ansible-sshd/vars/Fedora.yml

---
sshd_packages:
  - openssh
  - openssh-server
sshd_sftp_server: /usr/libexec/openssh/sftp-server
# Fedora 32 ships with drop-in directory support so we touch
# just included file with highest priority by default and have
# empty defaults
__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf
__sshd_defaults:
__sshd_os_supported: yes
__sshd_verify_hostkeys_default:
  - /etc/ssh/ssh_host_rsa_key
  - /etc/ssh/ssh_host_ecdsa_key
  - /etc/ssh/ssh_host_ed25519_key
__sshd_hostkeys_nofips:
  - /etc/ssh/ssh_host_ed25519_key
__sshd_hostkey_group: ssh_keys
__sshd_hostkey_mode: "0640"
Add Fedora support Based on RedHat 7 with few modifications (ed25519 hostkey for F22, GSSAPICleanupCredentials defaults to no, s/LC_TYPE/LC_CTYPE/ in AcceptEnv). Tested on Fedora 20 & 22. 2015-06-26 11:23:42 +02:00			`---`
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices 2020-11-04 21:29:48 +01:00			`sshd_packages:`
Add Fedora support Based on RedHat 7 with few modifications (ed25519 hostkey for F22, GSSAPICleanupCredentials defaults to no, s/LC_TYPE/LC_CTYPE/ in AcceptEnv). Tested on Fedora 20 & 22. 2015-06-26 11:23:42 +02:00			`- openssh`
			`- openssh-server`
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices 2020-11-04 21:29:48 +01:00			`sshd_sftp_server: /usr/libexec/openssh/sftp-server`
Update defaults for Fedora supporting Include keyword 2020-09-18 14:09:24 +02:00			`# Fedora 32 ships with drop-in directory support so we touch`
			`# just included file with highest priority by default and have`
			`# empty defaults`
Use proper variable precedence for configuratil file variables 2021-06-02 12:03:28 +02:00			`__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf`
Renames variables for all supported platforms 2018-09-03 00:23:58 +02:00			`__sshd_defaults:`
			`__sshd_os_supported: yes`
Introduce default hostkeys to check when using drop-in directory Previously no hostkeys were checked if they were not present in the generated configuration file. When the drop-in directory is used, usually, there are no hostkeys in that file and no sanity check for hostkeys was executed. This amends the "auto" value for the hostkeys check to allow checking for default hostkeys that are read by OpenSSH by default. Signed-off-by: Jakub Jelen <jjelen@redhat.com> 2022-04-11 13:07:44 +02:00			`__sshd_verify_hostkeys_default:`
			`- /etc/ssh/ssh_host_rsa_key`
			`- /etc/ssh/ssh_host_ecdsa_key`
			`- /etc/ssh/ssh_host_ed25519_key`
			`__sshd_hostkeys_nofips:`
			`- /etc/ssh/ssh_host_ed25519_key`
Fix variable precedence for sshd_hostkey_* variables This worked fine with the new include_role: invocation, but not with the old roles: invocation. 2021-06-02 11:17:39 +02:00			`__sshd_hostkey_group: ssh_keys`
			`__sshd_hostkey_mode: "0640"`