85 lines
2.6 KiB
YAML
85 lines
2.6 KiB
YAML
- name: SSH HARDENNING
|
|
hosts: prod,pre-prod,replica-prod,infra,infra-runner,infra-utils,ota-uber,load-balancer,!backup-mln
|
|
become: true
|
|
gather_facts: true
|
|
tasks:
|
|
- name: Créer le groupe ssh
|
|
ansible.builtin.group:
|
|
name: ssh
|
|
state: present
|
|
|
|
- ansible.builtin.user:
|
|
name: "{{ user_ssh }}"
|
|
shell: /bin/bash
|
|
groups:
|
|
- sudo
|
|
- ssh
|
|
append: true
|
|
state: present
|
|
password: "{{ password_user_ssh }}"
|
|
update_password: on_create
|
|
create_home: true
|
|
home: /home/omnex
|
|
no_log: true
|
|
|
|
- name: Check si la paire de clé SSH existe
|
|
ansible.builtin.stat:
|
|
path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
|
|
delegate_to: localhost
|
|
become: false
|
|
register: ssh_key_check
|
|
tags: [key]
|
|
|
|
- name: Générer la paire de clés SSH localement
|
|
community.crypto.openssh_keypair:
|
|
path: "{{ playbook_dir }}/../.ssh/{{ user_ssh }}"
|
|
type: ed25519
|
|
delegate_to: localhost
|
|
become: false
|
|
when: not ssh_key_check.stat.exists
|
|
run_once: true
|
|
tags: [key]
|
|
|
|
- ansible.posix.authorized_key:
|
|
user: "{{ user_ssh }}"
|
|
state: present
|
|
key: "{{ lookup('file', playbook_dir + '/../.ssh/' + user_ssh + '.pub') }}"
|
|
|
|
- name: Déployer la config sshd durcie
|
|
ansible.builtin.template:
|
|
src: ../templates/ssh_harden_conf.j2
|
|
dest: /etc/ssh/sshd_config
|
|
mode: "0600"
|
|
owner: root
|
|
group: root
|
|
validate: /usr/sbin/sshd -t -f %s
|
|
notify: restart ssh
|
|
|
|
- name: Restreindre les permissions des cles d'hote SSH privees (CIS 5.1.2)
|
|
ansible.builtin.shell: chmod 0600 /etc/ssh/ssh_host_*_key
|
|
changed_when: false
|
|
|
|
- name: Restreindre les permissions des cles d'hote SSH publiques (CIS 5.1.3)
|
|
ansible.builtin.shell: chmod 0644 /etc/ssh/ssh_host_*_key.pub
|
|
changed_when: false
|
|
|
|
- name: Delete cloud ssh config if exists
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
|
|
state: absent
|
|
|
|
- name: Déployer la config cloud-init durcie
|
|
ansible.builtin.template:
|
|
src: ../templates/cloud_harden.conf.j2
|
|
dest: /etc/ssh/sshd_config.d/60-cloudimg-settings.conf
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
notify: restart ssh
|
|
|
|
handlers:
|
|
- name: restart ssh
|
|
ansible.builtin.service:
|
|
name: ssh
|
|
state: restarted
|