system/tasks/ssh.yml

75 lines
1.6 KiB
YAML
Raw Normal View History

2021-04-20 08:18:56 +00:00
- name: copy ssh config for user
2022-02-13 08:40:15 +00:00
become: true
2022-07-26 17:50:17 +00:00
template:
2022-07-26 18:52:52 +00:00
dest: "/home/{{item}}/.ssh"
2022-02-13 08:40:15 +00:00
src: "ssh/config"
force: true
remote_src: false
mode: "600"
selevel: s0
owner: "{{ item }}"
2020-03-01 20:06:02 +00:00
with_items:
2022-02-13 08:40:15 +00:00
- "{{ user.name }}"
2021-07-10 12:41:35 +00:00
- name: ensure root ssh directory exist
become: true
file:
state: directory
path: "/root/.ssh"
owner: "root"
mode: 0700
- name: copy ssh config for root
2022-02-13 08:40:15 +00:00
become: true
2021-07-10 12:41:35 +00:00
copy:
2022-02-13 08:40:15 +00:00
dest: /root/.ssh/
src: "ssh/config"
force: true
remote_src: false
mode: "600"
selevel: s0
owner: "root"
2021-07-10 12:41:35 +00:00
- name: ensure key directory exist
become: true
file:
state: directory
path: "{{ item.keyfile | dirname }}"
2022-02-13 08:40:15 +00:00
owner: "{{ item.user }}"
2021-07-10 12:41:35 +00:00
mode: 0700
2022-02-13 08:40:15 +00:00
with_items: "{{ privatekeytodeploy }}"
2020-03-01 20:06:02 +00:00
2021-04-20 08:18:56 +00:00
- name: Install ssh private key
2022-02-13 08:40:15 +00:00
become: true
copy:
content: "{{ item.privatekey }}"
2021-04-20 08:18:56 +00:00
dest: "{{ item.keyfile }}"
mode: 0600
2022-02-13 08:40:15 +00:00
owner: "{{ item.user }}"
with_items: "{{ privatekeytodeploy }}"
2020-03-01 20:06:02 +00:00
- name: Deploy SSH-Keys to remote host
authorized_key:
2022-02-13 08:40:15 +00:00
user: "{{ item.user }}"
key: "{{ item.sshkey }}"
exclusive: false
with_items: "{{ keystodeploy }}"
become: true
2020-03-02 20:19:09 +00:00
- name: les connexions par mot de passe sont désactivées
2022-02-13 08:40:15 +00:00
become: true
lineinfile:
dest: /etc/ssh/sshd_config
2020-03-02 20:19:09 +00:00
regexp: "^#?PasswordAuthentication"
line: "PasswordAuthentication no"
state: present
notify: Restart sshd
- name: Remove root SSH access
2022-02-13 08:40:15 +00:00
become: true
lineinfile:
dest: /etc/ssh/sshd_config
regexp: "^PermitRootLogin"
line: "PermitRootLogin no"
2020-03-02 20:19:09 +00:00
state: present
notify: Restart sshd