Initial ansible onboard

2024-09-24 15:19:51 +02:00
parent 7366659355
commit f445996797
492 changed files with 2214589 additions and 0 deletions
@@ -0,0 +1,242 @@
+---
+- name: Get installed ssh version
+  ansible.builtin.command:
+    cmd: ssh -V
+  changed_when: false
+  failed_when: false
+  register: ssh_version
+  tags:
+    - sshd
+    - sshd_config
+
+- name: Set ssh version as fact
+  ansible.builtin.set_fact:
+    ssh_installed_version: "{{ ssh_version.stderr | regex_search('^OpenSSH_([0-9+].[0-9]+)', '\\1') | join('.') | float }}" # noqa jinja[spacing]
+  tags:
+    - sshd
+    - sshd_config
+
+- name: Stat sysconfig sshd configuration
+  ansible.builtin.stat:
+    path: /etc/sysconfig/sshd
+  register: sysconfig_sshd
+  tags:
+    - sshd
+    - sshd_config
+    - M1041
+
+- name: Remove sshd system crypto policy
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/sysconfig/sshd
+    state: absent
+    regexp: ^\s*CRYPTO_POLICY.*$
+  when: sysconfig_sshd.stat.exists
+  tags:
+    - sshd
+    - CCE-80939-2
+    - M1041
+
+- name: Get sshd Include config
+  become: true
+  ansible.builtin.command: grep -E "^Include " /etc/ssh/sshd_config
+  register: grep_include
+  changed_when: false
+  failed_when: false
+  tags:
+    - sshd
+    - sshd_config
+    - M1041
+
+- name: Check if sshd_config.d exits
+  ansible.builtin.stat:
+    path: /etc/ssh/sshd_config.d
+  register: sshd_config_d
+  tags:
+    - sshd
+    - sshd_config
+    - M1041
+
+- name: Ensure /etc/ssh/sshd_config permissions
+  become: true
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: "0600"
+  tags:
+    - sshd
+    - sshd_config
+
+- name: Configure sshd
+  become: true
+  ansible.builtin.template:
+    src: etc/ssh/sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    backup: true
+    mode: "0600"
+    owner: root
+    group: root
+    validate: sshd -t -f %s
+  when: not sshd_config_d.stat.exists or grep_include.rc != 0
+  notify:
+    - Restart sshd service
+    - Restart ssh service
+  tags:
+    - sshd
+    - sshd_config
+    - CCE-80895-6
+    - CCE-80896-4
+    - CCE-80897-2
+    - CCE-80898-0
+    - CCE-80901-2
+    - CCE-80902-0
+    - CCE-80903-8
+    - CCE-80904-6
+    - CCE-80905-3
+    - CCE-80906-1
+    - CCE-82177-7
+    - CCE-82281-7
+    - CCE-83360-8
+    - CIS-UBUNTU2004-5.3.1
+    - CIS-UBUNTU2004-5.3.4
+    - CIS-UBUNTU2004-5.3.5
+    - CIS-UBUNTU2004-5.3.6
+    - CIS-UBUNTU2004-5.3.7
+    - CIS-UBUNTU2004-5.3.8
+    - CIS-UBUNTU2004-5.3.9
+    - CIS-UBUNTU2004-5.3.10
+    - CIS-UBUNTU2004-5.3.11
+    - CIS-UBUNTU2004-5.3.12
+    - CIS-UBUNTU2004-5.3.13
+    - CIS-UBUNTU2004-5.3.14
+    - CIS-UBUNTU2004-5.3.15
+    - CIS-UBUNTU2004-5.3.16
+    - CIS-UBUNTU2004-5.3.17
+    - CIS-UBUNTU2004-5.3.18
+    - CIS-UBUNTU2004-5.3.19
+    - CIS-UBUNTU2004-5.3.20
+    - CIS-UBUNTU2004-5.3.21
+    - CIS-UBUNTU2004-5.3.22
+    - M1041
+    - UBTU-20-010036
+    - UBTU-20-010037
+
+- name: Configure sshd using sshd_config.d
+  become: true
+  ansible.builtin.template:
+    src: etc/ssh/sshd_config.j2
+    dest: /etc/ssh/sshd_config.d/01-hardening.conf
+    backup: true
+    mode: "0600"
+    owner: root
+    group: root
+    validate: sshd -t -f %s
+  when: sshd_config_d.stat.exists and grep_include.rc == 0
+  notify:
+    - Restart sshd service
+    - Restart ssh service
+  tags:
+    - sshd
+    - sshd_config
+    - CCE-80895-6
+    - CCE-80896-4
+    - CCE-80897-2
+    - CCE-80898-0
+    - CCE-80901-2
+    - CCE-80902-0
+    - CCE-80903-8
+    - CCE-80904-6
+    - CCE-80905-3
+    - CCE-80906-1
+    - CCE-82177-7
+    - CCE-82281-7
+    - CCE-83360-8
+    - CIS-UBUNTU2004-5.3.1
+    - CIS-UBUNTU2004-5.3.4
+    - CIS-UBUNTU2004-5.3.5
+    - CIS-UBUNTU2004-5.3.6
+    - CIS-UBUNTU2004-5.3.7
+    - CIS-UBUNTU2004-5.3.8
+    - CIS-UBUNTU2004-5.3.9
+    - CIS-UBUNTU2004-5.3.10
+    - CIS-UBUNTU2004-5.3.11
+    - CIS-UBUNTU2004-5.3.12
+    - CIS-UBUNTU2004-5.3.13
+    - CIS-UBUNTU2004-5.3.14
+    - CIS-UBUNTU2004-5.3.15
+    - CIS-UBUNTU2004-5.3.16
+    - CIS-UBUNTU2004-5.3.17
+    - CIS-UBUNTU2004-5.3.18
+    - CIS-UBUNTU2004-5.3.19
+    - CIS-UBUNTU2004-5.3.20
+    - CIS-UBUNTU2004-5.3.21
+    - CIS-UBUNTU2004-5.3.22
+    - M1041
+    - UBTU-20-010036
+    - UBTU-20-010037
+
+- name: Remove possible Subsystem duplicate
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: ^Subsystem.*
+    state: absent
+  when: sshd_config_d.stat.exists and grep_include.rc == 0
+  tags:
+    - sshd
+    - sshd_config
+
+- name: Stat sshd host keys
+  become: true
+  ansible.builtin.find:
+    paths: /etc/ssh
+    file_type: file
+    patterns: "ssh_host_*"
+    excludes: "*.pub"
+  register: ssh_host_keys
+  tags:
+    - sshd
+    - M1022
+    - M1041
+
+- name: Set sshd host key permissions
+  become: true
+  ansible.builtin.file:
+    owner: root
+    group: root
+    mode: "0600"
+    path: "{{ item.path }}"
+  with_items: "{{ ssh_host_keys.files }}"
+  loop_control:
+    label: "{{ item.path }}"
+  tags:
+    - sshd
+    - CCE-82424-3
+    - CIS-UBUNTU2004-5.3.2
+    - M1022
+    - M1041
+
+- name: Check if ssh_config.d exits
+  ansible.builtin.stat:
+    path: /etc/ssh/ssh_config.d
+  register: ssh_config_d
+  tags:
+    - ssh
+    - ssh_config
+    - M1041
+
+- name: Configure ssh client
+  become: true
+  ansible.builtin.template:
+    src: etc/ssh/ssh_config.j2
+    dest: /etc/ssh/ssh_config
+    backup: true
+    mode: "0644"
+    owner: root
+    group: root
+  tags:
+    - ssh
+    - ssh_config
+    - CCE-82880-6
+    - M1041