Ansible Role SSH server

Description

:grey_exclamation: Before using this role, please know that all my Ansible roles are fully written and accustomed to my IT infrastructure. So, even if they are as generic as possible they will not necessarily fill your needs, I advice you to carrefully analyse what they do and evaluate their capability to be installed securely on your servers.

This roles allow configuration of ssh server.

Requirements

Require Ansible >= 2.4

Dependencies

OS Family

This role is available for Debian and CentOS

Features

At this day the role can be used to :

• install sshd
• configure sshd
• filter the initial moduli to remove weak prime numbers
• local facts

Role Variables

All variables which can be overridden are stored in defaults/main.yml file as well as in table below. To see default values please refer to this file.

Most of the variables refers to the pure sshd config parameter. Please fetch informations from the man page.

Matchs

You can configure the available match using the ssh_server__match_list_global/group/host variables availables. Theses variable takes list of dict. Each dict must have the following form :

ssh_server__match_list_global
  - match: "match criterias"
    options:                                     # options that apply if "match" matches
      - AllowUsers test                          # a simple string option
      # a dict with version conditioned options
      # according to the current sshd version, the higher version condition win and it's options are applied
      - 8.2: AuthorizedKeysCommand /bin/true     # (string version)
        7.6:                                     # (list version)
          - AuthenticationMethods publickey
          - AllowUsers root
    state: absent               # optional state (default to present)

The available match criterias and options that you can apply depends on your current sshd version.

An example of group only allowed to run sftp is given, if you want to enable it you can use this bloc in inventory :

ssh_server__match_list_global:
  - '{{ ssh_server__match_group_sftponly }}'

Facts

By default the local fact are installed and expose the following variables :

ansible_local.ssh_server:
  version_full: '7.9p1'
  version_major: '7'

Example

Playbook

Use it in a playbook as follows:

- hosts: all
  roles:
    - turgon37.ssh_server

Inventory

To use this role create or update your playbook according the following example :

ssh_server__allow_agent_forwarding: false
ssh_server__allow_tcp_forwarding: false
ssh_server__allow_stream_local_forwarding: false
ssh_server__permit_tunnel: false
ssh_server__compression: true

ssh_server__allow_groups:
  - ssh
  - ssh-admins
ssh_server__permit_root_login: false
ssh_server__max_startups:
  start: 5
  rate: 80
  full: 10

ssh_server__match_list_global:
  - match: "LocalAddress 127.0.0.1"
    options:
      - AuthenticationMethods publickey,password
    state: present

  - match: "LocalAddress 10.0.0.1 Group ssh-admins"
    options:
    - AuthenticationMethods publickey password gssapi-with-mic

  - match: "LocalAddress 10.0.0.1 User root"
    options:
      - DenyUsers
      - AllowUsers root
      - DenyGroups
      - AllowGroups root
      - 7.0: 'PermitRootLogin prohibit-password'
        4.9: 'PermitRootLogin without-password'
      - AuthenticationMethods publickey
      - AuthorizedKeysFile /root/.ssh/authorized_keys
      - AuthorizedKeysCommand /bin/true

ssh_client__known_hosts_additionals:
  - '[gitlab]:7999 ssh-rsa XXXXX'

Example of FreeIPA configuration

ssh_server__authorized_keys: '/dev/null'
ssh_server__authorized_keys_lookup: true
ssh_server__authorized_keys_lookup_command: /usr/bin/sss_ssh_authorizedkeys
ssh_server__pubkey_authentication: true
ssh_server__gssapi_authentication: true