freifunk/Ansible-Configuration Changeset - e786d8b876e9 · Chaos Computer Club Lëtzebuerg Projects

Changeset - e786d8b876e9

Parent rev.

Child rev.

[Not reviewed]

0 1 0

x - 20 months ago 2023-08-29 18:26:34
xbr@c3l.lu

feat: initial, only reload sshd if edited

1 file changed with 7 insertions and 0 deletions:

initial_server_setup/initial_setup.yml

0 comments (0 inline, 0 general)

initial_server_setup/initial_setup.yml

➞

Show inline comments

@@ @@ -48,58 +48,64 @@ @@
         state: present
       tags: network,hostname,dns
     # SSH security improvements (EmptyPass, PassAuth, RootLogin)
     - name: Disable SSH Password Auth
       ansible.builtin.copy:
         dest: /etc/ssh/sshd_config.d/disable_password_auth.conf
         owner: root
         mode: u=rw,g=r,o=r
         content: |
           # {{ ansible_managed }}
           PasswordAuthentication no
       register: pass_auth
     - name: Remove SSH Password Auth from sshd_config
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regex: "^PasswordAuthentication"
         line: "# PasswordAuthentication No"
       tags: network,ssh
       register: pass_auth_sshd
     - name: Disable SSH Empty Password
       ansible.builtin.copy:
         dest: /etc/ssh/sshd_config.d/disable_empty_password.conf
         owner: root
         mode: u=rw,g=r,o=r
         content: |
           # {{ ansible_managed }}
           PermitEmptyPasswords no
       register: empty_pass
     - name: Remove SSH Empty Password from sshd_config
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regex: "^PermitEmptyPasswords"
         line: "# PermitEmptyPasswords No"
       tags: network,ssh
       register: empty_pass_sshd
     - name: Disable SSH Root Login
       ansible.builtin.copy:
         dest: /etc/ssh/sshd_config.d/disable_root_login.conf
         owner: root
         mode: u=rw,g=r,o=r
         content: |
           # {{ ansible_managed }}
           PermitRootLogin no
       register: root_login
     - name: Remove SSH Root Login from sshd_config
       ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regex: "^PermitRootLogin"
         line: "# PermitRootLogin No"
       tags: network,ssh
       register: root_login_sshd
     # Create Freifunk Users
     - name: Create member users
       ansible.builtin.user:
         name: "{{ item.username }}"
         password: "{{ password | password_hash('sha512') }}"
         update_password: "on_create"
         groups:
           - sudo
         append: true
         shell: /bin/bash
         state: present
@@ @@ -147,12 +153,13 @@ @@
     - name: Allow for password-less sudo
       community.general.sudoers:
         name: passwordless-sudo
         group: sudo
         commands: ALL
         nopassword: true
     - name: Reload SSHD
       ansible.builtin.service:
         name: "sshd"
         state: "reloaded"
       tags: network,ssh
       when: pass_auth.changed or pass_auth_sshd.changed or empty_pass.changed or empty_pass_sshd.changed or root_login.changed or root_login_sshd.changed

0 comments (0 inline, 0 general)