Changeset 15389 for main/waeup-ansible

Timestamp:

5 Apr 2019, 23:44:20 (6 years ago)

Author:

uli

Message:

Start vhost 6 after reboots.

Location:

main/waeup-ansible

Files:

• bootstrap.yml (modified) (1 diff)
• hosts (modified) (1 diff)
• playbook-post-reboot.yml (modified) (1 diff)
• roles/openssh/tasks/main.yml (modified) (3 diffs)

main/waeup-ansible/bootstrap.yml

@@ -15 +15 @@
     # accounts are active.
     permit_ssh_root: true
+    # Allow admin users below to become root w/o entering password?
+    permit_become_root_no_password: true
     # create hashed passwords like this:
     #      $ diceware -d '-' -n 6 --no-caps | tee mypw | mkpasswd -s --method=sha-512 >> mypw
     admin_users:
-      uli:
-        hashed_pw: "$6$W3DjhWuk/dDzw2F$ozaXblaUYnEX6NiS9jg.NYFelyPIV8ySxDJGNwbPpTd.oAnmA.754pntuGT1XP.cAcpkCI5b9zWSgOQ09f5HG1"
+      ulif:
+        hashed_pw: "$6$iuoXy2wO3elWM6d2$NR/ayKF58q0Bm0BdsR.g.Nt5xYzD0s0t17ZjrYaRpY7nkRekjgHTnqw849pK9FdynmNZAioW6oQBQx3BB5kcd0"
 
   roles:

main/waeup-ansible/hosts

@@ -4 +4 @@
 [vhosts]
 # localhost:2323 ansible_user=ubuntu ansible_ssh_pass=2d20eb81c5dbe0167f27151c
-v1.waeup.org:2323 ansible_user=ubuntu
+# at least from ubuntu 18.04 on, vagrant is the default user again.
+v1.waeup.org:2322 ansible_user=ubuntu
 v2.waeup.org:2323 ansible_user=ubuntu
-v3.waeup.org:2324 ansible_user=ubuntu
+v3.waeup.org:2324 ansible_user=vagrant
 v4.waeup.org:2325 ansible_user=ubuntu
 v5.waeup.org:2326 ansible_user=ubuntu
+v6.waeup.org:2327 ansible_user=vagrant
 
 
 [bootstrapped]
+gf5.gnufix.de
+gf6.gnufix.de
+gf9.gnufix.de
 h8.waeup.org
 

main/waeup-ansible/playbook-post-reboot.yml

@@ -97 +97 @@
     args:
       chdir: /home/vhosts/vhost5
+  - name: Start vagrant vhost6
+    become_user: vhosts
+    command: vagrant up
+    args:
+      chdir: /home/vhosts/vhost6

main/waeup-ansible/roles/openssh/tasks/main.yml

@@ -8 +8 @@
     regexp={{ item.regexp }}
   with_items:
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_rsa_key',
+        line: 'HostKey /etc/ssh/ssh_host_rsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_dsa_key',
         line: '# HostKey /etc/ssh/ssh_host_dsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key',
         line: '# HostKey /etc/ssh/ssh_host_ecdsa_key' }
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_ed25519_key',
+        line: 'HostKey /etc/ssh/ssh_host_ed25519_key' }
   notify: "restart sshd"
 
@@ -23 +27 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure ciphers from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
@@ -30 +36 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure MACs from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
-    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+    line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
     state=present
   notify: "restart sshd"
 
-- name: "sshd_config - set secure kex algos from bettercrypto.org"
+- name: "sshd_config - set secure MACs from bettercrypto.orgi (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure MACs from bettercrypto.org and ssh-audit.py (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com'
+    state=present
+  notify: "restart sshd"
+
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
   lineinfile:
     dest=/etc/ssh/sshd_config
     line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512'
     state=present
   notify: "restart sshd"