24 lines
859 B
YAML
24 lines
859 B
YAML
|
---
|
||
|
|
# SSH hardening configuration
|
||
|
|
|
||
|
|
- name: Configure SSH daemon
|
||
|
|
lineinfile:
|
||
|
|
path: /etc/ssh/sshd_config
|
||
|
|
regexp: "{{ item.regexp }}"
|
||
|
|
line: "{{ item.line }}"
|
||
|
|
state: present
|
||
|
|
with_items:
|
||
|
|
- { regexp: '^#?PermitRootLogin', line: 'PermitRootLogin {{ common_ssh_permit_root_login }}' }
|
||
|
|
- { regexp: '^#?PasswordAuthentication', line: 'PasswordAuthentication {{ common_ssh_password_authentication }}' }
|
||
|
|
- { regexp: '^#?PubkeyAuthentication', line: 'PubkeyAuthentication {{ common_ssh_pubkey_authentication }}' }
|
||
|
|
- { regexp: '^#?PermitEmptyPasswords', line: 'PermitEmptyPasswords no' }
|
||
|
|
- { regexp: '^#?X11Forwarding', line: 'X11Forwarding no' }
|
||
|
|
- { regexp: '^#?MaxAuthTries', line: 'MaxAuthTries 3' }
|
||
|
|
notify: Restart SSH
|
||
|
|
|
||
|
|
- name: Ensure SSH is running and enabled
|
||
|
|
service:
|
||
|
|
name: ssh
|
||
|
|
state: started
|
||
|
|
enabled: yes
|