From 0172750ca1c3eeaa7013879281ade1a7c2c1cb84 Mon Sep 17 00:00:00 2001 From: Timo Makinen Date: Wed, 17 Mar 2021 05:15:05 +0000 Subject: [PATCH] sshd: Move ssh deamon configuration to own role --- roles/base/tasks/main.yml | 45 +-------------------------- roles/sshd/handlers/main.yml | 5 +++ roles/sshd/tasks/main.yml | 60 ++++++++++++++++++++++++++++++++++++ 3 files changed, 66 insertions(+), 44 deletions(-) create mode 100644 roles/sshd/handlers/main.yml create mode 100644 roles/sshd/tasks/main.yml diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index 70d1b17..0031645 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -25,50 +25,6 @@ owner: root group: "{{ ansible_wheel }}" -# use mozilla recommended settings (only prefer aes256 over chacha20) -# https://infosec.mozilla.org/guidelines/openssh.html -- name: tighten sshd kex algorithms - lineinfile: - path: /etc/ssh/sshd_config - line: "KexAlgorithms curve25519-sha256@libssh.org,\ - diffie-hellman-group-exchange-sha256" - regexp: "^KexAlgorithms .*" - notify: restart sshd -- name: tighten sshd ciphers - lineinfile: - path: /etc/ssh/sshd_config - line: "Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,\ - aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr" - regexp: "^Ciphers .*" - notify: restart sshd -- name: tighten sshd macs - lineinfile: - path: /etc/ssh/sshd_config - line: "MACs hmac-sha2-512-etm@openssh.com,\ - hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,\ - hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com" - regexp: "^MACs .*" - notify: restart sshd - -- name: disable ecdsa key from sshd - lineinfile: - path: /etc/ssh/sshd_config - line: "#HostKey /etc/ssh/ssh_host_ecdsa_key" - regexp: "^#?HostKey /etc/ssh/ssh_host_ecdsa_key" - notify: restart sshd -- name: disable rsa key from sshd - lineinfile: - path: /etc/ssh/sshd_config - line: "#HostKey /etc/ssh/ssh_host_rsa_key" - regexp: "^#?HostKey /etc/ssh/ssh_host_rsa_key" - notify: restart sshd -- name: enable ed25519 key from sshd - lineinfile: - path: /etc/ssh/sshd_config - line: "HostKey /etc/ssh/ssh_host_ed25519_key" - regexp: "^#?HostKey /etc/ssh/ssh_host_ed25519_key" - notify: restart sshd - - name: install basic roles include_role: name: "{{ role }}" @@ -76,5 +32,6 @@ - network - pki - psacct + - sshd loop_control: loop_var: role diff --git a/roles/sshd/handlers/main.yml b/roles/sshd/handlers/main.yml new file mode 100644 index 0000000..6207454 --- /dev/null +++ b/roles/sshd/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart sshd + service: + name: sshd + state: restarted diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml new file mode 100644 index 0000000..521a831 --- /dev/null +++ b/roles/sshd/tasks/main.yml @@ -0,0 +1,60 @@ +--- + +# based on mozilla recommended settings +# https://infosec.mozilla.org/guidelines/openssh.html +# +# * prefer aes over chacha for hardware acceleration +# * use only ed25519 host key +# + +- name: tighten ssh kex algorithm + lineinfile: + path: /etc/ssh/sshd_config + line: "KexAlgorithms curve25519-sha256@libssh.org,\ + diffie-hellman-group-exchange-sha256" + regexp: "^KexAlgorithms .*" + validate: "sshd -t -f %s" + notify: restart sshd + +- name: tighten sshd ciphers + lineinfile: + path: /etc/ssh/sshd_config + line: "Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,\ + aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr" + regexp: "^Ciphers .*" + validate: "sshd -t -f %s" + notify: restart sshd + +- name: tighten sshd macs + lineinfile: + path: /etc/ssh/sshd_config + line: "MACs hmac-sha2-512-etm@openssh.com,\ + hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,\ + hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com" + regexp: "^MACs .*" + validate: "sshd -t -f %s" + notify: restart sshd + +- name: disable ecdsa key from sshd + lineinfile: + path: /etc/ssh/sshd_config + line: "#HostKey /etc/ssh/ssh_host_ecdsa_key" + regexp: "^#?HostKey /etc/ssh/ssh_host_ecdsa_key" + validate: "sshd -t -f %s" + notify: restart sshd + +- name: disable rsa key from sshd + lineinfile: + path: /etc/ssh/sshd_config + line: "#HostKey /etc/ssh/ssh_host_rsa_key" + regexp: "^#?HostKey /etc/ssh/ssh_host_rsa_key" + validate: "sshd -t -f %s" + notify: restart sshd + +- name: enable ed25519 key from sshd + lineinfile: + path: /etc/ssh/sshd_config + line: "HostKey /etc/ssh/ssh_host_ed25519_key" + regexp: "^#?HostKey /etc/ssh/ssh_host_ed25519_key" + validate: "sshd -t -f %s" + notify: restart sshd