alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor SSH configuration in ansible-apply.yaml and update playbook execution with ECDSA private key

Browse Source
This commit is contained in:
Alexandre Pires
2024-09-24 18:56:17 +02:00
parent caf983b39c
commit 50250c57d2
4 changed files with 23 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/playbook_hardening.yml
-2
View File
@@ -19,8 +19,6 @@
tags:
- roles
- roles::cis
- roles::cis::ufw
- roles::cis::sysctl
- role: "fail2ban"
tags:
- roles
ansible/roles/cis_hardening/defaults/main/sshd.yml
+1 -1
View File
@@ -15,7 +15,7 @@ sshd_client_alive_interval: 200
sshd_compression: "no"
sshd_gssapi_authentication: "no"
sshd_hostbased_authentication: "no"
sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
sshd_host_key_algorithms: ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com
sshd_ignore_user_known_hosts: "yes"
sshd_kerberos_authentication: "no"
sshd_kex_algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
ansible/roles/cis_hardening/tasks/main.yml
+8
View File
@@ -20,9 +20,13 @@
when: ufw_enable
tags:
- ufw
- roles::cis::ufw
- name: Configure sysctl
ansible.builtin.include_tasks: sysctl.yml
tags:
- sysctl
- roles::cis::sysctl
- name: Disable kernel network modules
ansible.builtin.include_tasks: disablenet.yml
@@ -76,6 +80,10 @@
- name: Configure ssh server and client
ansible.builtin.include_tasks: sshconfig.yml
tags:
- ssh
- sshd
- roles::cis::sshd
- name: Configure PAM
ansible.builtin.include_tasks: password.yml
ansible/roles/cis_hardening/tasks/sshconfig.yml
+14
View File
@@ -6,6 +6,7 @@
failed_when: false
register: ssh_version
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -13,6 +14,7 @@
ansible.builtin.set_fact:
ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -21,6 +23,7 @@
path: /etc/sysconfig/sshd
register: sysconfig_sshd
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -33,6 +36,7 @@
regexp: ^\s*CRYPTO_POLICY.*$
when: sysconfig_sshd.stat.exists
tags:
- roles::cis::sshd
- sshd
- CCE-80939-2
- M1041
@@ -44,6 +48,7 @@
changed_when: false
failed_when: false
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -53,6 +58,7 @@
path: /etc/ssh/sshd_config.d
register: sshd_config_d
tags:
- roles::cis::sshd
- sshd
- sshd_config
- M1041
@@ -65,6 +71,7 @@
group: root
mode: "0600"
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -83,6 +90,7 @@
- Restart sshd service
- Restart ssh service
tags:
- roles::cis::sshd
- sshd
- sshd_config
- CCE-80895-6
@@ -137,6 +145,7 @@
- Restart sshd service
- Restart ssh service
tags:
- roles::cis::sshd
- sshd
- sshd_config
- CCE-80895-6
@@ -184,6 +193,7 @@
state: absent
when: sshd_config_d.stat.exists and grep_include.rc == 0
tags:
- roles::cis::sshd
- sshd
- sshd_config
@@ -196,6 +206,7 @@
excludes: "*.pub"
register: ssh_host_keys
tags:
- roles::cis::sshd
- sshd
- M1022
- M1041
@@ -211,6 +222,7 @@
loop_control:
label: "{{ item.path }}"
tags:
- roles::cis::sshd
- sshd
- CCE-82424-3
- CIS-UBUNTU2004-5.3.2
@@ -222,6 +234,7 @@
path: /etc/ssh/ssh_config.d
register: ssh_config_d
tags:
- roles::cis::ssh
- ssh
- ssh_config
- M1041
@@ -236,6 +249,7 @@
owner: root
group: root
tags:
- roles::cis::ssh
- ssh
- ssh_config
- CCE-82880-6