49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
---
|
|
- name: "Ensure openssh-server is installed"
|
|
ansible.builtin.package:
|
|
name: "openssh-server"
|
|
state: "present"
|
|
|
|
- name: "Deploy hardened sshd_config"
|
|
ansible.builtin.template:
|
|
src: "sshd_config.j2"
|
|
dest: "/etc/ssh/sshd_config"
|
|
mode: "0600"
|
|
owner: "root"
|
|
group: "root"
|
|
backup: true
|
|
validate: "/usr/sbin/sshd -T -f %s"
|
|
register: "sshd_config_result"
|
|
notify: "Restart sshd"
|
|
|
|
- name: "Deploy CyberAar-branded SSH pre-login banner (/etc/issue.net)"
|
|
ansible.builtin.template:
|
|
src: "issue.net.j2"
|
|
dest: "/etc/issue.net"
|
|
mode: "0644"
|
|
owner: "root"
|
|
group: "root"
|
|
backup: true
|
|
when: "linux_ssh_banner != ''"
|
|
register: "banner_result"
|
|
changed_when: "banner_result.changed"
|
|
|
|
- name: "Enable and start sshd service"
|
|
ansible.builtin.service:
|
|
name: "sshd"
|
|
state: "started"
|
|
enabled: true
|
|
|
|
- name: "Verify SSH configuration is valid"
|
|
ansible.builtin.command: "sshd -t"
|
|
changed_when: false
|
|
register: "sshd_test"
|
|
failed_when: "sshd_test.rc != 0"
|
|
|
|
- name: "Debug SSH hardening status (verbosity >=1)"
|
|
ansible.builtin.debug:
|
|
msg:
|
|
- "sshd_config updated: {{ sshd_config_result.changed | default(false) }}"
|
|
- "SSHD test: {{ sshd_test.rc | default('unknown') }}"
|
|
# when: "ansible_verbosity >= 1"
|