mirror of
https://github.com/willshersystems/ansible-sshd
synced 2024-11-09 21:23:29 +01:00
Fix issues found by linters - enable all tests on all repos - remove suppressions
Cleaning up yamllint errors. - Use .yamllint.yml and .yamllint_defaults.yml instead of .yamllint.yaml. - Fix the invalid indentations. Cleaning up ansible-lint errors. - Add "name" to every task. - Use command rather than shell - Add "changed_when: false". - Use '|' instead of '>' for the shell module. - Fix '/bin/sh: line 3: CRYPTO_POLICY: unbound variable'. - Add "set -eu" and "set -o pipefail" if pipefail is available. Note: "pipefail" is not available in "sh" and "dash". - Add "- '306' # Shells that use pipes should set the pipefail option" to .ansible-lint since ansible-lint does not recognize it if it's set in "if set -o | grep pipefail". RHELPLAN-73804
This commit is contained in:
parent
428d390668
commit
6887864d2c
31 changed files with 831 additions and 765 deletions
|
@ -1,2 +1,3 @@
|
|||
warn_list: # or 'skip_list' to silence them completely │
|
||||
- '106' # Role name {} does not match ``^[a-z][a-z0-9_]+$`` pattern
|
||||
- '306' # Shells that use pipes should set the pipefail option
|
||||
|
|
15
.github/workflows/ansible-centos7.yml
vendored
15
.github/workflows/ansible-centos7.yml
vendored
|
@ -6,11 +6,12 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with centos:7
|
||||
uses: roles-ansible/check-ansible-centos-centos7-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with centos:7
|
||||
uses: roles-ansible/check-ansible-centos-centos7-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
15
.github/workflows/ansible-centos8.yml
vendored
15
.github/workflows/ansible-centos8.yml
vendored
|
@ -6,11 +6,12 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with centos:8
|
||||
uses: roles-ansible/check-ansible-centos-centos8-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with centos:8
|
||||
uses: roles-ansible/check-ansible-centos-centos8-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
17
.github/workflows/ansible-debian-buster.yml
vendored
17
.github/workflows/ansible-debian-buster.yml
vendored
|
@ -6,12 +6,13 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v2
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with debian:buster (10)
|
||||
uses: roles-ansible/check-ansible-debian-buster-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with debian:buster (10)
|
||||
uses: roles-ansible/check-ansible-debian-buster-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
17
.github/workflows/ansible-debian-stretch.yml
vendored
17
.github/workflows/ansible-debian-stretch.yml
vendored
|
@ -6,12 +6,13 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v2
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with debian:stretch (9)
|
||||
uses: roles-ansible/check-ansible-debian-stretch-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with debian:stretch (9)
|
||||
uses: roles-ansible/check-ansible-debian-stretch-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
17
.github/workflows/ansible-debian.yml
vendored
17
.github/workflows/ansible-debian.yml
vendored
|
@ -6,12 +6,13 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v2
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with debian:latest
|
||||
uses: roles-ansible/check-ansible-debian-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with debian:latest
|
||||
uses: roles-ansible/check-ansible-debian-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
17
.github/workflows/ansible-fedora.yml
vendored
17
.github/workflows/ansible-fedora.yml
vendored
|
@ -6,12 +6,13 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v2
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with fedora:latest
|
||||
uses: roles-ansible/check-ansible-fedora-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with fedora:latest
|
||||
uses: roles-ansible/check-ansible-fedora-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
49
.github/workflows/ansible-lint.yml
vendored
49
.github/workflows/ansible-lint.yml
vendored
|
@ -3,32 +3,35 @@ name: Ansible Lint # feel free to pick your own name
|
|||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
# test-ansible28:
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - uses: actions/checkout@v2
|
||||
# - name: Lint Ansible Playbook
|
||||
# uses: ansible/ansible-lint-action@master
|
||||
# with:
|
||||
# targets: "tests/test_*.yml"
|
||||
# override-deps: |
|
||||
# ansible==2.8
|
||||
# args: ""
|
||||
# test-ansible29:
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - uses: actions/checkout@v2
|
||||
# - name: Lint Ansible Playbook
|
||||
# uses: ansible/ansible-lint-action@master
|
||||
# with:
|
||||
# targets: "tests/test_*.yml"
|
||||
# override-deps: |
|
||||
# ansible==2.9
|
||||
# args: ""
|
||||
# test-ansible28:
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - name: checkout PR
|
||||
# uses: actions/checkout@v2
|
||||
# - name: Lint Ansible Playbook
|
||||
# uses: ansible/ansible-lint-action@master
|
||||
# with:
|
||||
# targets: "tests/test_*.yml"
|
||||
# override-deps: |
|
||||
# ansible==2.8
|
||||
# args: ""
|
||||
# test-ansible29:
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - name: checkout PR
|
||||
# uses: actions/checkout@v2
|
||||
# - name: Lint Ansible Playbook
|
||||
# uses: ansible/ansible-lint-action@master
|
||||
# with:
|
||||
# targets: "tests/test_*.yml"
|
||||
# override-deps: |
|
||||
# ansible==2.9
|
||||
# args: ""
|
||||
test-ansible210:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
- name: Lint Ansible Playbook
|
||||
uses: ansible/ansible-lint-action@master
|
||||
with:
|
||||
|
|
17
.github/workflows/ansible-ubuntu.yml
vendored
17
.github/workflows/ansible-ubuntu.yml
vendored
|
@ -6,12 +6,13 @@ jobs:
|
|||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- uses: actions/checkout@v2
|
||||
# Important: This sets up your GITHUB_WORKSPACE environment variable
|
||||
- name: checkout PR
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: ansible check with ubuntu:latest
|
||||
uses: roles-ansible/check-ansible-ubuntu-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
- name: ansible check with ubuntu:latest
|
||||
uses: roles-ansible/check-ansible-ubuntu-latest-action@master
|
||||
with:
|
||||
group: local
|
||||
hosts: localhost
|
||||
targets: "tests/*.yml"
|
||||
|
|
|
@ -1,21 +0,0 @@
|
|||
---
|
||||
# Based on ansible-lint config
|
||||
extends: default
|
||||
|
||||
rules:
|
||||
braces: {max-spaces-inside: 1, level: error}
|
||||
brackets: {max-spaces-inside: 1, level: error}
|
||||
colons: {max-spaces-after: -1, level: error}
|
||||
commas: {max-spaces-after: -1, level: error}
|
||||
comments: disable
|
||||
comments-indentation: disable
|
||||
document-start: disable
|
||||
empty-lines: {max: 3, level: error}
|
||||
hyphens: {level: error}
|
||||
indentation: disable
|
||||
key-duplicates: enable
|
||||
line-length: disable
|
||||
new-line-at-end-of-file: disable
|
||||
new-lines: {type: unix}
|
||||
trailing-spaces: disable
|
||||
truthy: disable
|
18
.yamllint.yml
Normal file
18
.yamllint.yml
Normal file
|
@ -0,0 +1,18 @@
|
|||
# SPDX-License-Identifier: MIT
|
||||
---
|
||||
extends: .yamllint_defaults.yml
|
||||
# possible customizations over the base yamllint config
|
||||
# skip the yaml files in the /tests/ directory
|
||||
# NOTE: If you want to customize `ignore` you'll have to
|
||||
# copy in all of the config from .yamllint.yml, then
|
||||
# add your own - so if you want to just add /tests/ to
|
||||
# be ignored, you'll have to add the ignores from the base
|
||||
ignore: |
|
||||
/.tox/
|
||||
/.github/
|
||||
# /tests/
|
||||
# skip checking line length
|
||||
# NOTE: the above does not apply to `rules` - you do not
|
||||
# have to copy all of the rules from the base config
|
||||
rules:
|
||||
line-length: disable
|
16
.yamllint_defaults.yml
Normal file
16
.yamllint_defaults.yml
Normal file
|
@ -0,0 +1,16 @@
|
|||
# SPDX-License-Identifier: MIT
|
||||
---
|
||||
ignore: |
|
||||
/.tox/
|
||||
extends: default
|
||||
rules:
|
||||
braces:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
brackets:
|
||||
max-spaces-inside: 1
|
||||
level: error
|
||||
truthy:
|
||||
allowed-values: ["yes", "no", "true", "false"]
|
||||
level: error
|
||||
document-start: disable
|
|
@ -10,6 +10,6 @@
|
|||
PermitRootLogin: no
|
||||
PasswordAuthentication: no
|
||||
Match:
|
||||
- Condition: "Address 192.0.2.0/24"
|
||||
PermitRootLogin: yes
|
||||
PasswordAuthentication: yes
|
||||
- Condition: "Address 192.0.2.0/24"
|
||||
PermitRootLogin: yes
|
||||
PasswordAuthentication: yes
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
- sshd_allow_reload|bool
|
||||
- ansible_virtualization_type|default(None) != 'docker'
|
||||
- ansible_virtualization_type|default(None) != 'podman'
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_connection != 'chroot'
|
||||
- ansible_os_family != 'AIX'
|
||||
listen: reload_sshd
|
||||
|
@ -19,10 +19,15 @@
|
|||
# https://www.ibm.com/developerworks/community/blogs/brian/entry/scripting_the_stop_and_restart_of_src_controlled_processes_on_aix6
|
||||
- name: Reload sshd Service (AIX)
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
stopsrc -s sshd
|
||||
until $(lssrc -s sshd | grep -q inoperative); do sleep 1; done
|
||||
startsrc -s sshd
|
||||
listen: reload_sshd
|
||||
changed_when: false
|
||||
when:
|
||||
- sshd_allow_reload|bool
|
||||
- ansible_os_family == 'AIX'
|
||||
|
|
|
@ -50,14 +50,19 @@
|
|||
{% endif %}
|
||||
block:
|
||||
- name: Make sure hostkeys are available
|
||||
shell: >
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
{% if sshd_sysconfig %}
|
||||
source /etc/sysconfig/sshd;
|
||||
source /etc/sysconfig/sshd
|
||||
{% endif %}
|
||||
ssh-keygen -q -t {{ item | regex_search('(rsa|dsa|ecdsa|ed25519)') }} -f {{ item }} -C '' -N ''
|
||||
args:
|
||||
creates: "{{ item }}"
|
||||
loop: "{{ __sshd_verify_hostkeys | from_json | list }}"
|
||||
changed_when: false
|
||||
|
||||
- name: Make sure private hostkeys have expected permissions
|
||||
file:
|
||||
|
@ -75,14 +80,15 @@
|
|||
tempfile:
|
||||
state: directory
|
||||
register: sshd_test_hostkey
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
when:
|
||||
- __sshd_hostkeys_from_config | from_json == []
|
||||
- sshd_config_file != "/etc/ssh/sshd_config"
|
||||
|
||||
- name: Generate temporary hostkey
|
||||
shell: "ssh-keygen -q -t rsa -f {{ sshd_test_hostkey.path }}/rsa_key -C '' -N ''"
|
||||
changed_when: False
|
||||
command: >
|
||||
ssh-keygen -q -t rsa -f '{{ sshd_test_hostkey.path }}/rsa_key' -C '' -N ''
|
||||
changed_when: false
|
||||
when: sshd_test_hostkey.path is defined
|
||||
|
||||
- name: Make sure sshd runtime directory is present
|
||||
|
@ -119,7 +125,7 @@
|
|||
file:
|
||||
path: "{{ sshd_test_hostkey.path }}"
|
||||
state: absent
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
when: sshd_test_hostkey.path is defined
|
||||
|
||||
- name: Install systemd service files
|
||||
|
@ -159,7 +165,7 @@
|
|||
- sshd_manage_service|bool
|
||||
- ansible_virtualization_type|default(None) != 'docker'
|
||||
- ansible_virtualization_type|default(None) != 'podman'
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_connection != 'chroot'
|
||||
|
||||
# Due to ansible bug 21026, cannot use service module on RHEL 7
|
||||
|
|
|
@ -6,17 +6,21 @@
|
|||
tempfile:
|
||||
state: directory
|
||||
register: __sshd_test_backup
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
when:
|
||||
- sshd_test_backup_skip is not defined
|
||||
|
||||
- name: Backup files
|
||||
shell: >
|
||||
shell: |
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
set -eu
|
||||
if test -f {{ item }}; then
|
||||
mkdir -p {{ __sshd_test_backup.path }}/$(dirname {{ item }});
|
||||
mkdir -p {{ __sshd_test_backup.path }}/$(dirname {{ item }})
|
||||
cp {{ item }} {{ __sshd_test_backup.path }}/$(dirname {{ item }})
|
||||
fi
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
loop: "{{ __sshd_test_backup_files | d([]) }}"
|
||||
when:
|
||||
- __sshd_test_backup is defined
|
||||
|
|
|
@ -1,12 +1,16 @@
|
|||
---
|
||||
- name: Restore backed up files and remove what was not present
|
||||
shell: >
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
if test -f {{ __sshd_test_backup.path }}/{{ item }}; then
|
||||
cp {{ __sshd_test_backup.path }}/{{ item }} $(dirname {{ item }})
|
||||
elif test -f {{ item }}; then
|
||||
rm {{ item }}
|
||||
fi
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
loop: "{{ __sshd_test_backup_files | d([]) }}"
|
||||
when:
|
||||
- __sshd_test_backup is defined
|
||||
|
@ -16,7 +20,7 @@
|
|||
file:
|
||||
path: "{{ __sshd_test_backup.path }}"
|
||||
state: absent
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
when:
|
||||
- __sshd_test_backup is defined
|
||||
- __sshd_test_backup.path is defined
|
||||
|
@ -25,11 +29,11 @@
|
|||
service:
|
||||
name: sshd
|
||||
state: reloaded
|
||||
changed_when: False
|
||||
changed_when: false
|
||||
when:
|
||||
- __sshd_test_backup is defined
|
||||
- ansible_virtualization_type|default(None) != 'docker'
|
||||
- ansible_virtualization_type|default(None) != 'podman'
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_virtualization_type|default(None) != 'VirtualPC' # for Github Actions
|
||||
- ansible_connection != 'chroot'
|
||||
- ansible_os_family != 'AIX'
|
||||
|
|
|
@ -7,98 +7,98 @@
|
|||
- /etc/ssh/sshd_config_custom
|
||||
- /etc/ssh/sshd_config_custom_second
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure alternative sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# just anything -- will not get processed by sshd
|
||||
sshd_config_file: /etc/ssh/sshd_config_custom
|
||||
sshd_skip_defaults: true
|
||||
sshd:
|
||||
AcceptEnv: LANG
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
sshd_Compression: no
|
||||
- name: Configure second alternative sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# just anything -- will not get processed by sshd
|
||||
sshd_config_file: /etc/ssh/sshd_config_custom_second
|
||||
sshd_skip_defaults: true
|
||||
sshd:
|
||||
Banner: /etc/issue2
|
||||
Ciphers: aes128-ctr
|
||||
sshd_MaxStartups: 100
|
||||
- name: Now configure the main sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes192-ctr
|
||||
HostKey:
|
||||
- /tmp/ssh_host_ecdsa_key
|
||||
sshd_PasswordAuthentication: no
|
||||
- name: Configure alternative sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# just anything -- will not get processed by sshd
|
||||
sshd_config_file: /etc/ssh/sshd_config_custom
|
||||
sshd_skip_defaults: true
|
||||
sshd:
|
||||
AcceptEnv: LANG
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
sshd_Compression: no
|
||||
- name: Configure second alternative sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# just anything -- will not get processed by sshd
|
||||
sshd_config_file: /etc/ssh/sshd_config_custom_second
|
||||
sshd_skip_defaults: true
|
||||
sshd:
|
||||
Banner: /etc/issue2
|
||||
Ciphers: aes128-ctr
|
||||
sshd_MaxStartups: 100
|
||||
- name: Now configure the main sshd_config file
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes192-ctr
|
||||
HostKey:
|
||||
- /tmp/ssh_host_ecdsa_key
|
||||
sshd_PasswordAuthentication: no
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config_custom
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config_custom
|
||||
register: config
|
||||
|
||||
- name: Print second configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config_custom_second
|
||||
register: config2
|
||||
- name: Print second configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config_custom_second
|
||||
register: config2
|
||||
|
||||
- name: Print the main configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config3
|
||||
- name: Print the main configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config3
|
||||
|
||||
- name: Check content of first configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'AcceptEnv LANG' in config.content | b64decode"
|
||||
- "'Banner /etc/issue' in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr' in config.content | b64decode"
|
||||
- "'HostKey' not in config.content | b64decode"
|
||||
- "'Compression no' in config.content | b64decode"
|
||||
- "'MaxStartups 100' not in config.content | b64decode"
|
||||
- name: Check content of first configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'AcceptEnv LANG' in config.content | b64decode"
|
||||
- "'Banner /etc/issue' in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr' in config.content | b64decode"
|
||||
- "'HostKey' not in config.content | b64decode"
|
||||
- "'Compression no' in config.content | b64decode"
|
||||
- "'MaxStartups 100' not in config.content | b64decode"
|
||||
|
||||
- name: Check content of second configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/issue2' in config2.content | b64decode"
|
||||
- "'Ciphers aes128-ctr' in config2.content | b64decode"
|
||||
- "'HostKey' not in config2.content | b64decode"
|
||||
- "'MaxStartups 100' in config2.content | b64decode"
|
||||
- "'Compression no' not in config2.content | b64decode"
|
||||
- name: Check content of second configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/issue2' in config2.content | b64decode"
|
||||
- "'Ciphers aes128-ctr' in config2.content | b64decode"
|
||||
- "'HostKey' not in config2.content | b64decode"
|
||||
- "'MaxStartups 100' in config2.content | b64decode"
|
||||
- "'Compression no' not in config2.content | b64decode"
|
||||
|
||||
- name: Check content of the main configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/issue' in config3.content | b64decode"
|
||||
- "'Ciphers aes192-ctr' in config3.content | b64decode"
|
||||
- "'HostKey /tmp/ssh_host_ecdsa_key' in config3.content | b64decode"
|
||||
- "'PasswordAuthentication no' in config3.content | b64decode"
|
||||
- "'MaxStartups 100' not in config3.content | b64decode"
|
||||
- "'Compression no' not in config3.content | b64decode"
|
||||
tags: tests::verify
|
||||
- name: Check content of the main configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/issue' in config3.content | b64decode"
|
||||
- "'Ciphers aes192-ctr' in config3.content | b64decode"
|
||||
- "'HostKey /tmp/ssh_host_ecdsa_key' in config3.content | b64decode"
|
||||
- "'PasswordAuthentication no' in config3.content | b64decode"
|
||||
- "'MaxStartups 100' not in config3.content | b64decode"
|
||||
- "'Compression no' not in config3.content | b64decode"
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -17,51 +17,51 @@
|
|||
else "/etc/ssh/"
|
||||
}}
|
||||
tasks:
|
||||
- name: Backup configuration files
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: Backup configuration files
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Find old backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: backup_files
|
||||
- name: Find old backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: backup_files
|
||||
|
||||
- name: Remove old backup files
|
||||
file:
|
||||
path: "{{ item.path }}"
|
||||
state: absent
|
||||
with_items: "{{ backup_files.files }}"
|
||||
- name: Remove old backup files
|
||||
file:
|
||||
path: "{{ item.path }}"
|
||||
state: absent
|
||||
with_items: "{{ backup_files.files }}"
|
||||
|
||||
- name: Configure sshd without creating backup
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_backup: false
|
||||
- name: Configure sshd without creating backup
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_backup: false
|
||||
|
||||
- name: Find new backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: no_backup
|
||||
- name: Find new backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: no_backup
|
||||
|
||||
- name: Configure sshd again with different configuration and with backup
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_Banner: /tmp/banner
|
||||
register: second_run
|
||||
- name: Configure sshd again with different configuration and with backup
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_Banner: /tmp/banner
|
||||
register: second_run
|
||||
|
||||
- name: Find new backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: new_backup
|
||||
- name: Find new backups files
|
||||
find:
|
||||
paths: "{{ main_sshd_config_path }}"
|
||||
patterns: "{{ main_sshd_config }}.*@*~"
|
||||
register: new_backup
|
||||
|
||||
- name: Verify the backup was not done in the first attempt, but in the second one
|
||||
assert:
|
||||
that:
|
||||
- no_backup.files == []
|
||||
- new_backup.files != []
|
||||
- name: Verify the backup was not done in the first attempt, but in the second one
|
||||
assert:
|
||||
that:
|
||||
- no_backup.files == []
|
||||
- new_backup.files != []
|
||||
|
||||
- name: Restore configuration files
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: Restore configuration files
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,12 +5,12 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- hosts: all
|
||||
roles:
|
||||
- ansible-sshd
|
||||
- ansible-sshd
|
||||
|
||||
- hosts: all
|
||||
vars:
|
||||
|
@ -18,5 +18,5 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,12 +5,12 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: "Configure sshd"
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
- name: "Configure sshd"
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -6,76 +6,78 @@
|
|||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
- /tmp/ssh_host_rsa_key2
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Remove host key before the test
|
||||
file:
|
||||
path: /tmp/ssh_host_rsa_key2
|
||||
state: absent
|
||||
- name: Remove host key before the test
|
||||
file:
|
||||
path: /tmp/ssh_host_rsa_key2
|
||||
state: absent
|
||||
|
||||
- name: Ensure group 'nobody' exists
|
||||
group:
|
||||
name: nobody
|
||||
- name: Ensure group 'nobody' exists
|
||||
group:
|
||||
name: nobody
|
||||
|
||||
- name: Ensure the user 'nobody' exists
|
||||
user:
|
||||
name: nobody
|
||||
group: nobody
|
||||
comment: nobody
|
||||
create_home: no
|
||||
shell: /sbin/nologin
|
||||
- name: Ensure the user 'nobody' exists
|
||||
user:
|
||||
name: nobody
|
||||
group: nobody
|
||||
comment: nobody
|
||||
create_home: no
|
||||
shell: /sbin/nologin
|
||||
|
||||
- name: Configure sshd with alternative host keys
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# very BAD example
|
||||
sshd_hostkey_owner: "nobody"
|
||||
sshd_hostkey_group: "nobody"
|
||||
sshd_hostkey_mode: "0664"
|
||||
sshd:
|
||||
HostKey:
|
||||
- /tmp/ssh_host_rsa_key2
|
||||
- name: Configure sshd with alternative host keys
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# very BAD example
|
||||
sshd_hostkey_owner: "nobody"
|
||||
sshd_hostkey_group: "nobody"
|
||||
sshd_hostkey_mode: "0664"
|
||||
sshd:
|
||||
HostKey:
|
||||
- /tmp/ssh_host_rsa_key2
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
|
||||
- stat:
|
||||
path: /tmp/ssh_host_rsa_key2
|
||||
register: privkey
|
||||
- name: Get stat of private key
|
||||
stat:
|
||||
path: /tmp/ssh_host_rsa_key2
|
||||
register: privkey
|
||||
|
||||
- stat:
|
||||
path: /tmp/ssh_host_rsa_key2.pub
|
||||
register: pubkey
|
||||
- name: Get stat of public key
|
||||
stat:
|
||||
path: /tmp/ssh_host_rsa_key2.pub
|
||||
register: pubkey
|
||||
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'HostKey /tmp/ssh_host_rsa_key2' in config.content | b64decode"
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'HostKey /tmp/ssh_host_rsa_key2' in config.content | b64decode"
|
||||
|
||||
- name: Check the generated host key has requested properties
|
||||
assert:
|
||||
that:
|
||||
- privkey.stat.exists
|
||||
- privkey.stat.gr_name == 'nobody'
|
||||
- privkey.stat.pw_name == 'nobody'
|
||||
- privkey.stat.mode == '0664'
|
||||
- pubkey.stat.exists
|
||||
tags: tests::verify
|
||||
- name: Check the generated host key has requested properties
|
||||
assert:
|
||||
that:
|
||||
- privkey.stat.exists
|
||||
- privkey.stat.gr_name == 'nobody'
|
||||
- privkey.stat.pw_name == 'nobody'
|
||||
- privkey.stat.mode == '0664'
|
||||
- pubkey.stat.exists
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -6,52 +6,52 @@
|
|||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
- /tmp/missing_ssh_host_rsa_key
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd with missing host keys and prevent their creation
|
||||
block:
|
||||
- name: Configure missing hostkey
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_verify_hostkeys: []
|
||||
sshd:
|
||||
HostKey:
|
||||
- /tmp/missing_ssh_host_rsa_key
|
||||
register: role_result
|
||||
- name: Configure sshd with missing host keys and prevent their creation
|
||||
block:
|
||||
- name: Configure missing hostkey
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_verify_hostkeys: []
|
||||
sshd:
|
||||
HostKey:
|
||||
- /tmp/missing_ssh_host_rsa_key
|
||||
register: role_result
|
||||
|
||||
- name: unreachable task
|
||||
fail:
|
||||
msg: UNREACH
|
||||
- name: unreachable task
|
||||
fail:
|
||||
msg: UNREACH
|
||||
|
||||
rescue:
|
||||
- name: Check that we failed in the role
|
||||
assert:
|
||||
that:
|
||||
- ansible_failed_result.msg != 'UNREACH'
|
||||
- not role_result.changed
|
||||
msg: "Role has not failed when it should have"
|
||||
when:
|
||||
- ansible_facts['os_family'] != 'Debian'
|
||||
- not (ansible_facts['distribution'] == 'RedHat' and ansible_facts['distribution_major_version'] == '6')
|
||||
tags: tests::verify
|
||||
rescue:
|
||||
- name: Check that we failed in the role
|
||||
assert:
|
||||
that:
|
||||
- ansible_failed_result.msg != 'UNREACH'
|
||||
- not role_result.changed
|
||||
msg: "Role has not failed when it should have"
|
||||
when:
|
||||
- ansible_facts['os_family'] != 'Debian'
|
||||
- not (ansible_facts['distribution'] == 'RedHat' and ansible_facts['distribution_major_version'] == '6')
|
||||
tags: tests::verify
|
||||
|
||||
- name: Make sure the key was not created
|
||||
file:
|
||||
path: /tmp/missing_ssh_host_rsa_key
|
||||
state: absent
|
||||
register: key
|
||||
failed_when: key.changed
|
||||
tags: tests::verify
|
||||
- name: Make sure the key was not created
|
||||
file:
|
||||
path: /tmp/missing_ssh_host_rsa_key
|
||||
state: absent
|
||||
register: key
|
||||
failed_when: key.changed
|
||||
tags: tests::verify
|
||||
|
||||
- name: Make sure service is still running
|
||||
service:
|
||||
name: sshd
|
||||
state: started
|
||||
register: result
|
||||
failed_when: result.changed
|
||||
tags: tests::verify
|
||||
- name: Make sure service is still running
|
||||
service:
|
||||
name: sshd
|
||||
state: started
|
||||
register: result
|
||||
failed_when: result.changed
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,87 +5,87 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# For Fedora containers, we need to make sure we have keys for sshd -T below
|
||||
sshd_verify_hostkeys:
|
||||
- /etc/ssh/ssh_host_rsa_key
|
||||
sshd:
|
||||
Match:
|
||||
Condition: "User xusers"
|
||||
X11Forwarding: yes
|
||||
Banner: /tmp/xusers-banner
|
||||
sshd_match:
|
||||
- Condition: "User bot"
|
||||
AllowTcpForwarding: no
|
||||
Banner: /tmp/bot-banner
|
||||
sshd_match_1:
|
||||
- Condition: "User sftponly"
|
||||
ForceCommand: "internal-sftp"
|
||||
ChrootDirectory: "/var/uploads/"
|
||||
sshd_match_2:
|
||||
- Condition: "User root"
|
||||
PasswordAuthentication: no
|
||||
AllowTcpForwarding: yes
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# For Fedora containers, we need to make sure we have keys for sshd -T below
|
||||
sshd_verify_hostkeys:
|
||||
- /etc/ssh/ssh_host_rsa_key
|
||||
sshd:
|
||||
Match:
|
||||
Condition: "User xusers"
|
||||
X11Forwarding: yes
|
||||
Banner: /tmp/xusers-banner
|
||||
sshd_match:
|
||||
- Condition: "User bot"
|
||||
AllowTcpForwarding: no
|
||||
Banner: /tmp/bot-banner
|
||||
sshd_match_1:
|
||||
- Condition: "User sftponly"
|
||||
ForceCommand: "internal-sftp"
|
||||
ChrootDirectory: "/var/uploads/"
|
||||
sshd_match_2:
|
||||
- Condition: "User root"
|
||||
PasswordAuthentication: no
|
||||
AllowTcpForwarding: yes
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: List effective configuration using sshd -T for xusers
|
||||
command: sshd -T -C user=xusers,addr=127.0.0.1,host=example.com
|
||||
register: xusers_effective
|
||||
- name: List effective configuration using sshd -T for xusers
|
||||
command: sshd -T -C user=xusers,addr=127.0.0.1,host=example.com
|
||||
register: xusers_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for bot
|
||||
command: sshd -T -C user=bot,addr=127.0.0.1,host=example.com
|
||||
register: bot_effective
|
||||
- name: List effective configuration using sshd -T for bot
|
||||
command: sshd -T -C user=bot,addr=127.0.0.1,host=example.com
|
||||
register: bot_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for sftponly
|
||||
command: sshd -T -C user=sftponly,addr=127.0.0.1,host=example.com
|
||||
register: sftponly_effective
|
||||
- name: List effective configuration using sshd -T for sftponly
|
||||
command: sshd -T -C user=sftponly,addr=127.0.0.1,host=example.com
|
||||
register: sftponly_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for root
|
||||
command: sshd -T -C user=root,addr=127.0.0.1,host=example.com
|
||||
register: root_effective
|
||||
- name: List effective configuration using sshd -T for root
|
||||
command: sshd -T -C user=root,addr=127.0.0.1,host=example.com
|
||||
register: root_effective
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'x11forwarding yes' in xusers_effective.stdout"
|
||||
- "'banner /tmp/xusers-banner' in xusers_effective.stdout"
|
||||
- "'allowtcpforwarding no' in bot_effective.stdout"
|
||||
- "'banner /tmp/bot-banner' in bot_effective.stdout"
|
||||
- "'forcecommand internal-sftp' in sftponly_effective.stdout"
|
||||
- "'chrootdirectory /var/uploads/' in sftponly_effective.stdout"
|
||||
- "'passwordauthentication no' in root_effective.stdout"
|
||||
- "'allowtcpforwarding yes' in root_effective.stdout"
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'x11forwarding yes' in xusers_effective.stdout"
|
||||
- "'banner /tmp/xusers-banner' in xusers_effective.stdout"
|
||||
- "'allowtcpforwarding no' in bot_effective.stdout"
|
||||
- "'banner /tmp/bot-banner' in bot_effective.stdout"
|
||||
- "'forcecommand internal-sftp' in sftponly_effective.stdout"
|
||||
- "'chrootdirectory /var/uploads/' in sftponly_effective.stdout"
|
||||
- "'passwordauthentication no' in root_effective.stdout"
|
||||
- "'allowtcpforwarding yes' in root_effective.stdout"
|
||||
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Match User xusers' in config.content | b64decode"
|
||||
- "'Match User bot' in config.content | b64decode"
|
||||
- "'Match User sftponly' in config.content | b64decode"
|
||||
- "'Match User root' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Match User xusers' in config.content | b64decode"
|
||||
- "'Match User bot' in config.content | b64decode"
|
||||
- "'Match User sftponly' in config.content | b64decode"
|
||||
- "'Match User root' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,85 +5,85 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# For Fedora containers, we need to make sure we have keys for sshd -T below
|
||||
sshd_verify_hostkeys:
|
||||
- /etc/ssh/ssh_host_rsa_key
|
||||
sshd:
|
||||
Match:
|
||||
- Condition: "User xusers"
|
||||
X11Forwarding: yes
|
||||
Banner: /tmp/xusers-banner
|
||||
- Condition: "User bot"
|
||||
AllowTcpForwarding: no
|
||||
Banner: /tmp/bot-banner
|
||||
sshd_match:
|
||||
- Condition: "User sftponly"
|
||||
ForceCommand: "internal-sftp"
|
||||
ChrootDirectory: "/var/uploads/"
|
||||
- Condition: "User root"
|
||||
PasswordAuthentication: no
|
||||
AllowTcpForwarding: yes
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
# For Fedora containers, we need to make sure we have keys for sshd -T below
|
||||
sshd_verify_hostkeys:
|
||||
- /etc/ssh/ssh_host_rsa_key
|
||||
sshd:
|
||||
Match:
|
||||
- Condition: "User xusers"
|
||||
X11Forwarding: yes
|
||||
Banner: /tmp/xusers-banner
|
||||
- Condition: "User bot"
|
||||
AllowTcpForwarding: no
|
||||
Banner: /tmp/bot-banner
|
||||
sshd_match:
|
||||
- Condition: "User sftponly"
|
||||
ForceCommand: "internal-sftp"
|
||||
ChrootDirectory: "/var/uploads/"
|
||||
- Condition: "User root"
|
||||
PasswordAuthentication: no
|
||||
AllowTcpForwarding: yes
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: List effective configuration using sshd -T for xusers
|
||||
command: sshd -T -C user=xusers,addr=127.0.0.1,host=example.com
|
||||
register: xusers_effective
|
||||
- name: List effective configuration using sshd -T for xusers
|
||||
command: sshd -T -C user=xusers,addr=127.0.0.1,host=example.com
|
||||
register: xusers_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for bot
|
||||
command: sshd -T -C user=bot,addr=127.0.0.1,host=example.com
|
||||
register: bot_effective
|
||||
- name: List effective configuration using sshd -T for bot
|
||||
command: sshd -T -C user=bot,addr=127.0.0.1,host=example.com
|
||||
register: bot_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for sftponly
|
||||
command: sshd -T -C user=sftponly,addr=127.0.0.1,host=example.com
|
||||
register: sftponly_effective
|
||||
- name: List effective configuration using sshd -T for sftponly
|
||||
command: sshd -T -C user=sftponly,addr=127.0.0.1,host=example.com
|
||||
register: sftponly_effective
|
||||
|
||||
- name: List effective configuration using sshd -T for root
|
||||
command: sshd -T -C user=root,addr=127.0.0.1,host=example.com
|
||||
register: root_effective
|
||||
- name: List effective configuration using sshd -T for root
|
||||
command: sshd -T -C user=root,addr=127.0.0.1,host=example.com
|
||||
register: root_effective
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'x11forwarding yes' in xusers_effective.stdout"
|
||||
- "'banner /tmp/xusers-banner' in xusers_effective.stdout"
|
||||
- "'allowtcpforwarding no' in bot_effective.stdout"
|
||||
- "'banner /tmp/bot-banner' in bot_effective.stdout"
|
||||
- "'forcecommand internal-sftp' in sftponly_effective.stdout"
|
||||
- "'chrootdirectory /var/uploads/' in sftponly_effective.stdout"
|
||||
- "'passwordauthentication no' in root_effective.stdout"
|
||||
- "'allowtcpforwarding yes' in root_effective.stdout"
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'x11forwarding yes' in xusers_effective.stdout"
|
||||
- "'banner /tmp/xusers-banner' in xusers_effective.stdout"
|
||||
- "'allowtcpforwarding no' in bot_effective.stdout"
|
||||
- "'banner /tmp/bot-banner' in bot_effective.stdout"
|
||||
- "'forcecommand internal-sftp' in sftponly_effective.stdout"
|
||||
- "'chrootdirectory /var/uploads/' in sftponly_effective.stdout"
|
||||
- "'passwordauthentication no' in root_effective.stdout"
|
||||
- "'allowtcpforwarding yes' in root_effective.stdout"
|
||||
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Match User xusers' in config.content | b64decode"
|
||||
- "'Match User bot' in config.content | b64decode"
|
||||
- "'Match User sftponly' in config.content | b64decode"
|
||||
- "'Match User root' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Match User xusers' in config.content | b64decode"
|
||||
- "'Match User bot' in config.content | b64decode"
|
||||
- "'Match User sftponly' in config.content | b64decode"
|
||||
- "'Match User root' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -7,32 +7,38 @@
|
|||
- /etc/ssh/ssh_host_rsa_key
|
||||
- /etc/ssh/ssh_host_rsa_key.pub
|
||||
tasks:
|
||||
- name: Backup configuration files
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: Backup configuration files
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Show effective configuration before running role (system defaults)
|
||||
shell: >
|
||||
if test ! -f /etc/ssh/ssh_host_rsa_key; then
|
||||
ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N ''
|
||||
fi;
|
||||
sshd -T
|
||||
register: runtime_before
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
- name: Show effective configuration after running role (role defaults)
|
||||
shell: sshd -T
|
||||
register: runtime_after
|
||||
- debug:
|
||||
var: ansible_facts['distribution']
|
||||
- debug:
|
||||
var: ansible_facts['distribution_major_version']
|
||||
- name: Check that the effective configuration did not change from OS defaults
|
||||
assert:
|
||||
that:
|
||||
- runtime_before.stdout == runtime_after.stdout
|
||||
when:
|
||||
- not (ansible_facts['distribution'] == 'RedHat' and ansible_facts['distribution_major_version'] == '6')
|
||||
- name: Show effective configuration before running role (system defaults)
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
if test ! -f /etc/ssh/ssh_host_rsa_key; then
|
||||
ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N ''
|
||||
fi
|
||||
sshd -T
|
||||
register: runtime_before
|
||||
changed_when: false
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
- name: Show effective configuration after running role (role defaults)
|
||||
command: sshd -T
|
||||
register: runtime_after
|
||||
changed_when: false
|
||||
- debug:
|
||||
var: ansible_facts['distribution']
|
||||
- debug:
|
||||
var: ansible_facts['distribution_major_version']
|
||||
- name: Check that the effective configuration did not change from OS defaults
|
||||
assert:
|
||||
that:
|
||||
- runtime_before.stdout == runtime_after.stdout
|
||||
when:
|
||||
- not (ansible_facts['distribution'] == 'RedHat' and ansible_facts['distribution_major_version'] == '6')
|
||||
|
||||
- name: Restore configuration files
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: Restore configuration files
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -6,61 +6,61 @@
|
|||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
- /tmp/ssh_host_rsa_key
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Remove host key before the test
|
||||
file:
|
||||
path: /tmp/ssh_host_rsa_key
|
||||
state: absent
|
||||
- name: Remove host key before the test
|
||||
file:
|
||||
path: /tmp/ssh_host_rsa_key
|
||||
state: absent
|
||||
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
HostKey: /etc/ssh/ssh_host_rsa_key
|
||||
sshd_Ciphers: aes128-ctr
|
||||
sshd_Banner: /etc/good-issue
|
||||
sshd_HostKey: /tmp/ssh_host_rsa_key
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
HostKey: /etc/ssh/ssh_host_rsa_key
|
||||
sshd_Ciphers: aes128-ctr
|
||||
sshd_Banner: /etc/good-issue
|
||||
sshd_HostKey: /tmp/ssh_host_rsa_key
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
vars:
|
||||
main_sshd_config: >-
|
||||
{{
|
||||
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||
if ansible_facts['distribution'] == 'Fedora'
|
||||
else "/etc/ssh/sshd_config"
|
||||
}}
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: List effective configuration using sshd -T
|
||||
command: sshd -T
|
||||
register: runtime
|
||||
- name: List effective configuration using sshd -T
|
||||
command: sshd -T
|
||||
register: runtime
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: "{{ main_sshd_config }}"
|
||||
register: config
|
||||
|
||||
- name: Check the sshd_* values are effective in runtime
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'banner /etc/good-issue' in runtime.stdout"
|
||||
- "'ciphers aes128-ctr' in runtime.stdout"
|
||||
- "'hostkey /tmp/ssh_host_rsa_key' in runtime.stdout"
|
||||
- name: Check the sshd_* values are effective in runtime
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'banner /etc/good-issue' in runtime.stdout"
|
||||
- "'ciphers aes128-ctr' in runtime.stdout"
|
||||
- "'hostkey /tmp/ssh_host_rsa_key' in runtime.stdout"
|
||||
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/good-issue' in config.content | b64decode"
|
||||
- "'Ciphers aes128-ctr' in config.content | b64decode"
|
||||
- "'HostKey /tmp/ssh_host_rsa_key' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'Banner /etc/good-issue' in config.content | b64decode"
|
||||
- "'Ciphers aes128-ctr' in config.content | b64decode"
|
||||
- "'HostKey /tmp/ssh_host_rsa_key' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,50 +5,50 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
AcceptEnv: LANG
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
Subsystem: "sftp internal-sftp"
|
||||
sshd_config_file: /etc/ssh/sshd_config
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
AcceptEnv: LANG
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr
|
||||
Subsystem: "sftp internal-sftp"
|
||||
sshd_config_file: /etc/ssh/sshd_config
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: List effective configuration using sshd -T
|
||||
command: sshd -T
|
||||
register: runtime
|
||||
- name: List effective configuration using sshd -T
|
||||
command: sshd -T
|
||||
register: runtime
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config
|
||||
register: config
|
||||
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'acceptenv LANG' in runtime.stdout"
|
||||
- "'banner /etc/issue' in runtime.stdout"
|
||||
- "'ciphers aes256-ctr' in runtime.stdout"
|
||||
- "'subsystem sftp internal-sftp' in runtime.stdout"
|
||||
- name: Check the options are effective
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'acceptenv LANG' in runtime.stdout"
|
||||
- "'banner /etc/issue' in runtime.stdout"
|
||||
- "'ciphers aes256-ctr' in runtime.stdout"
|
||||
- "'subsystem sftp internal-sftp' in runtime.stdout"
|
||||
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'AcceptEnv LANG' in config.content | b64decode"
|
||||
- "'Banner /etc/issue' in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr' in config.content | b64decode"
|
||||
- "'Subsystem sftp internal-sftp' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
- name: Check the options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'AcceptEnv LANG' in config.content | b64decode"
|
||||
- "'Banner /etc/issue' in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr' in config.content | b64decode"
|
||||
- "'Subsystem sftp internal-sftp' in config.content | b64decode"
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,57 +5,57 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd with uncommon options, making sure it keeps running
|
||||
block:
|
||||
- name: Configure ssh with unsupported options
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
# Unsupported in new versions, but ignored ?
|
||||
Protocol: 1
|
||||
UsePrivilegeSeparation: no
|
||||
UseLogin: yes
|
||||
# Debian only
|
||||
DebianBanner: /etc/motd
|
||||
# Used in FreeBSD ?
|
||||
VersionAddendum: FreeBSD-20180909
|
||||
# HPN only
|
||||
HPNDisabled: yes
|
||||
HPNBufferSize: 2MB
|
||||
TcpRcvBufPoll: yes
|
||||
NoneEnabled: yes
|
||||
# some builds might be without kerberos/GSSAPI
|
||||
KerberosAuthentication: yes
|
||||
GSSAPIStoreCredentialsOnRekey: yes
|
||||
# SSHv1 options
|
||||
KeyRegenerationInterval: 1h
|
||||
ServerKeyBits: 1024
|
||||
# This one is pretty new, but works on OpenBSD only
|
||||
RDomain: 2
|
||||
register: role_result
|
||||
- name: Configure sshd with uncommon options, making sure it keeps running
|
||||
block:
|
||||
- name: Configure ssh with unsupported options
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd:
|
||||
# Unsupported in new versions, but ignored ?
|
||||
Protocol: 1
|
||||
UsePrivilegeSeparation: no
|
||||
UseLogin: yes
|
||||
# Debian only
|
||||
DebianBanner: /etc/motd
|
||||
# Used in FreeBSD ?
|
||||
VersionAddendum: FreeBSD-20180909
|
||||
# HPN only
|
||||
HPNDisabled: yes
|
||||
HPNBufferSize: 2MB
|
||||
TcpRcvBufPoll: yes
|
||||
NoneEnabled: yes
|
||||
# some builds might be without kerberos/GSSAPI
|
||||
KerberosAuthentication: yes
|
||||
GSSAPIStoreCredentialsOnRekey: yes
|
||||
# SSHv1 options
|
||||
KeyRegenerationInterval: 1h
|
||||
ServerKeyBits: 1024
|
||||
# This one is pretty new, but works on OpenBSD only
|
||||
RDomain: 2
|
||||
register: role_result
|
||||
|
||||
- name: unreachable task
|
||||
fail:
|
||||
msg: UNREACH
|
||||
rescue:
|
||||
- name: Check that we failed in the role
|
||||
assert:
|
||||
that:
|
||||
- ansible_failed_result.msg != 'UNREACH'
|
||||
- not role_result.changed
|
||||
msg: "Role has not failed when it should have"
|
||||
- name: unreachable task
|
||||
fail:
|
||||
msg: UNREACH
|
||||
rescue:
|
||||
- name: Check that we failed in the role
|
||||
assert:
|
||||
that:
|
||||
- ansible_failed_result.msg != 'UNREACH'
|
||||
- not role_result.changed
|
||||
msg: "Role has not failed when it should have"
|
||||
|
||||
- name: Make sure service is still running
|
||||
service:
|
||||
name: sshd
|
||||
state: started
|
||||
register: result
|
||||
failed_when: result.changed
|
||||
tags: tests::verify
|
||||
- name: Make sure service is still running
|
||||
service:
|
||||
name: sshd
|
||||
state: started
|
||||
register: result
|
||||
failed_when: result.changed
|
||||
tags: tests::verify
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -5,43 +5,48 @@
|
|||
- /etc/ssh/sshd_config
|
||||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd with the role disabled
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_enable: false
|
||||
sshd:
|
||||
AcceptEnv: XDG_*
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr,aes128-ctr
|
||||
sshd_config_file: /etc/ssh/sshd_config
|
||||
- name: Configure sshd with the role disabled
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_enable: false
|
||||
sshd:
|
||||
AcceptEnv: XDG_*
|
||||
Banner: /etc/issue
|
||||
Ciphers: aes256-ctr,aes128-ctr
|
||||
sshd_config_file: /etc/ssh/sshd_config
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/ssh/sshd_config
|
||||
register: config
|
||||
|
||||
- name: Print effective configuration
|
||||
shell: >
|
||||
if test ! -f /etc/ssh/ssh_host_rsa_key; then
|
||||
ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N ''
|
||||
fi;
|
||||
sshd -T
|
||||
register: runtime
|
||||
- name: Print effective configuration
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
if test ! -f /etc/ssh/ssh_host_rsa_key; then
|
||||
ssh-keygen -q -t rsa -f /etc/ssh/ssh_host_rsa_key -C '' -N ''
|
||||
fi
|
||||
sshd -T
|
||||
register: runtime
|
||||
changed_when: false
|
||||
|
||||
- name: Check the options were not applied
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'Acceptenv XDG_*' not in config.content | b64decode"
|
||||
- "'Banner /etc/issue' not in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr,aes128-ctr' not in config.content | b64decode"
|
||||
- "'acceptenv XDG_*' not in runtime.stdout"
|
||||
- "'banner /etc/issue' not in runtime.stdout"
|
||||
- "'ciphers aes256-ctr,aes128-ctr' not in runtime.stdout"
|
||||
- name: Check the options were not applied
|
||||
# note, the options are in lower-case here
|
||||
assert:
|
||||
that:
|
||||
- "'Acceptenv XDG_*' not in config.content | b64decode"
|
||||
- "'Banner /etc/issue' not in config.content | b64decode"
|
||||
- "'Ciphers aes256-ctr,aes128-ctr' not in config.content | b64decode"
|
||||
- "'acceptenv XDG_*' not in runtime.stdout"
|
||||
- "'banner /etc/issue' not in runtime.stdout"
|
||||
- "'ciphers aes256-ctr,aes128-ctr' not in runtime.stdout"
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
|
@ -6,67 +6,77 @@
|
|||
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
||||
- /etc/sysconfig/sshd
|
||||
tasks:
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
- name: "Backup configuration files"
|
||||
include_tasks: tasks/backup.yml
|
||||
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_sysconfig: true
|
||||
sshd_sysconfig_override_crypto_policy: true
|
||||
sshd_sysconfig_use_strong_rng: 32
|
||||
- name: Configure sshd
|
||||
include_role:
|
||||
name: ansible-sshd
|
||||
vars:
|
||||
sshd_sysconfig: true
|
||||
sshd_sysconfig_override_crypto_policy: true
|
||||
sshd_sysconfig_use_strong_rng: 32
|
||||
|
||||
- name: Verify the options are correctly set
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
- name: Verify the options are correctly set
|
||||
block:
|
||||
- meta: flush_handlers
|
||||
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/sysconfig/sshd
|
||||
register: config
|
||||
- name: Print current configuration file
|
||||
slurp:
|
||||
src: /etc/sysconfig/sshd
|
||||
register: config
|
||||
|
||||
- name: Evaluate sysconfig similarly as systemd
|
||||
shell: |
|
||||
source /etc/sysconfig/sshd
|
||||
echo "CP=|$CRYPTO_POLICY|"
|
||||
echo "RNG=|$SSH_USE_STRONG_RNG|"
|
||||
register: evaluation
|
||||
- name: Evaluate sysconfig similarly as systemd
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
source /etc/sysconfig/sshd
|
||||
echo "CP=|${CRYPTO_POLICY:-}|"
|
||||
echo "RNG=|${SSH_USE_STRONG_RNG:-}|"
|
||||
register: evaluation
|
||||
changed_when: false
|
||||
|
||||
- name: Evaluate sysconfig similarly as systemd on RHEL 8
|
||||
shell: |
|
||||
source /etc/crypto-policies/back-ends/opensshserver.config
|
||||
source /etc/sysconfig/sshd
|
||||
echo "CP=|$CRYPTO_POLICY|"
|
||||
echo "RNG=|$SSH_USE_STRONG_RNG|"
|
||||
register: evaluation8
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution_major_version'] == "8"
|
||||
- name: Evaluate sysconfig similarly as systemd on RHEL 8
|
||||
shell: |
|
||||
set -eu
|
||||
if set -o | grep pipefail 2>&1 /dev/null ; then
|
||||
set -o pipefail
|
||||
fi
|
||||
source /etc/crypto-policies/back-ends/opensshserver.config
|
||||
source /etc/sysconfig/sshd
|
||||
echo "CP=|${CRYPTO_POLICY:-}|"
|
||||
echo "RNG=|${SSH_USE_STRONG_RNG:-}|"
|
||||
register: evaluation8
|
||||
changed_when: false
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution_major_version'] == "8"
|
||||
|
||||
- name: Check the crypto policies is overridden in RHEL 8
|
||||
assert:
|
||||
that:
|
||||
- "'CRYPTO_POLICY=' in config.content | b64decode"
|
||||
# these are string variants in default configuration file
|
||||
- "'# CRYPTO_POLICY=' not in config.content | b64decode"
|
||||
- "'CP=||' in evaluation8.stdout"
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution_major_version'] == "8"
|
||||
- name: Check the crypto policies is overridden in RHEL 8
|
||||
assert:
|
||||
that:
|
||||
- "'CRYPTO_POLICY=' in config.content | b64decode"
|
||||
# these are string variants in default configuration file
|
||||
- "'# CRYPTO_POLICY=' not in config.content | b64decode"
|
||||
- "'CP=||' in evaluation8.stdout"
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution_major_version'] == "8"
|
||||
|
||||
- name: Check the RNG options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'SSH_USE_STRONG_RNG=32' in config.content | b64decode"
|
||||
# these are string variants in default configuration file
|
||||
- "'SSH_USE_STRONG_RNG=0' not in config.content | b64decode"
|
||||
- "'# SSH_USE_STRONG_RNG=1' not in config.content | b64decode"
|
||||
- "'RNG=|32|' in evaluation.stdout"
|
||||
tags: tests::verify
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution'] != 'Fedora'
|
||||
- name: Check the RNG options are in configuration file
|
||||
assert:
|
||||
that:
|
||||
- "'SSH_USE_STRONG_RNG=32' in config.content | b64decode"
|
||||
# these are string variants in default configuration file
|
||||
- "'SSH_USE_STRONG_RNG=0' not in config.content | b64decode"
|
||||
- "'# SSH_USE_STRONG_RNG=1' not in config.content | b64decode"
|
||||
- "'RNG=|32|' in evaluation.stdout"
|
||||
tags: tests::verify
|
||||
when:
|
||||
- ansible_facts['os_family'] == "RedHat"
|
||||
- ansible_facts['distribution'] != 'Fedora'
|
||||
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
- name: "Restore configuration files"
|
||||
include_tasks: tasks/restore.yml
|
||||
|
|
Loading…
Reference in a new issue