a13labs.infra/ansible/roles/cis_hardening/tasks/sshconfig.yml

---
- name: Get installed ssh version
  ansible.builtin.command:
    cmd: ssh -V
  changed_when: false
  failed_when: false
  register: ssh_version
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config

- name: Set ssh version as fact
  ansible.builtin.set_fact:
    ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config

- name: Stat sysconfig sshd configuration
  ansible.builtin.stat:
    path: /etc/sysconfig/sshd
  register: sysconfig_sshd
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config
    - M1041

- name: Remove sshd system crypto policy
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: ^\s*CRYPTO_POLICY.*$
  when: sysconfig_sshd.stat.exists
  tags:
    - roles::cis::sshd
    - sshd
    - CCE-80939-2
    - M1041

- name: Get sshd Include config
  become: true
  ansible.builtin.command: grep -E "^Include " /etc/ssh/sshd_config
  register: grep_include
  changed_when: false
  failed_when: false
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config
    - M1041

- name: Check if sshd_config.d exits
  ansible.builtin.stat:
    path: /etc/ssh/sshd_config.d
  register: sshd_config_d
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config
    - M1041

- name: Ensure /etc/ssh/sshd_config permissions
  become: true
  ansible.builtin.file:
    path: /etc/ssh/sshd_config
    owner: root
    group: root
    mode: "0600"
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config

- name: Configure sshd
  become: true
  ansible.builtin.template:
    src: etc/ssh/sshd_config.j2
    dest: /etc/ssh/sshd_config
    backup: true
    mode: "0600"
    owner: root
    group: root
    validate: sshd -t -f %s
  when: not sshd_config_d.stat.exists or grep_include.rc != 0
  notify:
    - Restart sshd service
    - Restart ssh service
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config
    - CCE-80895-6
    - CCE-80896-4
    - CCE-80897-2
    - CCE-80898-0
    - CCE-80901-2
    - CCE-80902-0
    - CCE-80903-8
    - CCE-80904-6
    - CCE-80905-3
    - CCE-80906-1
    - CCE-82177-7
    - CCE-82281-7
    - CCE-83360-8
    - CIS-UBUNTU2004-5.3.1
    - CIS-UBUNTU2004-5.3.4
    - CIS-UBUNTU2004-5.3.5
    - CIS-UBUNTU2004-5.3.6
    - CIS-UBUNTU2004-5.3.7
    - CIS-UBUNTU2004-5.3.8
    - CIS-UBUNTU2004-5.3.9
    - CIS-UBUNTU2004-5.3.10
    - CIS-UBUNTU2004-5.3.11
    - CIS-UBUNTU2004-5.3.12
    - CIS-UBUNTU2004-5.3.13
    - CIS-UBUNTU2004-5.3.14
    - CIS-UBUNTU2004-5.3.15
    - CIS-UBUNTU2004-5.3.16
    - CIS-UBUNTU2004-5.3.17
    - CIS-UBUNTU2004-5.3.18
    - CIS-UBUNTU2004-5.3.19
    - CIS-UBUNTU2004-5.3.20
    - CIS-UBUNTU2004-5.3.21
    - CIS-UBUNTU2004-5.3.22
    - M1041
    - UBTU-20-010036
    - UBTU-20-010037

- name: Configure sshd using sshd_config.d
  become: true
  ansible.builtin.template:
    src: etc/ssh/sshd_config.j2
    dest: /etc/ssh/sshd_config.d/01-hardening.conf
    backup: true
    mode: "0600"
    owner: root
    group: root
    validate: sshd -t -f %s
  when: sshd_config_d.stat.exists and grep_include.rc == 0
  notify:
    - Restart sshd service
    - Restart ssh service
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config
    - CCE-80895-6
    - CCE-80896-4
    - CCE-80897-2
    - CCE-80898-0
    - CCE-80901-2
    - CCE-80902-0
    - CCE-80903-8
    - CCE-80904-6
    - CCE-80905-3
    - CCE-80906-1
    - CCE-82177-7
    - CCE-82281-7
    - CCE-83360-8
    - CIS-UBUNTU2004-5.3.1
    - CIS-UBUNTU2004-5.3.4
    - CIS-UBUNTU2004-5.3.5
    - CIS-UBUNTU2004-5.3.6
    - CIS-UBUNTU2004-5.3.7
    - CIS-UBUNTU2004-5.3.8
    - CIS-UBUNTU2004-5.3.9
    - CIS-UBUNTU2004-5.3.10
    - CIS-UBUNTU2004-5.3.11
    - CIS-UBUNTU2004-5.3.12
    - CIS-UBUNTU2004-5.3.13
    - CIS-UBUNTU2004-5.3.14
    - CIS-UBUNTU2004-5.3.15
    - CIS-UBUNTU2004-5.3.16
    - CIS-UBUNTU2004-5.3.17
    - CIS-UBUNTU2004-5.3.18
    - CIS-UBUNTU2004-5.3.19
    - CIS-UBUNTU2004-5.3.20
    - CIS-UBUNTU2004-5.3.21
    - CIS-UBUNTU2004-5.3.22
    - M1041
    - UBTU-20-010036
    - UBTU-20-010037

- name: Remove possible Subsystem duplicate
  become: true
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: ^Subsystem.*
    state: absent
  when: sshd_config_d.stat.exists and grep_include.rc == 0
  tags:
    - roles::cis::sshd
    - sshd
    - sshd_config

- name: Stat sshd host keys
  become: true
  ansible.builtin.find:
    paths: /etc/ssh
    file_type: file
    patterns: "ssh_host_*"
    excludes: "*.pub"
  register: ssh_host_keys
  tags:
    - roles::cis::sshd
    - sshd
    - M1022
    - M1041

- name: Set sshd host key permissions
  become: true
  ansible.builtin.file:
    owner: root
    group: root
    mode: "0600"
    path: "{{ item.path }}"
  with_items: "{{ ssh_host_keys.files }}"
  loop_control:
    label: "{{ item.path }}"
  tags:
    - roles::cis::sshd
    - sshd
    - CCE-82424-3
    - CIS-UBUNTU2004-5.3.2
    - M1022
    - M1041

- name: Check if ssh_config.d exits
  ansible.builtin.stat:
    path: /etc/ssh/ssh_config.d
  register: ssh_config_d
  tags:
    - roles::cis::ssh
    - ssh
    - ssh_config
    - M1041

- name: Configure ssh client
  become: true
  ansible.builtin.template:
    src: etc/ssh/ssh_config.j2
    dest: /etc/ssh/ssh_config
    backup: true
    mode: "0644"
    owner: root
    group: root
  tags:
    - roles::cis::ssh
    - ssh
    - ssh_config
    - CCE-82880-6
    - M1041