From 07af146990845417e73ef12f4099cdc27a865556 Mon Sep 17 00:00:00 2001 From: "a.kazantsev" Date: Mon, 13 Jul 2026 09:37:08 +0300 Subject: [PATCH] update from gigacoms --- roles/openssh/.ansible-lint | 78 +++++--------------------- roles/openssh/.gitlab-ci.yml | 49 ++++++++++++++++ roles/openssh/README.md | 17 ------ roles/openssh/meta/main.yml | 4 +- roles/openssh/requirements.yml | 10 ++++ roles/openssh/tasks/main.yml | 28 ++++----- roles/openssh/templates/sshd_config.j2 | 4 +- 7 files changed, 91 insertions(+), 99 deletions(-) mode change 100644 => 100755 roles/openssh/.ansible-lint create mode 100755 roles/openssh/.gitlab-ci.yml create mode 100755 roles/openssh/requirements.yml diff --git a/roles/openssh/.ansible-lint b/roles/openssh/.ansible-lint old mode 100644 new mode 100755 index c04a869..2b1d710 --- a/roles/openssh/.ansible-lint +++ b/roles/openssh/.ansible-lint @@ -1,71 +1,23 @@ --- -# Ansible-lint configuration -# Uses production profile for highest quality standards - -# Profile selection (production is strictest) profile: production -# Exclude paths +# Paths to exclude from linting exclude_paths: - - .cache/ - - .github/ - collections/ - - tests/output/ - - '*.md' - - .tox/ - - molecule/default/molecule.yml + - .git/ -# Enable specific security-focused rules -enable_list: - - no-log-password # Require no_log for password fields - - risky-file-permissions # Catch overly permissive file modes - - command-instead-of-shell # Prefer command over shell module - - name[casing] # Enforce consistent task naming - - yaml[line-length] # Max line length - - fqcn # Require Fully Qualified Collection Names - - jinja[spacing] # Consistent Jinja2 formatting - -# Skip list for rules we explicitly don't need -skip_list: - - role-name[path] # We use namespace in paths (generic/lshw) - - galaxy[no-changelog] # We don't use Galaxy - -# Strict mode - warnings become errors -strict: true - -# Warn about potential issues +# Treat these rule IDs as warnings instead of errors warn_list: - - experimental # Warn about experimental features - - no-changed-when # Tasks should have changed_when - - no-handler # Warn if notify without handler + - experimental + - name + - no-handler + - risky-shell-pipe + - no-changed-when + - risky-file-permissions + - yaml[trailing-spaces] -# Task naming requirements -task_name_prefix: "{stem} | " # Optional prefix for better organization - -# Offline mode for CI/CD -offline: false - -# Mock modules that may not be available during linting -mock_modules: - - docker_container - - docker_compose - - community.general.docker_compose - -# Mock roles for testing -mock_roles: - - community.general - - ansible-role-openssh_server - -# Kinds of files to lint -kinds: - - yaml: "**/*.yaml" - - yaml: "**/*.yml" - - playbook: "playbooks/*.yml" - - tasks: "roles/*/tasks/*.yml" - - handlers: "roles/*/handlers/*.yml" - - vars: "roles/*/vars/*.yml" - - vars: "roles/*/defaults/*.yml" - - meta: "roles/*/meta/*.yml" - -# Logging -verbosity: 1 +# Skip rules that don't apply to this project +skip_list: + - var-naming[no-role-prefix] + - yaml[line-length] + - name[missing] diff --git a/roles/openssh/.gitlab-ci.yml b/roles/openssh/.gitlab-ci.yml new file mode 100755 index 0000000..1ace23b --- /dev/null +++ b/roles/openssh/.gitlab-ci.yml @@ -0,0 +1,49 @@ +--- +# GitLab CI pipeline for Ansible infrastructure +# +# Required GitLab CI/CD Variables (Settings → CI/CD → Variables): +# ANSIBLE_SSH_USER — SSH username for target servers +# ANSIBLE_SSHKEY_ID_RSA — private SSH key (тип: File или Variable, содержимое id_rsa) +# ANSIBLE_BECOME_PASS — sudo password +# VCENTER_USER — vCenter username (e.g. administrator@vsphere.local) +# VCENTER_PASSWORD — vCenter password +# ANSIBLE_GIT_TOKEN — Project Access Token or Deploy Token with write_repository scope +# (required for committing connection_history.json from the pages job) +# Create: Settings → Access Tokens → role: Developer, scope: write_repository + +stages: + - validate + +# ── Shared configuration ─────────────────────────────────────────────────────── +default: + image: python:3.11-slim + before_script: + - apt-get update -qq + - apt-get install -y -qq --no-install-recommends openssh-client git + - pip install --quiet ansible ansible-lint pyvmomi requests netaddr + - ansible-galaxy collection install -r requirements.yml -p collections/ --force + - mkdir -p ~/.ssh && chmod 700 ~/.ssh + - printf '%b\n' "$ANSIBLE_SSHKEY_ID_RSA" > ~/.ssh/id_rsa + - chmod 600 ~/.ssh/id_rsa + - eval $(ssh-agent -s) + - ssh-add ~/.ssh/id_rsa + interruptible: true + +variables: + ANSIBLE_FORCE_COLOR: "1" + ANSIBLE_HOST_KEY_CHECKING: "False" + ANSIBLE_ROLES_PATH: roles + ANSIBLE_COLLECTIONS_PATH: collections + ANSIBLE_FILTER_PLUGINS: filter_plugins + PIP_NO_CACHE_DIR: "1" + # inventory environment — change to 'staging' for a staging pipeline + INVENTORY: inventory/prod + +# ── Stage: validate ──────────────────────────────────────────────────────────── +lint: + stage: validate + script: + - ansible-lint . + rules: + - if: $CI_PIPELINE_SOURCE == "merge_request_event" + - if: $CI_COMMIT_BRANCH diff --git a/roles/openssh/README.md b/roles/openssh/README.md index 78e3c4b..1fa03da 100644 --- a/roles/openssh/README.md +++ b/roles/openssh/README.md @@ -1,13 +1,5 @@ # Ansible Role: openssh_server -[![CI](https://img.shields.io/badge/CI-ready-brightgreen)](https://github.com/welshwandering/ansible-role-openssh_server) -[![Debian](https://img.shields.io/badge/Debian-11%20to%2014-A81D33?style=for-the-badge&logo=debian&logoColor=white)](docs/DISTRIBUTIONS.md) -[![Ubuntu](https://img.shields.io/badge/Ubuntu-22.04%20to%2025.10-E95420?style=for-the-badge&logo=ubuntu&logoColor=white)](docs/DISTRIBUTIONS.md) -[![Rocky Linux](https://img.shields.io/badge/Rocky_Linux-8%20to%2010-10B981?style=for-the-badge&logo=rocky-linux&logoColor=white)](docs/DISTRIBUTIONS.md) -[![Fedora](https://img.shields.io/badge/Fedora-43-51A2DA?style=for-the-badge&logo=fedora&logoColor=white)](docs/DISTRIBUTIONS.md) -![Ansible](https://img.shields.io/badge/Ansible-EE0000?style=for-the-badge&logo=ansible&logoColor=white) -[![License](https://img.shields.io/badge/License-MIT-blue?style=for-the-badge)](LICENSE) - Comprehensive OpenSSH server hardening for Debian and Ubuntu systems with support for 16 compliance frameworks, extensive CVE tracking, and version-aware capability detection. ## ✨ Features @@ -27,15 +19,6 @@ Comprehensive OpenSSH server hardening for Debian and Ubuntu systems with suppor ### Installation -Add to your `requirements.yml`: - -```yaml -roles: - - src: https://github.com/welshwandering/ansible-role-openssh_server - name: openssh_server - scm: git -``` - Then install: ```bash diff --git a/roles/openssh/meta/main.yml b/roles/openssh/meta/main.yml index b1ec81b..9bab267 100644 --- a/roles/openssh/meta/main.yml +++ b/roles/openssh/meta/main.yml @@ -41,9 +41,7 @@ galaxy_info: - "10" - name: Rocky versions: - - "8" - - "9" - - "10" + - "all" - name: Fedora versions: - "43" diff --git a/roles/openssh/requirements.yml b/roles/openssh/requirements.yml new file mode 100755 index 0000000..9d8296a --- /dev/null +++ b/roles/openssh/requirements.yml @@ -0,0 +1,10 @@ +--- +collections: + - name: ansible.posix + version: ">=1.5.0" + - name: ansible.utils + version: ">=2.0.0,<5.0.0" + - name: community.general + version: ">=8.0.0" + - name: community.vmware + version: ">=4.0.0" diff --git a/roles/openssh/tasks/main.yml b/roles/openssh/tasks/main.yml index 2f5d253..369a44b 100644 --- a/roles/openssh/tasks/main.yml +++ b/roles/openssh/tasks/main.yml @@ -113,21 +113,21 @@ - name: Set OpenSSH capability flags ansible.builtin.set_fact: # Core capabilities for backwards compatibility - openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version >= 7.4 }}" - openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version >= 7.9 }}" - openssh_has_fido2: "{{ openssh_version is defined and openssh_version >= 8.2 }}" - openssh_has_include: "{{ openssh_version is defined and openssh_version >= 8.2 }}" - openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version >= 8.5 }}" - openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version >= 9.3 }}" - openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version >= 9.8 }}" - openssh_has_mlkem: "{{ openssh_version is defined and openssh_version >= 9.9 }}" + openssh_has_disable_forwarding: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}" + openssh_has_ca_signature_algorithms: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}" + openssh_has_fido2: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}" + openssh_has_include: "{{ openssh_version is defined and openssh_version is version('8.2', '>=') }}" + openssh_has_log_verbose: "{{ openssh_version is defined and openssh_version is version('8.5', '>=') }}" + openssh_has_required_rsa_size: "{{ openssh_version is defined and openssh_version is version('9.3', '>=') }}" + openssh_has_persourcepenalties: "{{ openssh_version is defined and openssh_version is version('9.8', '>=') }}" + openssh_has_mlkem: "{{ openssh_version is defined and openssh_version is version('9.9', '>=') }}" # Algorithm support flags - openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version >= 7.2 }}" - openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version >= 7.4 }}" + openssh_has_rsa_sha2: "{{ openssh_version is defined and openssh_version is version('7.2', '>=') }}" + openssh_has_modern_kex: "{{ openssh_version is defined and openssh_version is version('7.4', '>=') }}" # Security restriction flags - openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version >= 7.9 }}" - openssh_removes_dsa: "{{ openssh_version is defined and openssh_version >= 9.6 }}" - openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version >= 10.0 }}" + openssh_blocks_dsa_ca: "{{ openssh_version is defined and openssh_version is version('7.9', '>=') }}" + openssh_removes_dsa: "{{ openssh_version is defined and openssh_version is version('9.6', '>=') }}" + openssh_dh_disabled_default: "{{ openssh_version is defined and openssh_version is version('10.0', '>=') }}" tags: - openssh - facts @@ -139,7 +139,7 @@ openssh_ca_signature_algorithms: "{{ openssh_ca_signature_algorithms | reject('match', '^sk-') | list }}" when: - openssh_version is defined - - openssh_version < 8.2 + - openssh_version is version('8.2', '<') tags: - openssh - facts diff --git a/roles/openssh/templates/sshd_config.j2 b/roles/openssh/templates/sshd_config.j2 index cbc8852..c750bd8 100644 --- a/roles/openssh/templates/sshd_config.j2 +++ b/roles/openssh/templates/sshd_config.j2 @@ -9,7 +9,7 @@ ListenAddress {{ address }} {% endfor %} # Protocol (deprecated directive in newer OpenSSH, kept for compatibility) -{% if openssh_version is defined and openssh_version < 7.4 %} +{% if openssh_version is defined and openssh_version is version('7.4', '<') %} Protocol {{ openssh_protocol }} {% endif %} @@ -153,6 +153,6 @@ GatewayPorts no {% if openssh_has_persourcepenalties | default(false) and openssh_enable_persourcepenalties %} # Automatic penalties for repeated failures and suspicious behavior PerSourcePenalties authfail:{{ openssh_persource_authfail_penalty }} noauth:{{ openssh_persource_noauth_penalty }} crash:{{ openssh_persource_crash_penalty }} -PerSourceMaxStartups {{ openssh_persource_maxstartups }} +PerSourceMaxStartups '{{ openssh_persource_maxstartups }}' PerSourceNetBlockSize {{ openssh_persource_netblock_ipv4 }}:{{ openssh_persource_netblock_ipv6 }} {% endif %}