mirror of
https://github.com/willshersystems/ansible-sshd
synced 2024-12-23 17:10:19 +01:00
128 lines
3.7 KiB
YAML
128 lines
3.7 KiB
YAML
|
---
|
||
|
- hosts: all
|
||
|
vars:
|
||
|
__sshd_test_backup_files:
|
||
|
- /etc/ssh/sshd_config
|
||
|
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||
|
tasks:
|
||
|
- name: "Backup configuration files"
|
||
|
ansible.builtin.include_tasks: tasks/backup.yml
|
||
|
|
||
|
##########
|
||
|
# First test: default port
|
||
|
##########
|
||
|
- name: Configure the role on default port and let it handle firewall settings
|
||
|
ansible.builtin.include_role:
|
||
|
name: ansible-sshd
|
||
|
vars:
|
||
|
sshd_manage_selinux: true
|
||
|
sshd_manage_firewall: true
|
||
|
sshd:
|
||
|
Port: 22
|
||
|
|
||
|
- name: Verify the options are correctly set
|
||
|
block:
|
||
|
- name: Flush handlers
|
||
|
ansible.builtin.meta: flush_handlers
|
||
|
|
||
|
- name: Print current configuration file
|
||
|
ansible.builtin.slurp:
|
||
|
src: "{{ main_sshd_config }}"
|
||
|
register: config
|
||
|
|
||
|
- name: Check the options are in configuration file
|
||
|
ansible.builtin.assert:
|
||
|
that:
|
||
|
- "'Port 22' in config.content | b64decode"
|
||
|
tags: tests::verify
|
||
|
|
||
|
##########
|
||
|
# Second test: non-default port
|
||
|
##########
|
||
|
# is this going to break some tests running ansible through ssh?
|
||
|
- name: Configure the role on another port and let it handle firewall settings
|
||
|
ansible.builtin.include_role:
|
||
|
name: ansible-sshd
|
||
|
vars:
|
||
|
sshd_manage_firewall: true
|
||
|
sshd_manage_selinux: true
|
||
|
sshd:
|
||
|
Port: 222
|
||
|
|
||
|
- name: Verify the options are correctly set
|
||
|
block:
|
||
|
- name: Flush handlers
|
||
|
ansible.builtin.meta: flush_handlers
|
||
|
|
||
|
- name: Print current configuration file
|
||
|
ansible.builtin.slurp:
|
||
|
src: "{{ main_sshd_config }}"
|
||
|
register: config
|
||
|
|
||
|
- name: Check the options are in configuration file
|
||
|
ansible.builtin.assert:
|
||
|
that:
|
||
|
- "'Port 222' in config.content | b64decode"
|
||
|
tags: tests::verify
|
||
|
|
||
|
##########
|
||
|
# Third test: multiple ports
|
||
|
##########
|
||
|
- name: Configure the role on several ports and let it handle firewall settings
|
||
|
ansible.builtin.include_role:
|
||
|
name: ansible-sshd
|
||
|
vars:
|
||
|
sshd_manage_firewall: true
|
||
|
sshd_manage_selinux: true
|
||
|
sshd:
|
||
|
Port:
|
||
|
- 22
|
||
|
- 222
|
||
|
|
||
|
- name: Verify the options are correctly set
|
||
|
block:
|
||
|
- name: Flush handlers
|
||
|
ansible.builtin.meta: flush_handlers
|
||
|
|
||
|
- name: Print current configuration file
|
||
|
ansible.builtin.slurp:
|
||
|
src: "{{ main_sshd_config }}"
|
||
|
register: config
|
||
|
|
||
|
- name: Check the options are in configuration file
|
||
|
ansible.builtin.assert:
|
||
|
that:
|
||
|
- "'Port 222' in config.content | b64decode"
|
||
|
tags: tests::verify
|
||
|
|
||
|
##########
|
||
|
# Cleanup
|
||
|
##########
|
||
|
- name: "Restore configuration files"
|
||
|
ansible.builtin.include_tasks: tasks/restore.yml
|
||
|
|
||
|
- name: Remove the modification to the firewall rules
|
||
|
ansible.builtin.include_role:
|
||
|
name: fedora.linux_system_roles.firewall
|
||
|
vars:
|
||
|
firewall:
|
||
|
- port: "222/tcp"
|
||
|
state: disabled
|
||
|
when:
|
||
|
- ansible_facts['os_family'] == 'RedHat'
|
||
|
- ansible_virtualization_type|default(None) not in __sshd_skip_virt_env
|
||
|
|
||
|
- name: Remove the modification to the selinux policy
|
||
|
ansible.builtin.include_role:
|
||
|
name: fedora.linux_system_roles.firewall
|
||
|
vars:
|
||
|
selinux:
|
||
|
port: 222
|
||
|
proto: tcp
|
||
|
setype: ssh_port_t
|
||
|
state: absent
|
||
|
local: true
|
||
|
when:
|
||
|
- ansible_facts['os_family'] == 'RedHat'
|
||
|
- ansible_virtualization_type|default(None) not in __sshd_skip_virt_env
|