libretic/ansible-sshd
6
0
Fork 0
mirror of https://github.com/willshersystems/ansible-sshd synced 2024-12-25 10:00:19 +01:00
Code Issues Projects Releases Packages Wiki Activity

Add match support

Browse source
This commit is contained in:
Matt Willsher 2014-12-25 09:58:55 +00:00
parent 3689ad7020
commit b93f4c48db
8 changed files with 252 additions and 104 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
meta/macros.j2 → meta/10_top.j2
View file

@ -1,13 +1,7 @@
# {{ ansible_managed }}
{% macro render_option(key,override) %}
{% if override is defined %}
{% set value = override %}
{% elif sshd[key] is defined %}
{% set value = sshd[key] %}
{% elif sshd_defaults[key] is defined and sshd_skip_defaults != true %}
{% set value = sshd_defaults[key] %}
{% endif %}
{% macro render_option(key,value,indent=false) %}
{% if value is defined %}
{% if indent == true %} {% endif %}
{% if value is sameas true %}
{{ key }} yes
{% elif value is sameas false %}
@ -21,3 +15,17 @@
{% endif %}
{% endif %}
{% endmacro %}
{% macro body_option(key,override) %}
{% if override is defined %}
{% set value = override %}
{% elif sshd[key] is defined %}
{% set value = sshd[key] %}
{% elif sshd_defaults[key] is defined and sshd_skip_defaults != true %}
{% set value = sshd_defaults[key] %}
{% endif %}
{{ render_option(key,value) -}}
{% endmacro %}
{% macro match_block(match_list) %}
{% if match_list is defined %}
{% for match in match_list %}
Match {{ match["Condition"] }}

3
meta/20_middle.j2 Normal file
View file

@ -0,0 +1,3 @@
{% endfor %}
{% endif %}
{% endmacro %}

24
meta/30_bottom.j2 Normal file
View file

@ -0,0 +1,24 @@
{% if sshd['Match'] is defined %}
{{ match_block(sshd['Match']) -}}
{% endif %}
{% if sshd_match is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_1 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_2 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_3 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_4 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_5 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_6 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}

15
meta/make_option_list
View file

@ -1,7 +1,16 @@
#!/bin/sh
cat macros.j2
cat 10_top.j2
cat ssh_options |
cat options_match |
awk '{
print "{{ render_option(\""$1"\",sshd_"$1") -}}"
print "{{ render_option(\""$1"\",match[\""$1"\"],true) -}}"
}'
cat 20_middle.j2
cat options_body |
awk '{
print "{{ body_option(\""$1"\",sshd_"$1") -}}"
}'
cat 30_bottom.j2

0
meta/ssh_options → meta/options_body
View file

33
meta/options_match Normal file
View file

@ -0,0 +1,33 @@
AllowAgentForwarding
AllowGroups
AllowTcpForwarding
AllowUsers
AuthenticationMethods
AuthorizedKeysCommand
AuthorizedKeysCommandUser
AuthorizedKeysFile
AuthorizedPrincipalsFile
Banner
ChrootDirectory
DenyGroups
DenyUsers
ForceCommand
GatewayPorts
GSSAPIAuthentication
HostbasedAuthentication
HostbasedUsesNameFromPacketOnly
KbdInteractiveAuthentication
KerberosAuthentication
MaxAuthTries
MaxSessions
PasswordAuthentication
PermitEmptyPasswords
PermitOpen
PermitRootLogin
PermitTunnel
PubkeyAuthentication
RhostsRSAAuthentication
RSAAuthentication
X11DisplayOffset
X11Forwarding
X11UseLocalHost

254
templates/sshd_config.j2
View file

@ -1,13 +1,7 @@
# {{ ansible_managed }}
{% macro render_option(key,override) %}
{% if override is defined %}
{% set value = override %}
{% elif sshd[key] is defined %}
{% set value = sshd[key] %}
{% elif sshd_defaults[key] is defined and sshd_skip_defaults != true %}
{% set value = sshd_defaults[key] %}
{% endif %}
{% macro render_option(key,value,indent=false) %}
{% if value is defined %}
{% if indent == true %} {% endif %}
{% if value is sameas true %}
{{ key }} yes
{% elif value is sameas false %}
@ -21,88 +15,162 @@
{% endif %}
{% endif %}
{% endmacro %}
{{ render_option("Port",sshd_Port) -}}
{{ render_option("ListenAddress",sshd_ListenAddress) -}}
{{ render_option("Protocol",sshd_Protocol) -}}
{{ render_option("HostKey",sshd_HostKey) -}}
{{ render_option("AcceptEnv",sshd_AcceptEnv) -}}
{{ render_option("AddressFamily",sshd_AddressFamily) -}}
{{ render_option("AllowAgentForwarding",sshd_AllowAgentForwarding) -}}
{{ render_option("AllowGroups",sshd_AllowGroups) -}}
{{ render_option("AllowTcpForwarding",sshd_AllowTcpForwarding) -}}
{{ render_option("AllowUsers",sshd_AllowUsers) -}}
{{ render_option("AuthenticationMethods",sshd_AuthenticationMethods) -}}
{{ render_option("AuthorizedKeysCommand",sshd_AuthorizedKeysCommand) -}}
{{ render_option("AuthorizedKeysCommandUser",sshd_AuthorizedKeysCommandUser) -}}
{{ render_option("AuthorizedKeysFile",sshd_AuthorizedKeysFile) -}}
{{ render_option("AuthorizedPrincipalsFile",sshd_AuthorizedPrincipalsFile) -}}
{{ render_option("Banner",sshd_Banner) -}}
{{ render_option("ChallengeResponseAuthentication",sshd_ChallengeResponseAuthentication) -}}
{{ render_option("ChrootDirectory",sshd_ChrootDirectory) -}}
{{ render_option("Ciphers",sshd_Ciphers) -}}
{{ render_option("ClientAliveCountMax",sshd_ClientAliveCountMax) -}}
{{ render_option("ClientAliveInterval",sshd_ClientAliveInterval) -}}
{{ render_option("Compression",sshd_Compression) -}}
{{ render_option("DenyGroups",sshd_DenyGroups) -}}
{{ render_option("DenyUsers",sshd_DenyUsers) -}}
{{ render_option("ForceCommand",sshd_ForceCommand) -}}
{{ render_option("GSSAPIAuthentication",sshd_GSSAPIAuthentication) -}}
{{ render_option("GSSAPICleanupCredentials",sshd_GSSAPICleanupCredentials) -}}
{{ render_option("GSSAPIKeyExchange",sshd_GSSAPIKeyExchange) -}}
{{ render_option("GSSAPIStoreCredentialsOnRekey",sshd_GSSAPIStoreCredentialsOnRekey) -}}
{{ render_option("GSSAPIStrictAcceptorCheck",sshd_GSSAPIStrictAcceptorCheck) -}}
{{ render_option("GatewayPorts",sshd_GatewayPorts) -}}
{{ render_option("HPNBufferSize",sshd_HPNBufferSize) -}}
{{ render_option("HPNDisabled",sshd_HPNDisabled) -}}
{{ render_option("HostCertificate",sshd_HostCertificate) -}}
{{ render_option("HostKeyAgent",sshd_HostKeyAgent) -}}
{{ render_option("HostbasedAuthentication",sshd_HostbasedAuthentication) -}}
{{ render_option("HostbasedUsesNameFromPacketOnly",sshd_HostbasedUsesNameFromPacketOnly) -}}
{{ render_option("IPQoS",sshd_IPQoS) -}}
{{ render_option("IgnoreRhosts",sshd_IgnoreRhosts) -}}
{{ render_option("IgnoreUserKnownHosts",sshd_IgnoreUserKnownHosts) -}}
{{ render_option("KbdInteractiveAuthentication",sshd_KbdInteractiveAuthentication) -}}
{{ render_option("KerberosAuthentication",sshd_KerberosAuthentication) -}}
{{ render_option("KerberosGetAFSToken",sshd_KerberosGetAFSToken) -}}
{{ render_option("KerberosOrLocalPasswd",sshd_KerberosOrLocalPasswd) -}}
{{ render_option("KerberosTicketCleanup",sshd_KerberosTicketCleanup) -}}
{{ render_option("KexAlgorithms",sshd_KexAlgorithms) -}}
{{ render_option("KeyRegenerationInterval",sshd_KeyRegenerationInterval) -}}
{{ render_option("LogLevel",sshd_LogLevel) -}}
{{ render_option("LoginGraceTime",sshd_LoginGraceTime) -}}
{{ render_option("MACs",sshd_MACs) -}}
{{ render_option("MaxAuthTries",sshd_MaxAuthTries) -}}
{{ render_option("MaxSessions",sshd_MaxSessions) -}}
{{ render_option("MaxStartups",sshd_MaxStartups) -}}
{{ render_option("NoneEnabled",sshd_NoneEnabled) -}}
{{ render_option("PasswordAuthentication",sshd_PasswordAuthentication) -}}
{{ render_option("PermitEmptyPasswords",sshd_PermitEmptyPasswords) -}}
{{ render_option("PermitOpen",sshd_PermitOpen) -}}
{{ render_option("PermitRootLogin",sshd_PermitRootLogin) -}}
{{ render_option("PermitTTY",sshd_PermitTTY) -}}
{{ render_option("PermitTunnel",sshd_PermitTunnel) -}}
{{ render_option("PermitUserEnvironment",sshd_PermitUserEnvironment) -}}
{{ render_option("PidFile",sshd_PidFile) -}}
{{ render_option("PrintLastLog",sshd_PrintLastLog) -}}
{{ render_option("PrintMotd",sshd_PrintMotd) -}}
{{ render_option("PubkeyAuthentication",sshd_PubkeyAuthentication) -}}
{{ render_option("RSAAuthentication",sshd_RSAAuthentication) -}}
{{ render_option("RekeyLimit",sshd_RekeyLimit) -}}
{{ render_option("RevokedKeys",sshd_RevokedKeys) -}}
{{ render_option("RhostsRSAAuthentication",sshd_RhostsRSAAuthentication) -}}
{{ render_option("ServerKeyBits",sshd_ServerKeyBits) -}}
{{ render_option("StrictModes",sshd_StrictModes) -}}
{{ render_option("Subsystem",sshd_Subsystem) -}}
{{ render_option("SyslogFacility",sshd_SyslogFacility) -}}
{{ render_option("TCPKeepAlive",sshd_TCPKeepAlive) -}}
{{ render_option("TcpRcvBufPoll",sshd_TcpRcvBufPoll) -}}
{{ render_option("TrustedUserCAKeys",sshd_TrustedUserCAKeys) -}}
{{ render_option("UseDNS",sshd_UseDNS) -}}
{{ render_option("UseLogin",sshd_UseLogin) -}}
{{ render_option("UsePAM",sshd_UsePAM) -}}
{{ render_option("UsePrivilegeSeparation",sshd_UsePrivilegeSeparation) -}}
{{ render_option("VersionAddendum",sshd_VersionAddendum) -}}
{{ render_option("X11DisplayOffset",sshd_X11DisplayOffset) -}}
{{ render_option("X11Forwarding",sshd_X11Forwarding) -}}
{{ render_option("X11UseLocalhost",sshd_X11UseLocalhost) -}}
{{ render_option("XAuthLocation",sshd_XAuthLocation) -}}
{% macro body_option(key,override) %}
{% if override is defined %}
{% set value = override %}
{% elif sshd[key] is defined %}
{% set value = sshd[key] %}
{% elif sshd_defaults[key] is defined and sshd_skip_defaults != true %}
{% set value = sshd_defaults[key] %}
{% endif %}
{{ render_option(key,value) -}}
{% endmacro %}
{% macro match_block(match_list) %}
{% if match_list is defined %}
{% for match in match_list %}
Match {{ match["Condition"] }}
{{ render_option("AllowAgentForwarding",match["AllowAgentForwarding"],true) -}}
{{ render_option("AllowGroups",match["AllowGroups"],true) -}}
{{ render_option("AllowTcpForwarding",match["AllowTcpForwarding"],true) -}}
{{ render_option("AllowUsers",match["AllowUsers"],true) -}}
{{ render_option("AuthenticationMethods",match["AuthenticationMethods"],true) -}}
{{ render_option("AuthorizedKeysCommand",match["AuthorizedKeysCommand"],true) -}}
{{ render_option("AuthorizedKeysCommandUser",match["AuthorizedKeysCommandUser"],true) -}}
{{ render_option("AuthorizedKeysFile",match["AuthorizedKeysFile"],true) -}}
{{ render_option("AuthorizedPrincipalsFile",match["AuthorizedPrincipalsFile"],true) -}}
{{ render_option("Banner",match["Banner"],true) -}}
{{ render_option("ChrootDirectory",match["ChrootDirectory"],true) -}}
{{ render_option("DenyGroups",match["DenyGroups"],true) -}}
{{ render_option("DenyUsers",match["DenyUsers"],true) -}}
{{ render_option("ForceCommand",match["ForceCommand"],true) -}}
{{ render_option("GatewayPorts",match["GatewayPorts"],true) -}}
{{ render_option("GSSAPIAuthentication",match["GSSAPIAuthentication"],true) -}}
{{ render_option("HostbasedAuthentication",match["HostbasedAuthentication"],true) -}}
{{ render_option("HostbasedUsesNameFromPacketOnly",match["HostbasedUsesNameFromPacketOnly"],true) -}}
{{ render_option("KbdInteractiveAuthentication",match["KbdInteractiveAuthentication"],true) -}}
{{ render_option("KerberosAuthentication",match["KerberosAuthentication"],true) -}}
{{ render_option("MaxAuthTries",match["MaxAuthTries"],true) -}}
{{ render_option("MaxSessions",match["MaxSessions"],true) -}}
{{ render_option("PasswordAuthentication",match["PasswordAuthentication"],true) -}}
{{ render_option("PermitEmptyPasswords",match["PermitEmptyPasswords"],true) -}}
{{ render_option("PermitOpen",match["PermitOpen"],true) -}}
{{ render_option("PermitRootLogin",match["PermitRootLogin"],true) -}}
{{ render_option("PermitTunnel",match["PermitTunnel"],true) -}}
{{ render_option("PubkeyAuthentication",match["PubkeyAuthentication"],true) -}}
{{ render_option("RhostsRSAAuthentication",match["RhostsRSAAuthentication"],true) -}}
{{ render_option("RSAAuthentication",match["RSAAuthentication"],true) -}}
{{ render_option("X11DisplayOffset",match["X11DisplayOffset"],true) -}}
{{ render_option("X11Forwarding",match["X11Forwarding"],true) -}}
{{ render_option("X11UseLocalHost",match["X11UseLocalHost"],true) -}}
{% endfor %}
{% endif %}
{% endmacro %}
{{ body_option("Port",sshd_Port) -}}
{{ body_option("ListenAddress",sshd_ListenAddress) -}}
{{ body_option("Protocol",sshd_Protocol) -}}
{{ body_option("HostKey",sshd_HostKey) -}}
{{ body_option("AcceptEnv",sshd_AcceptEnv) -}}
{{ body_option("AddressFamily",sshd_AddressFamily) -}}
{{ body_option("AllowAgentForwarding",sshd_AllowAgentForwarding) -}}
{{ body_option("AllowGroups",sshd_AllowGroups) -}}
{{ body_option("AllowTcpForwarding",sshd_AllowTcpForwarding) -}}
{{ body_option("AllowUsers",sshd_AllowUsers) -}}
{{ body_option("AuthenticationMethods",sshd_AuthenticationMethods) -}}
{{ body_option("AuthorizedKeysCommand",sshd_AuthorizedKeysCommand) -}}
{{ body_option("AuthorizedKeysCommandUser",sshd_AuthorizedKeysCommandUser) -}}
{{ body_option("AuthorizedKeysFile",sshd_AuthorizedKeysFile) -}}
{{ body_option("AuthorizedPrincipalsFile",sshd_AuthorizedPrincipalsFile) -}}
{{ body_option("Banner",sshd_Banner) -}}
{{ body_option("ChallengeResponseAuthentication",sshd_ChallengeResponseAuthentication) -}}
{{ body_option("ChrootDirectory",sshd_ChrootDirectory) -}}
{{ body_option("Ciphers",sshd_Ciphers) -}}
{{ body_option("ClientAliveCountMax",sshd_ClientAliveCountMax) -}}
{{ body_option("ClientAliveInterval",sshd_ClientAliveInterval) -}}
{{ body_option("Compression",sshd_Compression) -}}
{{ body_option("DenyGroups",sshd_DenyGroups) -}}
{{ body_option("DenyUsers",sshd_DenyUsers) -}}
{{ body_option("ForceCommand",sshd_ForceCommand) -}}
{{ body_option("GSSAPIAuthentication",sshd_GSSAPIAuthentication) -}}
{{ body_option("GSSAPICleanupCredentials",sshd_GSSAPICleanupCredentials) -}}
{{ body_option("GSSAPIKeyExchange",sshd_GSSAPIKeyExchange) -}}
{{ body_option("GSSAPIStoreCredentialsOnRekey",sshd_GSSAPIStoreCredentialsOnRekey) -}}
{{ body_option("GSSAPIStrictAcceptorCheck",sshd_GSSAPIStrictAcceptorCheck) -}}
{{ body_option("GatewayPorts",sshd_GatewayPorts) -}}
{{ body_option("HPNBufferSize",sshd_HPNBufferSize) -}}
{{ body_option("HPNDisabled",sshd_HPNDisabled) -}}
{{ body_option("HostCertificate",sshd_HostCertificate) -}}
{{ body_option("HostKeyAgent",sshd_HostKeyAgent) -}}
{{ body_option("HostbasedAuthentication",sshd_HostbasedAuthentication) -}}
{{ body_option("HostbasedUsesNameFromPacketOnly",sshd_HostbasedUsesNameFromPacketOnly) -}}
{{ body_option("IPQoS",sshd_IPQoS) -}}
{{ body_option("IgnoreRhosts",sshd_IgnoreRhosts) -}}
{{ body_option("IgnoreUserKnownHosts",sshd_IgnoreUserKnownHosts) -}}
{{ body_option("KbdInteractiveAuthentication",sshd_KbdInteractiveAuthentication) -}}
{{ body_option("KerberosAuthentication",sshd_KerberosAuthentication) -}}
{{ body_option("KerberosGetAFSToken",sshd_KerberosGetAFSToken) -}}
{{ body_option("KerberosOrLocalPasswd",sshd_KerberosOrLocalPasswd) -}}
{{ body_option("KerberosTicketCleanup",sshd_KerberosTicketCleanup) -}}
{{ body_option("KexAlgorithms",sshd_KexAlgorithms) -}}
{{ body_option("KeyRegenerationInterval",sshd_KeyRegenerationInterval) -}}
{{ body_option("LogLevel",sshd_LogLevel) -}}
{{ body_option("LoginGraceTime",sshd_LoginGraceTime) -}}
{{ body_option("MACs",sshd_MACs) -}}
{{ body_option("MaxAuthTries",sshd_MaxAuthTries) -}}
{{ body_option("MaxSessions",sshd_MaxSessions) -}}
{{ body_option("MaxStartups",sshd_MaxStartups) -}}
{{ body_option("NoneEnabled",sshd_NoneEnabled) -}}
{{ body_option("PasswordAuthentication",sshd_PasswordAuthentication) -}}
{{ body_option("PermitEmptyPasswords",sshd_PermitEmptyPasswords) -}}
{{ body_option("PermitOpen",sshd_PermitOpen) -}}
{{ body_option("PermitRootLogin",sshd_PermitRootLogin) -}}
{{ body_option("PermitTTY",sshd_PermitTTY) -}}
{{ body_option("PermitTunnel",sshd_PermitTunnel) -}}
{{ body_option("PermitUserEnvironment",sshd_PermitUserEnvironment) -}}
{{ body_option("PidFile",sshd_PidFile) -}}
{{ body_option("PrintLastLog",sshd_PrintLastLog) -}}
{{ body_option("PrintMotd",sshd_PrintMotd) -}}
{{ body_option("PubkeyAuthentication",sshd_PubkeyAuthentication) -}}
{{ body_option("RSAAuthentication",sshd_RSAAuthentication) -}}
{{ body_option("RekeyLimit",sshd_RekeyLimit) -}}
{{ body_option("RevokedKeys",sshd_RevokedKeys) -}}
{{ body_option("RhostsRSAAuthentication",sshd_RhostsRSAAuthentication) -}}
{{ body_option("ServerKeyBits",sshd_ServerKeyBits) -}}
{{ body_option("StrictModes",sshd_StrictModes) -}}
{{ body_option("Subsystem",sshd_Subsystem) -}}
{{ body_option("SyslogFacility",sshd_SyslogFacility) -}}
{{ body_option("TCPKeepAlive",sshd_TCPKeepAlive) -}}
{{ body_option("TcpRcvBufPoll",sshd_TcpRcvBufPoll) -}}
{{ body_option("TrustedUserCAKeys",sshd_TrustedUserCAKeys) -}}
{{ body_option("UseDNS",sshd_UseDNS) -}}
{{ body_option("UseLogin",sshd_UseLogin) -}}
{{ body_option("UsePAM",sshd_UsePAM) -}}
{{ body_option("UsePrivilegeSeparation",sshd_UsePrivilegeSeparation) -}}
{{ body_option("VersionAddendum",sshd_VersionAddendum) -}}
{{ body_option("X11DisplayOffset",sshd_X11DisplayOffset) -}}
{{ body_option("X11Forwarding",sshd_X11Forwarding) -}}
{{ body_option("X11UseLocalhost",sshd_X11UseLocalhost) -}}
{{ body_option("XAuthLocation",sshd_XAuthLocation) -}}
{% if sshd['Match'] is defined %}
{{ match_block(sshd['Match']) -}}
{% endif %}
{% if sshd_match is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_1 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_2 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_3 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_4 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_5 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}
{% if sshd_match_6 is defined %}
{{ match_block(sshd_match) -}}
{% endif %}

3
vars/Debian.yml
View file

@ -36,3 +36,6 @@ sshd_defaults:
AcceptEnv: LANG LC_*
Subsystem: "sftp {{ sshd_sftp_server }}"
UsePAM: yes
Match:
- Condition: User vagrant
MaxSessions: 10