diff options
author | Lars Wirzenius <liw@liw.fi> | 2022-07-31 17:50:37 +0300 |
---|---|---|
committer | Lars Wirzenius <liw@liw.fi> | 2022-07-31 17:50:37 +0300 |
commit | 66e7ecebce239a3c59696786fb776f5d729831b1 (patch) | |
tree | a7ec105c55218edc4b350ad8bcc2d660d879079b /roles/sshd/tasks/main.yml | |
parent | 48730af77bfd45478250a52e747b00a36f716e47 (diff) | |
download | debian-ansible-66e7ecebce239a3c59696786fb776f5d729831b1.tar.gz |
sshd: add
Sponsored-by: author
Diffstat (limited to 'roles/sshd/tasks/main.yml')
-rw-r--r-- | roles/sshd/tasks/main.yml | 63 |
1 files changed, 63 insertions, 0 deletions
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml new file mode 100644 index 0000000..f4c2104 --- /dev/null +++ b/roles/sshd/tasks/main.yml @@ -0,0 +1,63 @@ +- name: "sshd role version" + shell: | + [ "{{ sshd_version }}" = "1" ] || \ + (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1) + +- name: "Set SSH host identity" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + {{ sshd_host_key }} + dest: /etc/ssh/ssh_host_key + owner: root + group: root + mode: 0600 + notify: sshd_restart + +- name: "Set SSH host certificate" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + {{ sshd_host_cert }} + dest: /etc/ssh/ssh_host_key-cert.pub + notify: sshd_restart + +- name: "Configure SSH server host key" + when: sshd_host_key is defined and sshd_host_cert is defined + copy: + content: | + HostKeyAlgorithms ssh-ed25519 + HostKey /etc/ssh/ssh_host_key + HostCertificate /etc/ssh/ssh_host_key-cert.pub + dest: /etc/ssh/sshd_config.d/host_id.conf + notify: sshd_restart + +- name: "Remove obsolete SSH host keys and certificates" + when: sshd_host_key is defined and sshd_host_cert is defined + shell: | + find /etc/ssh -maxdepth 1 -type f -name "ssh_host_*_key*" -delete + notify: sshd_restart + +- name: "Configure SSH server port" + when: sshd_port is defined + copy: + content: | + Port {{ sshd_port }} + dest: /etc/ssh/sshd_config.d/port.conf + notify: sshd_restart + +- name: "Configure user CA for SSH server" + when: sshd_user_ca_pub is defined + copy: + content: | + {{ sshd_user_ca_pub }} + dest: /etc/ssh/user_ca_pubs + notify: sshd_restart + +- name: "Configure SSH server to accept user CA" + when: sshd_user_ca_pub is defined + copy: + content: | + TrustedUserCAKeys /etc/ssh/user_ca_pubs + dest: /etc/ssh/sshd_config.d/user_ca.conf + notify: sshd_restart |