ansible-sshd/tasks/install_service.yml

55 lines
1.8 KiB
YAML
Raw Normal View History

---
- name: Install systemd service files
when:
- sshd_install_service | bool
- ansible_facts['service_mgr'] == 'systemd' or
(ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7')
block:
- name: Install service unit file
2022-06-03 12:22:17 +02:00
ansible.builtin.template:
src: "{{ sshd_service_template_service }}"
dest: "/etc/systemd/system/{{ sshd_service }}.service"
owner: root
group: root
mode: "0644"
notify: Reload_sshd
- name: Install instanced service unit file
2022-06-03 12:22:17 +02:00
ansible.builtin.template:
src: "{{ sshd_service_template_at_service }}"
dest: "/etc/systemd/system/{{ sshd_service }}@.service"
owner: root
group: root
mode: "0644"
notify: Reload_sshd
when:
- __sshd_socket_accept | bool
- name: Install socket unit file
2022-06-03 12:22:17 +02:00
ansible.builtin.template:
src: "{{ sshd_service_template_socket }}"
dest: "/etc/systemd/system/{{ sshd_service }}.socket"
owner: root
group: root
mode: "0644"
notify: Reload_sshd
- name: Service enabled and running
2022-06-03 12:22:17 +02:00
ansible.builtin.service:
name: "{{ sshd_service }}"
enabled: true
state: started
when:
- sshd_manage_service|bool
- ansible_facts['virtualization_type'] | default(None) not in __sshd_skip_virt_env
- ansible_connection != 'chroot'
# Due to ansible bug 21026, cannot use service module on RHEL 7
- name: Enable service in chroot
fix: use quote with command, shell and validate with variable (#298) * robustness: quote test backup/restore file names This avoids issues if file names are not safepaths. * security: use quote with command, shell and validate with variable Skip quotation only if variable is checked. Add test suit to excercise some quote use cases. * robustness: fail if systemd.unit could have something in need of quote Ensure systemd.unit contents is robust. This disables possibility to have something that needs to be quoted there. But as ansible lacks proper way to quote systemd unit files (see man systemd.syntax, rules are not shell rules), it is better to fail such configs. If you are trying to do that, you are doing it wrong anyway or have malicious intent. Also ensure similar issue with sysctl.conf. Issue can be seen with `tests_hostkeys_unsafe_path.yml`, when adding following to role params: sshd_install_service: true sshd_config_file: "{{ ansible_facts.env.TMPDIR }}/sshd.d/foo.conf" sshd_binary: "{{ ansible_facts.env.TMPDIR }}/sshd" __sshd_runtime_directory: "{{ ansible_facts.env.TMPDIR }}/run" * tests: Quote also the source filename Signed-off-by: Jakub Jelen <jjelen@redhat.com> * tests: Add more negative test cases Signed-off-by: Jakub Jelen <jjelen@redhat.com> * tests: Skip the test with unsafe TMPDIR as it does not work on CentOS8 Signed-off-by: Jakub Jelen <jjelen@redhat.com> * Move the variable checks to separate file ... ... and explain better why this is problematic Drops also the check for internal variables as the user should not bother with these. Signed-off-by: Jakub Jelen <jjelen@redhat.com> --------- Signed-off-by: Jakub Jelen <jjelen@redhat.com> Co-authored-by: Markus Linnala <Markus.Linnala@knowit.fi>
2024-09-12 08:24:22 +02:00
ansible.builtin.command: systemctl enable {{ sshd_service | quote }} # noqa command-instead-of-module
when:
- ansible_connection == 'chroot'
- ansible_facts['os_family'] == 'RedHat'
- ansible_facts['distribution_major_version'] | int >= 7
changed_when: true