ansible-sshd/vars/Fedora.yml

---
__sshd_os_supported: true

__sshd_packages:
  - openssh
  - openssh-server
__sshd_sftp_server: /usr/libexec/openssh/sftp-server
# Fedora 32 ships with drop-in directory support so we touch
# just included file with highest priority by default
__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf
# the defaults here represent the defaults shipped in the main sshd_config
__sshd_defaults:
  Include: /etc/ssh/sshd_config.d/*.conf
  AuthorizedKeysFile: .ssh/authorized_keys
  Subsystem: sftp /usr/libexec/sftp-server

__sshd_verify_hostkeys_default:
  - /etc/ssh/ssh_host_rsa_key
  - /etc/ssh/ssh_host_ecdsa_key
  - /etc/ssh/ssh_host_ed25519_key
__sshd_hostkeys_nofips:
  - /etc/ssh/ssh_host_ed25519_key

__sshd_drop_in_dir_mode: '0700'
__sshd_main_config_file: /etc/ssh/sshd_config
Add Fedora support Based on RedHat 7 with few modifications (ed25519 hostkey for F22, GSSAPICleanupCredentials defaults to no, s/LC_TYPE/LC_CTYPE/ in AcceptEnv). Tested on Fedora 20 & 22. 2015-06-26 11:23:42 +02:00			`---`
ansible-lint - align with current Ansible recommendations Use `true/false` instead of `yes/no` Ensure use of FQCN for builtin modules Use correct spacing in Jinja expressions All tasks and plays must have a `name`, and the `name` string must begin with an uppercase letter Use `ansible.posix.mount` instead of `ansible.builtin.mount` Use `set -o pipefail` with `shell` module where supported by the platform shell Signed-off-by: Rich Megginson <rmeggins@redhat.com> 2023-04-10 22:19:29 +02:00			`__sshd_os_supported: true`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00
Fixes un-overrideable public api variables 2022-08-17 13:53:56 +02:00			`__sshd_packages:`
Add Fedora support Based on RedHat 7 with few modifications (ed25519 hostkey for F22, GSSAPICleanupCredentials defaults to no, s/LC_TYPE/LC_CTYPE/ in AcceptEnv). Tested on Fedora 20 & 22. 2015-06-26 11:23:42 +02:00			`- openssh`
			`- openssh-server`
Fixes un-overrideable public api variables 2022-08-17 13:53:56 +02:00			`__sshd_sftp_server: /usr/libexec/openssh/sftp-server`
Update defaults for Fedora supporting Include keyword 2020-09-18 14:09:24 +02:00			`# Fedora 32 ships with drop-in directory support so we touch`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00			`# just included file with highest priority by default`
Use proper variable precedence for configuratil file variables 2021-06-02 12:03:28 +02:00			`__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00			`# the defaults here represent the defaults shipped in the main sshd_config`
Renames variables for all supported platforms 2018-09-03 00:23:58 +02:00			`__sshd_defaults:`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00			`Include: /etc/ssh/sshd_config.d/*.conf`
			`AuthorizedKeysFile: .ssh/authorized_keys`
			`Subsystem: sftp /usr/libexec/sftp-server`

Introduce default hostkeys to check when using drop-in directory Previously no hostkeys were checked if they were not present in the generated configuration file. When the drop-in directory is used, usually, there are no hostkeys in that file and no sanity check for hostkeys was executed. This amends the "auto" value for the hostkeys check to allow checking for default hostkeys that are read by OpenSSH by default. Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-11 13:07:44 +02:00			`__sshd_verify_hostkeys_default:`
			`- /etc/ssh/ssh_host_rsa_key`
			`- /etc/ssh/ssh_host_ecdsa_key`
			`- /etc/ssh/ssh_host_ed25519_key`
			`__sshd_hostkeys_nofips:`
			`- /etc/ssh/ssh_host_ed25519_key`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00
tMakes drop-in functionality configurable by the user 2022-08-17 16:34:35 +02:00			`__sshd_drop_in_dir_mode: '0700'`
Verify the Include is in main configuration file ... if drop-in file is modified Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-06 14:01:13 +02:00			`__sshd_main_config_file: /etc/ssh/sshd_config`