chore: update

hardening/playbook-ssh-hardenning.yml

@@ -1,5 +1,5 @@
 - name: SSH HARDENNING
-  hosts: load-balancer
+  hosts: prod,pre-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer,!backup-mln
   become: true
   gather_facts: true
   tasks:
@@ -24,7 +24,7 @@
 
       - name: Check si la paire de clé SSH existe
         ansible.builtin.stat:
-            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
         delegate_to: localhost
         become: false
         register: ssh_key_check
@@ -32,7 +32,7 @@
 
       - name: Générer la paire de clés SSH localement
         community.crypto.openssh_keypair:
-            path: "{{ playbook_dir }}/../../.ssh/{{ user_ssh }}"
+            path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
             type: ed25519
         delegate_to: localhost
         become: false
@@ -43,18 +43,26 @@
       - ansible.posix.authorized_key:
           user: "{{ user_ssh }}"
           state: present
-          key: "{{ lookup('file', playbook_dir + '/../../.ssh/' + user_ssh + '.pub') }}"
+          key: "{{ lookup('file', playbook_dir + '/../.ssh/' + user_ssh + '.pub') }}"
 
       - name: Déployer la config sshd durcie
         ansible.builtin.template:
             src: ../templates/ssh_harden_conf.j2
             dest: /etc/ssh/sshd_config
-            mode: "0644"
+            mode: "0600"
             owner: root
             group: root
             validate: /usr/sbin/sshd -t -f %s
         notify: restart ssh
 
+      - name: Restreindre les permissions des cles d'hote SSH privees (CIS 5.1.2)
+        ansible.builtin.shell: chmod 0600 /etc/ssh/ssh_host_*_key
+        changed_when: false
+
+      - name: Restreindre les permissions des cles d'hote SSH publiques (CIS 5.1.3)
+        ansible.builtin.shell: chmod 0644 /etc/ssh/ssh_host_*_key.pub
+        changed_when: false
+
       - name: Delete cloud ssh config if exists
         ansible.builtin.file:
             path: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf