54 lines
1.2 KiB
YAML
54 lines
1.2 KiB
YAML
---
|
|
# SSH Hardening Tasks
|
|
|
|
- name: Backup original sshd_config
|
|
ansible.builtin.copy:
|
|
src: /etc/ssh/sshd_config
|
|
dest: /etc/ssh/sshd_config.backup
|
|
remote_src: yes
|
|
force: no
|
|
|
|
- name: Configure SSH daemon
|
|
ansible.builtin.template:
|
|
src: sshd_config.j2
|
|
dest: /etc/ssh/sshd_config
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
validate: '/usr/sbin/sshd -t -f %s'
|
|
notify: restart sshd
|
|
|
|
- name: Ensure SSH directory exists for root
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0700'
|
|
|
|
- name: Generate strong SSH host keys
|
|
ansible.builtin.command: ssh-keygen -A
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
|
|
- name: Remove weak SSH host keys
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /etc/ssh/ssh_host_dsa_key
|
|
- /etc/ssh/ssh_host_dsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
|
|
- name: Set permissions on SSH host keys
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_facts['os_family'] == "Debian"
|