source: main/waeup-ansible/roles/openssh/tasks/main.yml @ 16954

---
# tasks to enable secure OpenSSH server config
- name: "sshd_config - disable weak keys"
  lineinfile:
    dest=/etc/ssh/sshd_config
    backrefs=yes
    line={{ item.line }}
    regexp={{ item.regexp }}
  with_items:
    - { regexp: '^#HostKey /etc/ssh/ssh_host_rsa_key',
        line: 'HostKey /etc/ssh/ssh_host_rsa_key' }
    - { regexp: '^HostKey /etc/ssh/ssh_host_dsa_key',
        line: '# HostKey /etc/ssh/ssh_host_dsa_key' }
    - { regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key',
        line: '# HostKey /etc/ssh/ssh_host_ecdsa_key' }
    - { regexp: '^#HostKey /etc/ssh/ssh_host_ed25519_key',
        line: 'HostKey /etc/ssh/ssh_host_ed25519_key' }
  notify: "restart sshd"

- name: "sshd_config - set key bits to 4096"
  lineinfile:
    dest=/etc/ssh/sshd_config
    backrefs=yes
    line='ServerKeyBits 4096'
    regexp='^ServerKeyBits 1024'
    state=present
  notify: "restart sshd"

- name: "sshd_config - set secure ciphers from bettercrypto.org (Ubuntu)"
  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
        
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr'
    state=present
  notify: "restart sshd"

- name: "sshd_config - set secure ciphers from bettercrypto.org (Debian)"
  when: ansible_distribution == 'Debian'
        
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
    state=present
  notify: "restart sshd"

- name: "sshd_config - set secure MACs from bettercrypto.orgi (Ubuntu)"
  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
    state=present
  notify: "restart sshd"

- name: "sshd_config - set secure MACs from bettercrypto.org and ssh-audit.py (Debian)"
  when: ansible_distribution == 'Debian'
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com'
    state=present
  notify: "restart sshd"


- name: "sshd_config - set secure kex algos from bettercrypto.org (Ubuntu)"
  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
    state=present
  notify: "restart sshd"

- name: "sshd_config - set secure kex algos from bettercrypto.org (Debian)"
  when: ansible_distribution == 'Debian'
  lineinfile:
    dest=/etc/ssh/sshd_config
    line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512'
    state=present
  notify: "restart sshd"

- name: "remove short moduli (<2048 bits) from /etc/ssh/moduli"
  replace:
    dest=/etc/ssh/moduli
    regexp='^([0-9]+\s){4}(1[0-9]{3}\s)'
  notify: "restart sshd"