sshd: guard against a common misconfiguration of mine

Sponsored-by: author

1 files changed, 6 insertions, 0 deletions

diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 9cd2057..66f9103 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -3,6 +3,12 @@
     [ "{{ sshd_version }}" = "1" ] || \
       (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1)
 
+- name: "sshd role configuration sanity check"
+  when: not sshd_allow_authorized_keys and sshd_user_ca_pub is not defined
+  shell: |
+    echo "You MUST define sshd_allow_authorized_keys OR sshd_user_ca_pub"
+    exit 1
+
 - name: "Configure SSH server to read config files in sshd_config.d"
   lineinfile:
     path: /etc/ssh/sshd_config