Commit f5ba9a3b authored by nimrod's avatar nimrod
Browse files

SSH security. 

- Single configuration for the OpenSSH daemon (both on Debian and
  OpenBSD systems).
- The ssh-rsa signature scheme is being deprected (see the OpenSSH 8.5
  release notes for more details). Remove it everywhere.
parent 9f55919e

roles/debian_server/handlers/main.yml

+5 −0
Original line number Diff line number Diff line
@@ -10,3 +10,8 @@ 
- name: Update GRUB

  command:

    cmd: update-grub



- name: Restart the SSH daemon

  service:

    name: ssh

    state: restarted

roles/debian_server/tasks/main.yml

+5 −13
Original line number Diff line number Diff line
@@ -106,19 +106,11 @@ 
    state: present

    value: "640000"



- name: Secure SSH

  with_dict:

    PermitRootLogin: !!str no

    PasswordAuthentication: !!str no

  lineinfile:

    backup: true

    line: |-

      {{ item.key }} {{ item.value }}

    path: /etc/ssh/sshd_config

    regexp: |-

      {{ item.key }}

    state: present

    validate: sshd -Tf %s

- name: Configure the SSH daemon

  include_tasks:

    file: '{{ playbook_dir }}/tasks/sshd_config.yaml'

  tags:

    - always



- name: Make /tmp a tmpfs mount

  ansible.posix.mount:

roles/router/tasks/main.yaml

+3 −14
Original line number Diff line number Diff line
@@ -479,21 +479,10 @@ 
    - syspatch



- name: Configure the SSH daemon

  with_dict:

    PermitRootLogin: 'no'

    PasswordAuthentication: 'no'

    KexAlgorithms: '-diffie-hellman-group14-sha1'

    # yamllint disable-line rule:line-length

    MACs: '-hmac-sha1,umac-64-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com'

  lineinfile:

    line: '{{ item.key }} {{ item.value }}'

    path: /etc/ssh/sshd_config

    regexp: '{{ item.key }}'

    validate: sshd -Tf %s

  notify:

    - Restart the SSH daemon

  include_tasks:

    file: '{{ playbook_dir }}/tasks/sshd_config.yaml'

  tags:

    - ssh

    - always



# yamllint disable-line rule:line-length

- name: Configure the daily Cron job (skip email if there's nothing to report, report on pending system patches).

tasks/sshd_config.yaml

0 → 100644
+31 −0
Original line number Diff line number Diff line 
---

- name: Configure the SSH daemon

  with_dict:

    CASignatureAlgorithms: >-

      -ssh-rsa

    HostbasedAcceptedKeyTypes: >-

      -ssh-rsa

    HostKeyAlgorithms: >-

      -ssh-rsa

    KexAlgorithms: >-

      -diffie-hellman-group14-sha1

    MACs: >-

      -hmac-sha1,

      umac-64-etm@openssh.com,

      hmac-sha1-etm@openssh.com,

      umac-64@openssh.com

    PermitRootLogin: !!str no

    PasswordAuthentication: !!str no

    PubkeyAcceptedKeyTypes: >-

      -ssh-rsa,

      ssh-rsa-cert-v01@openssh.com

  lineinfile:

    backup: true

    line: '{{ item.key }} {{ item.value|replace(" ", "") }}'

    path: /etc/ssh/sshd_config

    regexp: '{{ item.key }}'

    validate: sshd -Tf %s

  notify:

    - Restart the SSH daemon

  tags:

    - ssh