify: sshd_restart
- name: "Configure user CA for SSH server"
when: sshd_user_ca_pub is defined
copy:
content: |
{{ sshd_user_ca_pub }}
dest: /etc/ssh/user_ca_pubs
notify: sshd_restart
- name: "Configure SSH server to accept user CA"
when: sshd_user_ca_pub is defined
copy:
content: |
TrustedUserCAKeys /etc/ssh/user_ca_pubs
dest: /etc/ssh/sshd_config.d/user_ca.conf
notify: sshd_restart
handlers:
- name: sshd_restart
systemd:
name: ssh
state: restarted
vars:
ansible_python_interpreter: /usr/bin/python3
sane_debian_system_version: 2
sane_debian_system_hostname: "{{ inventory_hostname }}"
sane_debian_system_codename: bullseye
sane_debian_system_mirror: deb.debian.org
unix_users_version: 2
unix_users:
- username: liw
sshd_port: 22
sshd_user_ca_pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdSnGI91exKItWsZi0XFVQWluS0FUdd12FLjuQk1FxG liw User CA v1
sshd_host_key: |
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuAAAAJD/iISQ/4iE
kAAAAAtzc2gtZWQyNTUxOQAAACD49xYdmjfVp0dyliHvLMs+vZnPFVZ45yyPvWAVVeHhuA
AAAEAsqoHFGyZZzwgNSfofP9NAwwMJMaKltYXkwBMfONIZ1vj3Fh2aN9WnR3KWIe8syz69
mc8VVnjnLI+9YBVV4eG4AAAACmxpd0Bzb2xhY2UBAgM=
-----END OPENSSH PRIVATE KEY-----
sshd_host_cert: ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIEJUVm2WJkZ0r+KFXpk2RHb7qMZHTKUwLdTyxb9AuREpAAAAIPj3Fh2aN9WnR3KWIe8syz69mc8VVnjnLI+9YBVV4eG4AAAAAAAAAAAAAAACAAAAIGhvc3QgY2VydGlmaWNhdGUgZm9yIC1udGVzdCBvbmx5AAAACAAAAAR0ZXN0AAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgvfQa9RoKfpcBZturxQz5/vrj0Gc76JzMW0rOKmYK90gAAABTAAAAC3NzaC1lZDI1NTE5AAAAQM5t7a4I4/IQPimHYXcj64iiAcCqzTSJcoQBrUwrTspGi5O1/3ibmbShwZJihmcYpCpFMTmA2nvO5+cqguSIlAo= liw@solace
|
