Merge pull request #16 from punktDe/ssh-hardening

Add default ssh settings, ignore key errors in check mode

.github/workflows/test.yml

@@ -29,6 +29,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Create an openssh privilege separation directory
+        run: |
+          sudo mkdir -p /run/sshd
+          sudo chmod 0755 /run/sshd
+
       - name: Set up Python
         uses: actions/setup-python@v2
         with:

defaults/main.yaml

@@ -5,8 +5,12 @@ system:
     {%- else -%}
       wheel
     {%- endif -%}
+  sshd:
+    config:
+      PasswordAuthentication: no
+      PermitRootLogin: no
   features:
-    sshd: no
+    sshd: yes
     proserver_fact: no
     hostname: yes
     timezone: yes
@@ -23,7 +27,7 @@ system:
     sudoers: yes
     authorized_keys: yes
     authorized_keys_delete: no
-    motd: no
+    motd: yes
   prefix:
     sudoers: >-
       {%- if ansible_system == 'Linux' -%}

handlers/main.yaml

@@ -1,4 +1,11 @@
+---
 - name: Restart Postfix
   ansible.builtin.service:
     name: postfix
     state: restarted
+
+- name: Restart sshd
+  when: (lookup('env', 'GITHUB_ACTIONS') | length) == 0
+  ansible.builtin.service:
+    name: sshd
+    state: restarted

molecule/default/converge.yml

@@ -1,6 +1,8 @@
 ---
 - name: Converge
   hosts: all
+  environment:
+    GITHUB_ACTIONS: "maybe"
   tasks:
     - name: "Include ansible-proserver-system"
       ansible.builtin.include_role:

tasks/authorized_keys.yaml

@@ -23,6 +23,8 @@
 
 - name: Add authorized keys
   loop: "{{ user_authorized_keys }}"
+  failed_when: "{{ add_authorized_keys.failed and not ansible_check_mode }}"
+  register: add_authorized_keys
   loop_control:
     label: '{{ item.user }} public_keys="{{ item.key }}"'
   ansible.posix.authorized_key:

tasks/sshd.yaml

@@ -1,8 +1,14 @@
+---
+- name: Make sure that sshd is installed (Debian-based)
+  when: ansible_os_family == "Debian"
+  ansible.builtin.package:
+    name: openssh-server
+
 - name: Make sure that the custom sshd configuration is included
   notify:
     - Restart sshd
   ansible.builtin.lineinfile:
-    validate: "sshd -T -f %s"
+    validate: "{{ 'sshd -T -f %s' if (lookup('env', 'GITHUB_ACTIONS') | length) == 0 else omit }}"
     path: /etc/ssh/sshd_config
     line: "Include /etc/ssh/sshd_config.d/*"
     insertbefore: "BOF"
@@ -18,11 +24,15 @@
   notify:
     - Restart sshd
   ansible.builtin.copy:
-    validate: "sshd -T -f %s"
+    validate: "{{ 'sshd -T -f %s' if (lookup('env', 'GITHUB_ACTIONS') | length) == 0 else omit }}"
     dest: /etc/ssh/sshd_config.d/00-ansible.conf
     content: |
-      {% for option, value in system.sshd.config.iteritems() %}
-        {{ option }} {{ value }}
+      {% for key, value in system.sshd.config.items() %}
+      {% if value is boolean %}
+      {{ key }} {{ value | ternary('yes', 'no') }}
+      {% else %}
+      {{ key }} {{ value }}
+      {% endif %}
       {% endfor %}
     owner: root
     mode: "0644"