ansible-infra/roles/deploy_ssh_server_config/tasks/main.yaml
June abc738c9c2
All checks were successful
/ Ansible Lint (push) Successful in 1m33s
flatten the "playbooks" directory for better structure
Because of how Ansible local relative search paths work, the global
"files" and "templates" directories need to be next to the playbooks.
However its not intuitive to look into the playbooks directory to find
the files and templates for a host.
Therefore flatten the playbooks directory to get rid of this confusing
structure.

Also see:
https://docs.ansible.com/ansible/latest/playbook_guide/playbook_pathing.html#resolving-local-relative-paths
2024-12-02 00:48:19 +01:00

36 lines
1.3 KiB
YAML

# Role and config created after: https://infosec.mozilla.org/guidelines/openssh
- name: deploy SSH server config
become: true
block:
- name: deploy `sshd_config`
ansible.builtin.template:
force: true
dest: /etc/ssh/sshd_config
mode: "0644"
owner: root
group: root
src: sshd_config.j2
notify:
# Reboot instead of just restarting the ssh service, since I don't know how Ansible reacts, when it restarts the service it probably needs for the connection.
- reboot the system
- name: deactivate short moduli
ansible.builtin.shell:
executable: /bin/bash
cmd: |
set -eo pipefail
awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.tmp
if diff /etc/ssh/moduli /etc/ssh/moduli.tmp; then
rm /etc/ssh/moduli.tmp
else
mv /etc/ssh/moduli.tmp /etc/ssh/moduli
echo "ansible-changed: changed /etc/ssh/moduli"
fi
register: result
changed_when:
- '"ansible-changed" in result.stdout'
notify:
# Reboot instead of just restarting the ssh service, since I don't know how Ansible reacts, when it restarts the service it probably needs for the connection.
- reboot the system