68 lines
2 KiB
YAML
68 lines
2 KiB
YAML
---
|
|
- name: Verify
|
|
hosts: all
|
|
become: true
|
|
tasks:
|
|
- name: Check SSH service status
|
|
ansible.builtin.systemd:
|
|
name: ssh
|
|
register: ssh_service
|
|
failed_when: false
|
|
|
|
- name: Display SSH service status
|
|
ansible.builtin.debug:
|
|
msg: "SSH service state: {{ ssh_service.status.ActiveState | default('unknown') }}"
|
|
|
|
- name: Validate SSH configuration syntax
|
|
ansible.builtin.command: sshd -t
|
|
changed_when: false
|
|
register: sshd_test
|
|
|
|
- name: Verify SSH config is valid
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sshd_test.rc == 0
|
|
fail_msg: "SSH configuration has errors"
|
|
success_msg: "SSH configuration is valid"
|
|
|
|
- name: Get OpenSSH version
|
|
ansible.builtin.command: ssh -V
|
|
changed_when: false
|
|
register: ssh_version_output
|
|
failed_when: false
|
|
|
|
- name: Display OpenSSH version
|
|
ansible.builtin.debug:
|
|
msg: "OpenSSH version: {{ ssh_version_output.stderr | default('unknown') }}"
|
|
|
|
- name: Check sshd_config exists
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/sshd_config
|
|
register: sshd_config_file
|
|
|
|
- name: Verify sshd_config was created
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sshd_config_file.stat.exists
|
|
fail_msg: "SSH configuration file not found"
|
|
success_msg: "SSH configuration file exists"
|
|
|
|
- name: Check sshd_config for hardening
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
grep -E '^(PasswordAuthentication|PermitRootLogin|PubkeyAuthentication)' /etc/ssh/sshd_config || true
|
|
changed_when: false
|
|
register: ssh_hardening
|
|
|
|
- name: Display hardening configuration
|
|
ansible.builtin.debug:
|
|
msg: "{{ ssh_hardening.stdout_lines }}"
|
|
|
|
- name: Verify key hardening settings
|
|
ansible.builtin.assert:
|
|
that:
|
|
- "'PasswordAuthentication' in ssh_hardening.stdout"
|
|
- "'PermitRootLogin' in ssh_hardening.stdout"
|
|
fail_msg: "Expected hardening settings not found"
|
|
success_msg: "Hardening settings are configured"
|