alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor SSH configuration in ansible-apply.yaml and update playbook execution with ECDSA private key

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-24 18:56:17 +02:00
parent caf983b39c
commit 50250c57d2
4 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/playbook_hardening.yml
-2
View File
@@ -19,8 +19,6 @@
tags: tags:
- roles - roles
- roles::cis - roles::cis
- roles::cis::ufw
- roles::cis::sysctl
- role: "fail2ban" - role: "fail2ban"
tags: tags:
- roles - roles
ansible/roles/cis_hardening/defaults/main/sshd.yml
+1 -1
View File
@@ -15,7 +15,7 @@ sshd_client_alive_interval: 200
sshd_compression: "no" sshd_compression: "no"
sshd_gssapi_authentication: "no" sshd_gssapi_authentication: "no"
sshd_hostbased_authentication: "no" sshd_hostbased_authentication: "no"
sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
sshd_ignore_user_known_hosts: "yes" sshd_ignore_user_known_hosts: "yes"
sshd_kerberos_authentication: "no" sshd_kerberos_authentication: "no"
sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
ansible/roles/cis_hardening/tasks/main.yml
+8
View File
@@ -20,9 +20,13 @@
when: ufw_enable when: ufw_enable
tags: tags:
- ufw - ufw
- roles::cis::ufw
- name: Configure sysctl - name: Configure sysctl
ansible.builtin.include_tasks: sysctl.yml ansible.builtin.include_tasks: sysctl.yml
tags:
- sysctl
- roles::cis::sysctl
- name: Disable kernel network modules - name: Disable kernel network modules
ansible.builtin.include_tasks: disablenet.yml ansible.builtin.include_tasks: disablenet.yml
@@ -76,6 +80,10 @@
- name: Configure ssh server and client - name: Configure ssh server and client
ansible.builtin.include_tasks: sshconfig.yml ansible.builtin.include_tasks: sshconfig.yml
tags:
- ssh
- sshd
- roles::cis::sshd
- name: Configure PAM - name: Configure PAM
ansible.builtin.include_tasks: password.yml ansible.builtin.include_tasks: password.yml
ansible/roles/cis_hardening/tasks/sshconfig.yml
+14
View File
@@ -6,6 +6,7 @@
failed_when: false failed_when: false
register: ssh_version register: ssh_version
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
@@ -13,6 +14,7 @@
ansible.builtin.set_fact: ansible.builtin.set_fact:
ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing] ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
@@ -21,6 +23,7 @@
path: /etc/sysconfig/sshd path: /etc/sysconfig/sshd
register: sysconfig_sshd register: sysconfig_sshd
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
- M1041 - M1041
@@ -33,6 +36,7 @@
regexp: ^\s*CRYPTO_POLICY.*$ regexp: ^\s*CRYPTO_POLICY.*$
when: sysconfig_sshd.stat.exists when: sysconfig_sshd.stat.exists
tags: tags:
- roles::cis::sshd
- sshd - sshd
- CCE-80939-2 - CCE-80939-2
- M1041 - M1041
@@ -44,6 +48,7 @@
changed_when: false changed_when: false
failed_when: false failed_when: false
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
- M1041 - M1041
@@ -53,6 +58,7 @@
path: /etc/ssh/sshd_config.d path: /etc/ssh/sshd_config.d
register: sshd_config_d register: sshd_config_d
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
- M1041 - M1041
@@ -65,6 +71,7 @@
group: root group: root
mode: "0600" mode: "0600"
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
@@ -83,6 +90,7 @@
- Restart sshd service - Restart sshd service
- Restart ssh service - Restart ssh service
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
- CCE-80895-6 - CCE-80895-6
@@ -137,6 +145,7 @@
- Restart sshd service - Restart sshd service
- Restart ssh service - Restart ssh service
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
- CCE-80895-6 - CCE-80895-6
@@ -184,6 +193,7 @@
state: absent state: absent
when: sshd_config_d.stat.exists and grep_include.rc == 0 when: sshd_config_d.stat.exists and grep_include.rc == 0
tags: tags:
- roles::cis::sshd
- sshd - sshd
- sshd_config - sshd_config
@@ -196,6 +206,7 @@
excludes: "*.pub" excludes: "*.pub"
register: ssh_host_keys register: ssh_host_keys
tags: tags:
- roles::cis::sshd
- sshd - sshd
- M1022 - M1022
- M1041 - M1041
@@ -211,6 +222,7 @@
loop_control: loop_control:
label: "{{ item.path }}" label: "{{ item.path }}"
tags: tags:
- roles::cis::sshd
- sshd - sshd
- CCE-82424-3 - CCE-82424-3
- CIS-UBUNTU2004-5.3.2 - CIS-UBUNTU2004-5.3.2
@@ -222,6 +234,7 @@
path: /etc/ssh/ssh_config.d path: /etc/ssh/ssh_config.d
register: ssh_config_d register: ssh_config_d
tags: tags:
- roles::cis::ssh
- ssh - ssh
- ssh_config - ssh_config
- M1041 - M1041
@@ -236,6 +249,7 @@
owner: root owner: root
group: root group: root
tags: tags:
- roles::cis::ssh
- ssh - ssh
- ssh_config - ssh_config
- CCE-82880-6 - CCE-82880-6