diff --git a/playbooks/roles/deploy_ssh_server_config/README.md b/playbooks/roles/deploy_ssh_server_config/README.md index ba78f86..026bda1 100644 --- a/playbooks/roles/deploy_ssh_server_config/README.md +++ b/playbooks/roles/deploy_ssh_server_config/README.md @@ -14,3 +14,4 @@ This role doesn't have nay required variables. - - Also see [Debian 11 cloud 2023-04-21 default /etc/ssh/sshd_config](docs/Debian_11_cloud_2023-04-21_default_etc_ssh_sshd_config). +- Also see [Debian 12 cloud 2023-07-25 default /etc/ssh/sshd_config](docs/Debian_12_cloud_2023-07-25_default_etc_ssh_sshd_config). diff --git a/playbooks/roles/deploy_ssh_server_config/docs/Debian_12_cloud_2023-07-25_default_etc_ssh_sshd_config b/playbooks/roles/deploy_ssh_server_config/docs/Debian_12_cloud_2023-07-25_default_etc_ssh_sshd_config new file mode 100644 index 0000000..f97f9e8 --- /dev/null +++ b/playbooks/roles/deploy_ssh_server_config/docs/Debian_12_cloud_2023-07-25_default_etc_ssh_sshd_config @@ -0,0 +1,123 @@ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server +ClientAliveInterval 120 diff --git a/playbooks/roles/deploy_ssh_server_config/tasks/main.yaml b/playbooks/roles/deploy_ssh_server_config/tasks/main.yaml index 9588d14..2b2fb22 100644 --- a/playbooks/roles/deploy_ssh_server_config/tasks/main.yaml +++ b/playbooks/roles/deploy_ssh_server_config/tasks/main.yaml @@ -4,14 +4,15 @@ block: - name: deploy `sshd_config` - ansible.builtin.copy: + ansible.builtin.template: force: true dest: /etc/ssh/sshd_config mode: 0644 owner: root group: root - src: sshd_config + src: sshd_config.j2 register: deploy_ssh_server_config__ssh_config_copy_result + when: inventory_hostname in groups['Debian_CloudInit_VMs'] - name: deactivate short moduli ansible.builtin.shell: diff --git a/playbooks/roles/deploy_ssh_server_config/files/sshd_config b/playbooks/roles/deploy_ssh_server_config/templates/sshd_config.j2 similarity index 80% rename from playbooks/roles/deploy_ssh_server_config/files/sshd_config rename to playbooks/roles/deploy_ssh_server_config/templates/sshd_config.j2 index 344f1fb..eefafa4 100644 --- a/playbooks/roles/deploy_ssh_server_config/files/sshd_config +++ b/playbooks/roles/deploy_ssh_server_config/templates/sshd_config.j2 @@ -34,16 +34,28 @@ AuthenticationMethods publickey PubkeyAuthentication yes # Don't do the other authentication types. PasswordAuthentication no +{# If on Debian 12, use the new keyword (KbdInteractiveAuthentication instead of ChallengeResponseAuthentication). #} +{% if ansible_facts["distribution"] == "Debian" and ansible_facts["distribution_major_version"] == "12" %} +KbdInteractiveAuthentication no +{% else %} ChallengeResponseAuthentication no +{% endif %} KerberosAuthentication no GSSAPIAuthentication no # Don't allow root login. PermitRootLogin no +{# If on Debian 12, use the new keyword (KbdInteractiveAuthentication instead of ChallengeResponseAuthentication). #} +{% if ansible_facts["distribution"] == "Debian" and ansible_facts["distribution_major_version"] == "12" %} +# Set this to "yes", but have "PasswordAuthentication" and +# "KbdInteractiveAuthentication" set to "no", to have account and session checks +# run. +{% else %} # Set this to "yes", but have "PasswordAuthentication" and # "ChallengeResponseAuthentication" set to "no", to have account and session # checks run. +{% endif %} # See "docs/Debian_11_cloud_2023-04-21_default_etc_ssh_sshd_config" for more # information. UsePAM yes