Jakub Jelen
dd820d1c24
Implement hostkey checks
...
This is useful during provisioning, when the keys were not generated
by sshd-keygen service or similar principles depending on operating
system.
This is also helpful when running this role in containers, where
is no service running either.
The keys are generally readable only by root, but in RHEL and Fedora,
they are readable also by group ssh_keys, which is used for hostbased
authentication.
This should fix #111
2020-11-16 11:10:16 +01:00
Jakub Jelen
f32003f051
Remove set_facts tasks not to polute global namespace
...
The usage of set_facts inside of roles is not recommended if
it is used for internal variables used only inside of the role.
It is recommended to use variables with smaller scope to avoid
inter-dependencies between different invocations of the same
role as demonstrated in the tests_alternative_file.yml later
in the patch series
ttps://github.com/oasis-roles/meta_standards#ansible-best-practices
2020-11-06 12:04:41 +01:00
Jakub Jelen
f1eef49960
gentoo: Remove bogus default values
2020-11-06 10:30:29 +01:00
Jakub Jelen
71b3f87308
Add support for sysconfig on Fedora/RHEL
...
This is useful for opting out from system-wide cryto policy for SSH
or configuring advanced use case (strong RNG seed).
Fixes : #141
2020-10-06 21:11:39 +02:00
Jakub Jelen
707e2e64a3
Update defaults for Fedora supporting Include keyword
2020-09-23 14:49:42 +02:00
Jakub Jelen
e6798c5d1e
Fix default configuration for RHEL7
2020-09-23 14:49:42 +02:00
Jakub Jelen
9e7eae712d
Reformat yaml files to avoid wrong indentation, trailing spaces and long lines
2020-09-23 14:49:42 +02:00
Matt Willsher
78c56e2129
Add pre-commit, fix issues
2020-09-18 20:49:22 +01:00
Matt Willsher
ed989f571c
Update CI to Ubuntu focal, add Ubuntu focal support to module
2020-09-18 20:48:56 +01:00
oddlama
3792fbbebb
Add Gentoo support (with secure defaults)
2020-01-19 17:41:52 +01:00
Matt Willsher
e70dbc3007
Merge pull request #117 from MartinVerges/debian10
...
add debian 10 (buster) support
2019-11-19 13:54:19 +00:00
Martin Verges
1cbfc4e272
on debian10 securely configure SSH by default
...
verified configuration with 'ssh-audit'
removed controversial keys
removed insecure macs,keys,ciphers
tested on Debian 10 Buster
2019-10-24 13:44:43 +02:00
Martin Verges
59314077b9
add debian 10 (buster) support
2019-10-23 15:52:21 +02:00
Tiziano Müller
90b19f3b7c
vars: add config for RedHat/CentOS 8
...
besides dropping the deprecated Sandbox option, set
`GSSAPICleanupCredentials no` since that's what I have on a fresh
installation of CentOS 8.
2019-10-14 14:48:06 +02:00
Tiziano Müller
6be10a2d17
vars: add config for openSUSE Leap 15
2019-10-14 14:45:08 +02:00
David Little
b5585b81f3
Newline at EOF
2019-07-10 13:05:19 -05:00
David Little
53a89b677e
AIX support for role (including new AIX handler)
2019-07-10 12:07:07 -05:00
Kevin P. Fleming
e000716443
Remove 'UsePrivilegeSeparation' from Fedora defaults
...
This option has been deprecated in OpenSSH for nearly two years, was the default for five years before that, and is not part of the current Fedora default configuration. It should not be included in sshd_config on Fedora systems.
2019-04-28 21:12:06 -04:00
mfredholm
a3ca915dbd
Update Ubuntu_18.yml
...
Minimal vars using defaults.
2019-01-31 10:33:01 +01:00
mfredholm
03172b3c07
Remove deprecated options
2019-01-28 13:30:19 +01:00
Nikolaos Kakouros
133543cc1f
Renames variables for all supported platforms
2018-09-03 00:23:58 +02:00
Nikolaos Kakouros
54715f9456
Fixes Ubuntu vars
2018-08-26 00:06:42 +02:00
Nikolaos Kakouros
f5c13ee90f
Merge branch 'master' into systemd
2018-08-25 23:48:09 +02:00
Nikolaos Kakouros
5774f7f44f
Adds ability to install a systemd service
2018-08-25 23:39:06 +02:00
Daniel Duong
20488a5edc
Add Ubuntu_18.yml
...
I copied it from Ubuntu_16.yml
2018-08-15 12:24:41 +07:00
Bo Huang
80fdedca43
Add CoreOS support
2018-06-15 16:29:07 -07:00
Bo Huang
f7f1e466e9
Amazon Linux default sshd var name should be sshd_defaults
2018-05-21 23:41:09 -07:00
Tim Fletcher
7afdd97726
Remove Deprecated options in default SSH config
2018-04-16 21:45:16 +02:00
Pieter Lexis
b559e19143
Fix Arch Linux var file
2017-10-26 16:21:29 +02:00
Ian Hattendorf
e14fbcfb99
Add Debian 9 (stretch) vars
...
Debian stretch has been released, copy Debian_8.yml into Debian_9.yml.
2017-06-23 11:26:16 -07:00
Matt Willsher
fffdf9df08
Add note about UsePAM
2017-05-04 15:03:19 +01:00
Harald Koch
f36d32e833
cleanup Archlinux support to match defaults in current package (openssh-7.4p1-2)
2017-02-11 11:11:18 -05:00
Markos Chandras
97e7660ac5
vars: SUSE: Add default variables for SUSE based distributions
2017-01-12 16:42:45 +00:00
Jasper Lievisse Adriaanse
ef4bc25d54
Support for OpenBSD
2016-10-19 21:33:15 +02:00
Ivan Kurnosov
89e4a4c574
Added ubuntu 16.04 config
2016-04-07 20:10:53 +12:00
Martin Stefany
ee74b9611f
Remove Fedora_22.yml
...
Remove Fedora_22.yml since it matches 'default' Fedora.yml list of HostKeys.
2016-01-09 16:28:51 +01:00
Martin Stefany
32de8c803a
Add ed25519 key to default Fedora.yml
...
Currently only supported Fedora distributions are 22 and 23, and they both ship openssh 7.1p1 which supports all 'rsa', 'ecdsa' and 'ed25519' keys, turn them on by default.
2016-01-09 16:27:35 +01:00
Matt Willsher
20c07b3178
Add ed25519 support for EL7
...
ed25519 support was added in RH7.1
2015-08-25 17:58:17 +01:00
Matt Willsher
8dada7e6a6
Fix HostbasedAuthentication typo
2015-07-23 18:24:12 +01:00
Matt Willsher
8f4aac2a37
Merge pull request #20 from jitakirin/fedora-support
...
Add Fedora support
2015-06-28 09:33:09 +01:00
jitakirin
e6d8ba264c
Add Fedora support
...
Based on RedHat 7 with few modifications (ed25519 hostkey for F22,
GSSAPICleanupCredentials defaults to no, s/LC_TYPE/LC_CTYPE/ in
AcceptEnv).
Tested on Fedora 20 & 22.
2015-06-26 10:23:42 +01:00
Kostyrev Aleksandr
0e86168b3c
fix type in AcceptEnv for RedHat7
2015-06-25 23:22:39 +03:00
Костырев Александр
70c45f0d6f
fix type in AcceptEnv
...
default AcceptEnv in RedHat includes LC_CTYPE but not LC_TYPE
2015-06-25 18:49:20 +03:00
Matt Willsher
a2116fe211
Merge branch 'master' into develop
2015-01-23 10:44:46 +00:00
Richard van den Brand
5c276ff7a1
Don't install openssh-sftp-server because this removes openssh-server package on Debian
2015-01-23 11:24:14 +01:00
Matt Willsher
f2648cc295
Add defaults.yml back in to stop failure on var import
2015-01-15 10:26:40 +00:00
Matt Willsher
849257c2f4
Add test for supported OS
2015-01-13 17:41:56 +00:00
Matt Willsher
e15dd828f2
Fixed typo in HostbasedAuthentication
2015-01-13 14:27:59 +00:00
Matt Willsher
13fa494cd8
Remove blacklist packages
2015-01-13 13:29:45 +00:00
Matt Willsher
bb3e36a914
Add precise, move 14.04 to specific configuration
2015-01-04 14:56:06 +00:00
