Add hpz440 host configuration and SSH setup for Windows; update Prometheus targets and variables

ansible/host_vars/game-01.lab.alexpires.me.yml

@@ -10,6 +10,16 @@ game_password: "{{ lookup('env', 'WIN_GAME_PASSWORD') }}"
 game_default_groups:
   - Administradores # This is mandatory to install games
 
+ssh_users:
+  - name: "{{ ansible_user }}"
+    admin: true
+    keys:
+      - "{{ lookup('file', 'keys/ansible_user.pub') }}"
+  - name: calex
+    admin: true
+    keys:
+      - "{{ lookup('file', 'keys/operator.pub') }}"
+
 grafana_prometheus_sources:
   - 10.19.4.136
 windows_exporter_collectors:

ansible/host_vars/hpz440.lab.alexpires.me.yml

@@ -0,0 +1,35 @@
+hostname: hpz440.lab.alexpires.me
+ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
+ansible_password: "{{ lookup('env', 'WIN_HPZ440_PASSWORD') }}"
+ansible_connection: winrm
+ansible_winrm_transport: basic
+ansible_winrm_server_cert_validation: ignore
+
+ssh_users:
+  - name: "{{ ansible_user }}"
+    admin: true
+    keys:
+      - "{{ lookup('file', 'keys/ansible_user.pub') }}"
+  - name: HP
+    admin: true
+    keys:
+      - "{{ lookup('file', 'keys/operator.pub') }}"
+
+grafana_prometheus_sources:
+  - 10.19.4.136
+
+windows_exporter_collectors:
+  - cache
+  - cpu
+  - cpu_info
+  - gpu
+  - diskdrive
+  - logical_disk
+  - memory
+  - net
+  - os
+  - process
+  - service
+  - tcp
+  - time
+  - update

ansible/host_vars/prod-01.alexpires.me.yml

@@ -89,7 +89,7 @@ fail2ban_jails:
     logpath: "/var/log/auth.log"
     maxretry: 5
     findtime: 600
-    bantime: 3600
+    bantime: -1
   postfix:
     enabled: true
     port: "smtp,ssmtp"

ansible/playbook_windows_ssh.yml

@@ -0,0 +1,7 @@
+- name: Setup ssh on Windows
+  hosts: windows
+
+  tasks:
+    - name: Setup ssh
+      ansible.builtin.include_tasks:
+        file: tasks/windows_ssh.yml

ansible/sectool.env

@@ -15,3 +15,4 @@ CLOUDNS_AUTH_ID=$CLOUDNS_AUTH_ID
 CLOUDNS_PASSWORD=$CLOUDNS_PASSWORD
 WIN_PROVISION_PASSWORD=$WIN_PROVISION_PASSWORD
 WIN_GAME_PASSWORD=$WIN_GAME_PASSWORD
+WIN_HPZ440_PASSWORD=$WIN_HPZ440_PASSWORD

ansible/tasks/windows_ssh.yml

@@ -0,0 +1,213 @@
+# Expects variable `ssh_users` as list of objects:
+# ssh_users:
+#   - name: alice
+#     keys:
+#       - "ssh-ed25519 AAAA..."
+#       - "ssh-rsa AAAA..."
+#   - name: bob
+#     keys:
+#       - "ssh-rsa AAAA..."
+- name: Ensure OpenSSH Server capability is installed (if available)
+  ansible.windows.win_shell: |
+    $cap = Get-WindowsCapability -Online | Where-Object { $_.Name -like 'OpenSSH.Server*' }
+    if ($cap -and $cap.State -ne 'Installed') {
+      Add-WindowsCapability -Online -Name $cap.Name
+      Write-Output 'installed'
+    } else {
+      Write-Output 'present'
+    }
+  args:
+    executable: powershell.exe
+  register: openssh_install
+  changed_when: "'installed' in openssh_install.stdout"
+
+- name: Ensure host keys exist (ssh-keygen -A)
+  ansible.windows.win_shell: |
+    $exe = 'C:\Windows\System32\OpenSSH\ssh-keygen.exe'
+    if (Test-Path $exe) {
+      & $exe -A 2>&1
+      Write-Output 'hostkeys-generated'
+    } else {
+      Write-Output 'ssh-keygen-not-found'
+      exit 2
+    }
+  register: ssh_keygen
+  changed_when: "'hostkeys-generated' in ssh_keygen.stdout"
+
+- name: Restrict private host key file permissions (icacls) and remove provision user access
+  ansible.windows.win_shell: |
+    $current = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+    $keys = Get-ChildItem -Path 'C:\ProgramData\ssh' -Filter 'ssh_host_*_key' -File -ErrorAction SilentlyContinue
+    if ($keys -and $keys.Count -gt 0) {
+      foreach ($k in $keys) {
+        icacls.exe $k.FullName /inheritance:r
+        icacls.exe $k.FullName /grant:r "S-1-5-18:(F)"
+        icacls.exe $k.FullName /remove $current 2>$null
+      }
+      Write-Output "restricted: removed access for $current"
+    } else {
+      Write-Output 'no-keys'
+    }
+  args:
+    executable: powershell.exe
+  register: restrict_hostkey_perms
+  changed_when: "'restricted' in restrict_hostkey_perms.stdout"
+
+- name: Ensure sshd service is enabled and running
+  ansible.windows.win_service:
+    name: sshd
+    start_mode: auto
+    state: started
+
+- name: Ensure firewall allows SSH (TCP/22)
+  community.windows.win_firewall_rule:
+    name: "OpenSSH Server (sshd)"
+    enable: true
+    direction: in
+    action: allow
+    localport: 22
+    protocol: TCP
+    profile: "Domain,Private"
+
+- name: Ensure PubkeyAuthentication is enabled in sshd_config
+  community.windows.win_lineinfile:
+    path: 'C:\ProgramData\ssh\sshd_config'
+    regexp: "^#?PubkeyAuthentication"
+    line: "PubkeyAuthentication yes"
+    create: true
+    backup: true
+  register: sshd_pubkey_changed
+
+- name: Ensure AuthorizedKeysFile is set to .ssh/authorized_keys
+  community.windows.win_lineinfile:
+    path: 'C:\ProgramData\ssh\sshd_config'
+    regexp: "^#?AuthorizedKeysFile"
+    line: "AuthorizedKeysFile .ssh/authorized_keys"
+    create: true
+    backup: true
+  register: sshd_authkeys_changed
+
+- name: Detect available PowerShell for ssh subsystem
+  ansible.windows.win_shell: |
+    if (Test-Path 'C:\Program Files\PowerShell\7\pwsh.exe') { Write-Output 'C:\Program Files\PowerShell\7\pwsh.exe' }
+    elseif (Test-Path 'C:\Program Files\PowerShell\6\pwsh.exe') { Write-Output 'C:\Program Files\PowerShell\6\pwsh.exe' }
+    elseif (Test-Path 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe') { Write-Output 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' }
+    else { Write-Output '' }
+  register: ssh_subsystem_path
+  changed_when: false
+
+- name: Configure sshd Subsystem to allow PowerShell sessions
+  community.windows.win_lineinfile:
+    path: 'C:\ProgramData\ssh\sshd_config'
+    regexp: '^Subsystem\s+powershell'
+    line: 'Subsystem powershell "{{ ssh_subsystem_path.stdout | trim }}" -sshs -NoLogo -NoProfile'
+    create: true
+    backup: true
+  register: sshd_subsystem_changed
+  when: ssh_subsystem_path.stdout != ''
+
+- name: Restart sshd if config changed
+  ansible.windows.win_service:
+    name: sshd
+    state: restarted
+  when: sshd_pubkey_changed.changed or sshd_authkeys_changed.changed or sshd_subsystem_changed.changed
+
+- name: Ensure users for SSH keys exist (no-op if already present)
+  ansible.windows.win_user:
+    name: "{{ item.name }}"
+    state: present
+  loop: "{{ ssh_users | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Ensure user .ssh directory exists
+  ansible.windows.win_file:
+    path: "C:\\Users\\{{ item.name }}\\.ssh"
+    state: directory
+  loop: "{{ ssh_users | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Deploy authorized_keys for each user
+  ansible.windows.win_copy:
+    dest: "C:\\Users\\{{ item.name }}\\.ssh\\authorized_keys"
+    content: "{{ (item['keys'] | default([])) | join('\r\n') }}\r\n"
+    force: true
+  loop: "{{ ssh_users | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Set ACL on .ssh directory to allow only the user and Administradores (directory)
+  ansible.windows.win_acl:
+    path: "C:\\Users\\{{ item.name }}\\.ssh"
+    user: "{{ item.name }}"
+    rights: FullControl
+    type: allow
+    inheritance: false
+    propagate: false
+    state: present
+  loop: "{{ ssh_users | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Set ACL on authorized_keys file to allow only the user and Administradores (file)
+  ansible.windows.win_acl:
+    path: "C:\\Users\\{{ item.name }}\\.ssh\\authorized_keys"
+    user: "{{ item.name }}"
+    rights: FullControl
+    type: allow
+    inheritance: false
+    propagate: false
+    state: present
+  loop: "{{ ssh_users | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Create administrators_authorized_keys from admin users' keys (if any)
+  ansible.windows.win_copy:
+    dest: 'C:\ProgramData\ssh\administrators_authorized_keys'
+    content: "{{ (ssh_users | default([]) | selectattr('admin','equalto',true) | map(attribute='keys') | list | flatten | default([])) | join('\r\n') }}\r\n"
+    force: true
+  when: (ssh_users | default([]) | selectattr('admin','equalto',true) | list) | length > 0
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Tighten ACLs for administrators_authorized_keys (icacls)
+  ansible.windows.win_shell: |
+    $f = 'C:\ProgramData\ssh\administrators_authorized_keys'
+    $current = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+    if (Test-Path $f) {
+      icacls.exe $f /inheritance:r
+      icacls.exe $f /grant:r "S-1-5-18:(F)" "S-1-5-32-544:(F)"
+      icacls.exe $f /remove $current 2>$null
+      Write-Output 'restricted'
+    } else {
+      Write-Output 'no-file'
+    }
+  args:
+    executable: powershell.exe
+  register: restrict_admin_auth_perms
+  changed_when: "'restricted' in restrict_admin_auth_perms.stdout"
+  become: true
+  become_method: runas
+  become_user: "NT AUTHORITY\\SYSTEM"
+
+- name: Debug administrators_authorized_keys ACL change
+  ansible.builtin.debug:
+    var: restrict_admin_auth_perms.stdout