diff options
| author | Egor Tensin <egor@tensin.name> | 2025-11-16 00:14:15 +0100 |
|---|---|---|
| committer | Egor Tensin <egor@tensin.name> | 2025-11-16 01:48:53 +0100 |
| commit | f9315c9d0f8cb2c20428fcd267e546b1e0ce2d4a (patch) | |
| tree | 7fdf1bce914cfcbc7a79c446c35737190f4ec48f | |
| parent | docker: don't query unused facts (diff) | |
| download | infra-ansible-f9315c9d0f8cb2c20428fcd267e546b1e0ce2d4a.tar.gz infra-ansible-f9315c9d0f8cb2c20428fcd267e546b1e0ce2d4a.zip | |
sshd: adjust sshd_config
| -rw-r--r-- | roles/sshd/tasks/main.yml | 18 | ||||
| -rw-r--r-- | roles/sshd/templates/sshd_config.j2 | 5 | ||||
| -rw-r--r-- | roles/sshd/vars/Archlinux.yml | 1 | ||||
| -rw-r--r-- | roles/sshd/vars/Debian.yml | 1 | ||||
| l--------- | roles/sshd/vars/Ubuntu.yml | 1 |
5 files changed, 25 insertions, 1 deletions
diff --git a/roles/sshd/tasks/main.yml b/roles/sshd/tasks/main.yml index cae0d86..78c461d 100644 --- a/roles/sshd/tasks/main.yml +++ b/roles/sshd/tasks/main.yml @@ -1,3 +1,21 @@ +- name: Get host distro + ansible.builtin.setup: + gather_subset: + - distribution + - distribution_major_version + - distribution_release + - os_family + +- name: Set platform-specific variables + ansible.builtin.include_vars: "{{ __sshd_vars_file }}" + loop: + - "{{ ansible_facts['os_family'] }}.yml" + - "{{ ansible_facts['distribution'] }}.yml" + - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['distribution_major_version'] }}.yml" + vars: + __sshd_vars_file: "{{ role_path }}/vars/{{ item }}" + when: __sshd_vars_file is exists + - name: Configure sshd become: true ansible.builtin.template: diff --git a/roles/sshd/templates/sshd_config.j2 b/roles/sshd/templates/sshd_config.j2 index 1ea1c12..6303d83 100644 --- a/roles/sshd/templates/sshd_config.j2 +++ b/roles/sshd/templates/sshd_config.j2 @@ -19,6 +19,9 @@ PasswordAuthentication no ChallengeResponseAuthentication no AuthenticationMethods publickey +# Print user's key fingerprint on login: +LogLevel VERBOSE + # Whitelist accepted environment variables: AcceptEnv LANG LC_* @@ -28,4 +31,4 @@ ClientAliveInterval 15 # Miscellaneous: PrintMotd no -Subsystem sftp /usr/lib/openssh/sftp-server +Subsystem sftp {{ __sshd_sftp_path }} -f AUTHPRIV -l INFO diff --git a/roles/sshd/vars/Archlinux.yml b/roles/sshd/vars/Archlinux.yml new file mode 100644 index 0000000..b1d73c4 --- /dev/null +++ b/roles/sshd/vars/Archlinux.yml @@ -0,0 +1 @@ +__sshd_sftp_path: /usr/lib/ssh/sftp-server diff --git a/roles/sshd/vars/Debian.yml b/roles/sshd/vars/Debian.yml new file mode 100644 index 0000000..9d00bf7 --- /dev/null +++ b/roles/sshd/vars/Debian.yml @@ -0,0 +1 @@ +__sshd_sftp_path: /usr/lib/openssh/sftp-server diff --git a/roles/sshd/vars/Ubuntu.yml b/roles/sshd/vars/Ubuntu.yml new file mode 120000 index 0000000..4e197bc --- /dev/null +++ b/roles/sshd/vars/Ubuntu.yml @@ -0,0 +1 @@ +Debian.yml
\ No newline at end of file |