diff --git a/.ansible-lint b/.ansible-lint index cee4980..d5975b8 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -5,6 +5,7 @@ exclude_paths: - .markdownlint.yaml skip_list: - var-naming[no-role-prefix] + - meta-runtime[unsupported-version] mock_roles: - willshersystems.sshd.ansible-sshd mock_modules: diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 57bd071..7f20b5d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,14 +1,14 @@ --- repos: - repo: https://github.com/adrienverge/yamllint.git - rev: v1.27.1 + rev: 81e9f98ffd059efe8aa9c1b1a42e5cce61b640c6 # frozen: v1.35.1 hooks: - id: yamllint files: \.(yaml|yml)$ types: [file, yaml] entry: yamllint --strict - repo: https://github.com/ansible/ansible-lint.git - rev: v6.5.2 + rev: 2d9f1ed1e6d08e1f6a18e50f789ab1580220c7db # frozen: v24.6.0 hooks: - id: ansible-lint files: \.(yaml|yml)$ diff --git a/.yamllint.yml b/.yamllint.yml index cfb56d3..39f1b71 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -4,6 +4,12 @@ ignore: | /.tox/ /.github/ /tests/roles/ -# skip checking line length rules: + comments-indentation: false + document-start: disable line-length: disable + braces: + max-spaces-inside: 1 + octal-values: + forbid-implicit-octal: true + forbid-explicit-octal: true diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 961b20f..6fb1c8a 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -6,7 +6,7 @@ In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, -level of experience, education, socio-economic status, nationality, personal +level of experience, education, socioeconomic status, nationality, personal appearance, race, religion, or sexual identity and orientation. ## Our Standards diff --git a/README.md b/README.md index c486bc4..8b4d9a9 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ via simple password. If you need this functionality, be sure to set Tested on: -* Ubuntu precise, trusty, xenial, bionic, focal, jammy +* Ubuntu precise, trusty, xenial, bionic, focal, jammy, noble * [![Run tests on Ubuntu latest](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-ubuntu.yml/badge.svg)](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-ubuntu.yml) * Debian wheezy, jessie, stretch, buster, bullseye, bookworm * [![Run tests on Debian](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-debian-check.yml/badge.svg)](https://github.com/willshersystems/ansible-sshd/actions/workflows/ansible-debian-check.yml) diff --git a/handlers/main.yml b/handlers/main.yml index 183b4e2..1af2b97 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -10,7 +10,7 @@ - ansible_connection != 'chroot' - ansible_facts['os_family'] != 'AIX' - ansible_facts['os_family'] != 'OpenWrt' - listen: reload_sshd + listen: Reload_sshd # sshd on AIX cannot be 'reloaded', it must be Stopped+Started. # It's dangerous to do this in two tasks.. you're stopping SSH and then trying to SSH back in to start it. @@ -25,7 +25,7 @@ stopsrc -s sshd until $(lssrc -s sshd | grep -q inoperative); do sleep 1; done startsrc -s sshd - listen: reload_sshd + listen: Reload_sshd changed_when: false when: - sshd_allow_reload|bool @@ -39,4 +39,4 @@ when: - sshd_allow_reload|bool - ansible_facts['os_family'] == 'OpenWrt' - listen: reload_sshd + listen: Reload_sshd diff --git a/meta/main.yml b/meta/main.yml index c8075a0..c8e199c 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -24,8 +24,9 @@ galaxy_info: - bionic - focal - jammy + - noble - name: FreeBSD - version: + versions: - "10.1" - name: EL versions: diff --git a/meta/runtime.yml b/meta/runtime.yml new file mode 100644 index 0000000..1e85b01 --- /dev/null +++ b/meta/runtime.yml @@ -0,0 +1,2 @@ +--- +requires_ansible: ">=2.15.0" diff --git a/tasks/install.yml b/tasks/install.yml index 211cbf3..9e6c409 100644 --- a/tasks/install.yml +++ b/tasks/install.yml @@ -22,7 +22,7 @@ when: - sshd_sysconfig | bool - __sshd_sysconfig_supports_use_strong_rng or __sshd_sysconfig_supports_crypto_policy - notify: reload_sshd + notify: Reload_sshd - name: Check FIPS mode ansible.builtin.include_tasks: check_fips.yml diff --git a/tasks/install_config.yml b/tasks/install_config.yml index 85ac40f..1c4efb1 100644 --- a/tasks/install_config.yml +++ b/tasks/install_config.yml @@ -24,7 +24,7 @@ {{ sshd_binary }} -t -f %s {% endif %} backup: "{{ sshd_backup }}" - notify: reload_sshd + notify: Reload_sshd - name: Make sure the include path is present in the main sshd_config ansible.builtin.lineinfile: @@ -43,7 +43,7 @@ {{ sshd_binary }} -t -f %s {% endif %} backup: "{{ sshd_backup }}" - notify: reload_sshd + notify: Reload_sshd when: - sshd_main_config_file is not none - sshd_config_file | dirname == sshd_main_config_file ~ '.d' diff --git a/tasks/install_namespace.yml b/tasks/install_namespace.yml index 525cf6e..1e7e1b6 100644 --- a/tasks/install_namespace.yml +++ b/tasks/install_namespace.yml @@ -21,4 +21,4 @@ {{ sshd_binary }} -t -f %s {% endif %} backup: "{{ sshd_backup }}" - notify: reload_sshd + notify: Reload_sshd diff --git a/tasks/install_service.yml b/tasks/install_service.yml index aee2514..b843449 100644 --- a/tasks/install_service.yml +++ b/tasks/install_service.yml @@ -12,7 +12,7 @@ owner: root group: root mode: "0644" - notify: reload_sshd + notify: Reload_sshd - name: Install instanced service unit file ansible.builtin.template: @@ -21,7 +21,7 @@ owner: root group: root mode: "0644" - notify: reload_sshd + notify: Reload_sshd when: - __sshd_socket_accept | bool @@ -32,7 +32,7 @@ owner: root group: root mode: "0644" - notify: reload_sshd + notify: Reload_sshd - name: Service enabled and running ansible.builtin.service: diff --git a/templates/sshd.socket.j2 b/templates/sshd.socket.j2 index 9e0c2fb..bd2341f 100644 --- a/templates/sshd.socket.j2 +++ b/templates/sshd.socket.j2 @@ -14,6 +14,12 @@ Accept=yes {% else %} Accept=no {% endif %} +{% if __sshd_socket_freebind is not none %} +FreeBind={{ 'yes' if __sshd_socket_freebind else 'no' }} +{% endif %} [Install] WantedBy=sockets.target +{% if __sshd_socket_required_by is not none %} +RequiredBy={{ __sshd_socket_required_by }} +{% endif %} diff --git a/tests/tests_all_options.yml b/tests/tests_all_options.yml index d085c09..bb59d4d 100644 --- a/tests/tests_all_options.yml +++ b/tests/tests_all_options.yml @@ -93,7 +93,7 @@ | grep -o '^\( \| \)[A-Z][A-Za-z0-9]*\(.\| \)' \ | grep -v "[A-Za-z0-9] $" | grep -v "[^A-Za-z0-9 ]$" \ | awk '{ print $1 }' \ - | grep -v '^$' | grep -v "^\(Match\|OpenSSH\|The\|Arguments\|Theo\)$" + | grep -v '^$' | grep -v "^\(Match\|OpenSSH\|The\|Arguments\|Theo\|Tatu\|Aaron\|Each\)$" args: executable: /bin/bash register: sshd_options diff --git a/tests/tests_second_service.yml b/tests/tests_second_service.yml index bd5ad1d..eb3cb5e 100644 --- a/tests/tests_second_service.yml +++ b/tests/tests_second_service.yml @@ -94,6 +94,7 @@ - ansible_facts['service_mgr'] == 'systemd' or (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7') - ansible_facts['distribution'] != "Debian" or ansible_facts['distribution_major_version'] | int < 12 + - not (ansible_facts['distribution'] == 'Ubuntu' and ansible_facts['distribution_version'] is version('24.04', '>=')) block: - name: Read the created instantiated service file ansible.builtin.slurp: diff --git a/tests/tests_second_service_drop_in.yml b/tests/tests_second_service_drop_in.yml index a315815..b3956db 100644 --- a/tests/tests_second_service_drop_in.yml +++ b/tests/tests_second_service_drop_in.yml @@ -106,6 +106,7 @@ when: - ansible_facts['service_mgr'] == 'systemd' - ansible_facts['distribution'] != "Debian" or ansible_facts['distribution_major_version'] | int < 12 + - not (ansible_facts['distribution'] == 'Ubuntu' and ansible_facts['distribution_version'] is version('24.04', '>=')) block: - name: Read the created instantiated service file ansible.builtin.slurp: diff --git a/tests/tests_systemd_services.yml b/tests/tests_systemd_services.yml index 7eec5d9..e37c45c 100644 --- a/tests/tests_systemd_services.yml +++ b/tests/tests_systemd_services.yml @@ -118,6 +118,7 @@ - ansible_facts['service_mgr'] == 'systemd' or (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '7') - ansible_facts['distribution'] != "Debian" or ansible_facts['distribution_major_version'] | int < 12 + - not (ansible_facts['distribution'] == 'Ubuntu' and ansible_facts['distribution_version'] is version('24.04', '>=')) block: - name: Read the distribution instantiated service file ansible.builtin.slurp: diff --git a/vars/Ubuntu_22.yml b/vars/Ubuntu_22.yml index 75b48b0..1c3ec87 100644 --- a/vars/Ubuntu_22.yml +++ b/vars/Ubuntu_22.yml @@ -14,6 +14,7 @@ __sshd_defaults: Include: /etc/ssh/sshd_config.d/*.conf KbdInteractiveAuthentication: false UsePAM: true + PrintMotd: false AcceptEnv: LANG LC_* Subsystem: "sftp /usr/lib/openssh/sftp-server" diff --git a/vars/Ubuntu_24.yml b/vars/Ubuntu_24.yml new file mode 100644 index 0000000..77d4079 --- /dev/null +++ b/vars/Ubuntu_24.yml @@ -0,0 +1,33 @@ +--- +__sshd_os_supported: true + +__sshd_service: ssh +__sshd_packages: + - openssh-server + - openssh-sftp-server +# Ubuntu 22.04 shipped with drop-in directory support so we touch +# just included file with highest priority by default +__sshd_config_file: /etc/ssh/sshd_config.d/00-ansible_system_role.conf +__sshd_config_mode: "0644" +# the defaults here represent the defaults shipped in the main sshd_config +__sshd_defaults: + Include: /etc/ssh/sshd_config.d/*.conf + KbdInteractiveAuthentication: false + UsePAM: true + PrintMotd: false + AcceptEnv: LANG LC_* + Subsystem: "sftp /usr/lib/openssh/sftp-server" + +__sshd_runtime_directory: sshd + +__sshd_drop_in_dir_mode: '0755' +__sshd_main_config_file: /etc/ssh/sshd_config + +__sshd_environment_file: /etc/default/ssh +__sshd_environment_variable: $SSHD_OPTS +__sshd_service_after: auditd.service +__sshd_service_alias: sshd + +__sshd_socket_accept: false +__sshd_socket_freebind: true +__sshd_socket_required_by: ssh.service diff --git a/vars/main.yml b/vars/main.yml index 792e84f..d048546 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -87,3 +87,9 @@ __sshd_service_restart_timeout: ~ # The systemd socket file does not accept the connection __sshd_socket_accept: true + +# Boolean to control if the systemd socket can be bound to non-local IP addresses +__sshd_socket_freebind: ~ + +# Space separated list of service names that this socket is required by +__sshd_socket_required_by: ~