Changeset 15389 for main/waeup-ansible/roles/openssh/tasks/main.yml

Timestamp:

5 Apr 2019, 23:44:20 (6 years ago)

Author:

uli

Message:

Start vhost 6 after reboots.

File:

• main/waeup-ansible/roles/openssh/tasks/main.yml (modified) (3 diffs)

main/waeup-ansible/roles/openssh/tasks/main.yml

@@ -8 +8 @@
     regexp={{ item.regexp }}
   with_items:
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_rsa_key',
+        line: 'HostKey /etc/ssh/ssh_host_rsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_dsa_key',
         line: '# HostKey /etc/ssh/ssh_host_dsa_key' }
     - { regexp: '^HostKey /etc/ssh/ssh_host_ecdsa_key',
         line: '# HostKey /etc/ssh/ssh_host_ecdsa_key' }
+    - { regexp: '^#HostKey /etc/ssh/ssh_host_ed25519_key',
+        line: 'HostKey /etc/ssh/ssh_host_ed25519_key' }
   notify: "restart sshd"
 
@@ -23 +27 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure ciphers from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
@@ -30 +36 @@
   notify: "restart sshd"
 
-- name: "sshd_config - set secure MACs from bettercrypto.org"
+- name: "sshd_config - set secure ciphers from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+        
   lineinfile:
     dest=/etc/ssh/sshd_config
-    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+    line='Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
     state=present
   notify: "restart sshd"
 
-- name: "sshd_config - set secure kex algos from bettercrypto.org"
+- name: "sshd_config - set secure MACs from bettercrypto.orgi (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure MACs from bettercrypto.org and ssh-audit.py (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com'
+    state=present
+  notify: "restart sshd"
+
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Ubuntu)"
+  when: ansible_distribution == 'Ubuntu' and ansible_distribution_major_version is version('16', '<=')
   lineinfile:
     dest=/etc/ssh/sshd_config
     line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1'
+    state=present
+  notify: "restart sshd"
+
+- name: "sshd_config - set secure kex algos from bettercrypto.org (Debian)"
+  when: ansible_distribution == 'Debian'
+  lineinfile:
+    dest=/etc/ssh/sshd_config
+    line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512'
     state=present
   notify: "restart sshd"