Commit graph

15 commits

Author SHA1 Message Date
Jakub Jelen
7f69d1e69a Filter out Ed25519 keys from default in FIPS mode
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
2021-11-16 15:05:22 +01:00
Jakub Jelen
345eeed0c0 Fix variable precedence for sshd_hostkey_* variables
This worked fine with the new include_role: invocation, but not with
the old roles: invocation.
2021-06-10 19:53:00 +02:00
Jakub Jelen
dd820d1c24 Implement hostkey checks
This is useful during provisioning, when the keys were not generated
by sshd-keygen service or similar principles depending on operating
system.

This is also helpful when running this role in containers, where
is no service running either.

The keys are generally readable only by root, but in RHEL and Fedora,
they are readable also by group ssh_keys, which is used for hostbased
authentication.

This should fix #111
2020-11-16 11:10:16 +01:00
Jakub Jelen
f32003f051 Remove set_facts tasks not to polute global namespace
The usage of set_facts inside of roles is not recommended if
it is used for internal variables used only inside of the role.
It is recommended to use variables with smaller scope to avoid
inter-dependencies between different invocations of the same
role as demonstrated in the tests_alternative_file.yml later
in the patch series

ttps://github.com/oasis-roles/meta_standards#ansible-best-practices
2020-11-06 12:04:41 +01:00
Jakub Jelen
71b3f87308 Add support for sysconfig on Fedora/RHEL
This is useful for opting out from system-wide cryto policy for SSH
or configuring advanced use case (strong RNG seed).

Fixes: #141
2020-10-06 21:11:39 +02:00
Jakub Jelen
e6798c5d1e Fix default configuration for RHEL7 2020-09-23 14:49:42 +02:00
Jakub Jelen
9e7eae712d Reformat yaml files to avoid wrong indentation, trailing spaces and long lines 2020-09-23 14:49:42 +02:00
Nikolaos Kakouros
133543cc1f Renames variables for all supported platforms 2018-09-03 00:23:58 +02:00
Matt Willsher
fffdf9df08 Add note about UsePAM 2017-05-04 15:03:19 +01:00
Matt Willsher
20c07b3178 Add ed25519 support for EL7
ed25519 support was added in RH7.1
2015-08-25 17:58:17 +01:00
Kostyrev Aleksandr
0e86168b3c fix type in AcceptEnv for RedHat7 2015-06-25 23:22:39 +03:00
Matt Willsher
849257c2f4 Add test for supported OS 2015-01-13 17:41:56 +00:00
Matt Willsher
6da7bb1f55 Merge from develop changes 2015-01-04 12:51:40 +00:00
Matt Willsher
3689ad7020 More distro supported, better docs 2014-12-22 20:19:44 +00:00
Matt Willsher
be5b543447 Add EL 7 2014-12-22 18:49:17 +00:00