From de2826bb21b102d02c240bf2fda5c4edae05ba97 Mon Sep 17 00:00:00 2001
From: Lars Wirzenius <liw@liw.fi>
Date: Tue, 11 Oct 2022 08:58:26 +0300
Subject: sshd: guard against a common misconfiguration of mine

Sponsored-by: author
---
 roles/sshd/tasks/main.yml | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'roles')

diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml
index 9cd2057..66f9103 100644
--- a/roles/sshd/tasks/main.yml
+++ b/roles/sshd/tasks/main.yml
@@ -3,6 +3,12 @@
     [ "{{ sshd_version }}" = "1" ] || \
       (echo "Unexpected version {{ sshd_version }}" 1>&2; exit 1)
 
+- name: "sshd role configuration sanity check"
+  when: not sshd_allow_authorized_keys and sshd_user_ca_pub is not defined
+  shell: |
+    echo "You MUST define sshd_allow_authorized_keys OR sshd_user_ca_pub"
+    exit 1
+
 - name: "Configure SSH server to read config files in sshd_config.d"
   lineinfile:
     path: /etc/ssh/sshd_config
-- 
cgit v1.2.1