aboutsummaryrefslogtreecommitdiffstats
path: root/roles/fedora
diff options
context:
space:
mode:
authorEmil Renner Berthing <esmil@labitat.dk>2020-02-27 14:44:24 +0100
committerEmil Renner Berthing <esmil@labitat.dk>2020-02-27 17:45:04 +0100
commitd26fe55aa9de5f0eb51152c22d12ff28a9c488d4 (patch)
tree04501e2a33ec62cd07e4e55efd1a4ab411abc578 /roles/fedora
parent4115d711842ea235966868a325f5d42ee428db14 (diff)
downloadlabitat-ansible-d26fe55aa9de5f0eb51152c22d12ff28a9c488d4.tar.gz
labitat-ansible-d26fe55aa9de5f0eb51152c22d12ff28a9c488d4.tar.xz
labitat-ansible-d26fe55aa9de5f0eb51152c22d12ff28a9c488d4.zip
space_server: use common secrets.yml in ansible root
..and generalize and move sshd tasks to fedora role.
Diffstat (limited to 'roles/fedora')
-rw-r--r--roles/fedora/tasks/main.yml2
-rw-r--r--roles/fedora/tasks/sshd.yml51
2 files changed, 53 insertions, 0 deletions
diff --git a/roles/fedora/tasks/main.yml b/roles/fedora/tasks/main.yml
index 4492df5..de4c160 100644
--- a/roles/fedora/tasks/main.yml
+++ b/roles/fedora/tasks/main.yml
@@ -20,5 +20,7 @@
tags: networkd
- import_tasks: timesyncd.yml
tags: timesyncd
+- import_tasks: sshd.yml
+ tags: sshd
# vim: set ts=2 sw=2 et:
diff --git a/roles/fedora/tasks/sshd.yml b/roles/fedora/tasks/sshd.yml
new file mode 100644
index 0000000..603fbf9
--- /dev/null
+++ b/roles/fedora/tasks/sshd.yml
@@ -0,0 +1,51 @@
+---
+- name: Create private host keys
+ copy:
+ dest: '/etc/ssh/{{ item.key }}'
+ content: '{{ item.value.private }}'
+ owner: root
+ group: ssh_keys
+ mode: 0640
+ with_dict: '{{ ssh_host_keys[hostname] }}'
+ loop_control:
+ label: '/etc/ssh/{{ item.key }}'
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
+
+- name: Create public host keys
+ copy:
+ dest: '/etc/ssh/{{ item.key }}.pub'
+ content: '{{ item.value.public }}'
+ owner: root
+ group: root
+ mode: 0644
+ with_dict: '{{ ssh_host_keys[hostname] }}'
+ loop_control:
+ label: '/etc/ssh/{{ item.key }}.pub'
+ when: ssh_host_keys is defined and hostname in ssh_host_keys
+
+- name: Configure SSH daemon
+ lineinfile:
+ path: '/etc/ssh/sshd_config'
+ regexp: '{{ item.regexp }}'
+ line: '{{ item.line }}'
+ with_items:
+ - regexp: '^[# ]*PermitRootLogin'
+ line: 'PermitRootLogin no'
+ - regexp: '^PasswordAuthentication'
+ line: 'PasswordAuthentication no'
+ - regexp: '^[# ]*GSSAPIAuthentication'
+ line: 'GSSAPIAuthentication no'
+ notify: restart sshd
+
+- name: Enable SSH daemon
+ systemd:
+ name: sshd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: not chroot
+- name: '- when in chroot'
+ command: systemctl enable sshd.service
+ when: chroot|bool
+
+# vim: set ts=2 sw=2 et: