Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit ef9c340

Browse files
author
Sebastian Gumprich
committed
yaml-lint update, refactor tasks
1 parent 045dbea commit ef9c340

File tree

10 files changed

+200
-118
lines changed

10 files changed

+200
-118
lines changed

‎.kitchen.aws.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
driver:
3+
name: ec2
4+
vpc_id: "vpc-4ef2ce26"
5+
subnet_id: "subnet-b477b7df"
6+
region: eu-central-1
7+
8+
transport:
9+
max_ssh_sessions: 5
10+
11+
provisioner:
12+
name: ansible_playbook
13+
hosts: all
14+
require_ansible_repo: false
15+
require_chef_for_busser: false
16+
require_ruby_for_busser: false
17+
require_ansible_omnibus: true
18+
ansible_verbose: true
19+
ansible_diff: true
20+
hosts: all
21+
roles_path: ../ansible-ssh-hardening/
22+
http_proxy: <%= ENV['http_proxy'] || nil %>
23+
https_proxy: <%= ENV['https_proxy'] || nil %>
24+
playbook: default.yml
25+
26+
platforms:
27+
- name: centos-7
28+
- name: ubuntu-16.04
29+
30+
verifier:
31+
name: inspec
32+
sudo: true
33+
inspec_tests:
34+
- https://github.com/dev-sec/tests-ssh-hardening
35+
36+
suites:
37+
- name: os

‎.kitchen.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ provisioner:
2121
roles_path: ../ansible-ssh-hardening/
2222
http_proxy: <%= ENV['http_proxy'] || nil %>
2323
https_proxy: <%= ENV['https_proxy'] || nil %>
24-
playbook: default.yml
24+
playbook: tests/default.yml
2525
ansible_diff: true
2626
ansible_extra_flags:
2727
- "--skip-tags=sysctl"

‎.travis.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ script:
5757
- 'docker run --detach --volume="${PWD}":/etc/ansible/roles/ansible-ssh-hardening:ro ${run_opts} rndmh3ro/docker-${distro}-ansible:${version} "${init}" > "${container_id}"'
5858

5959
# Test role.
60-
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/default_custom.yml'
61-
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/default.yml'
60+
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default_custom.yml'
61+
- 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default.yml'
6262

6363
# Verify role
6464
# remove the UseLogin-check, see here for reasons: https://github.com/dev-sec/ansible-ssh-hardening/pull/141

‎tasks/2fa.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
# Install the 2FA packages and setup the config in PAM and SSH
3+
- name: Install google authenticator PAM module
4+
apt:
5+
name: 'libpam-google-authenticator'
6+
state: present
7+
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
8+
9+
- name: Install google authenticator PAM module
10+
yum:
11+
name: 'google-authenticator'
12+
state: present
13+
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
14+
15+
- name: Add google auth module to PAM
16+
pamd:
17+
name: 'sshd'
18+
type: 'auth'
19+
control: 'required'
20+
module_path: 'pam_google_authenticator.so'
21+
22+
- name: Remove password auth from PAM
23+
pamd:
24+
name: 'sshd'
25+
type: 'auth'
26+
control: 'substack'
27+
module_path: 'password-auth'
28+
state: absent
29+
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux' or ansible_distribution == 'Amazon'
30+
31+
- name: Remove password auth from PAM
32+
replace:
33+
dest: '/etc/pam.d/sshd'
34+
regexp: '^@include common-auth'
35+
replace: '#@include common-auth'
36+
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'

‎tasks/ca_keys_and_principals.yml‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,27 @@
11
---
22
- name: Set ssh CA pub keys
3-
template: src='trusted_user_ca_keys.j2' dest="{{ ssh_trusted_user_ca_keys_file }}" mode=0644 owner="{{ ssh_owner }}" group="{{ ssh_group }}"
3+
template:
4+
src: 'trusted_user_ca_keys.j2'
5+
dest: '{{ ssh_trusted_user_ca_keys_file }}'
6+
mode: '0644'
7+
owner: '{{ ssh_owner }}'
8+
group: '{{ ssh_group }}'
49
notify: restart sshd
510

611
- name: Create ssh authorized principals directories
7-
file: path="{{ item.path | dirname }}" mode="{{ item.directorymode | default(0700) }}" owner="{{ item.directoryowner | default(ssh_owner) }}" group="{{ item.directorygroup | default(ssh_group) }}" state=directory
8-
with_items: "{{ ssh_authorized_principals }}"
12+
file:
13+
path: '{{ item.path | dirname }}'
14+
mode: '{{ item.directorymode | default(0700) }}'
15+
owner: '{{ item.directoryowner | default(ssh_owner) }}'
16+
group: '{{ item.directorygroup | default(ssh_group) }}'
17+
state: directory
18+
with_items: '{{ ssh_authorized_principals }}'
919

1020
- name: Set ssh authorized principals
11-
template: src='authorized_principals.j2' dest="{{ item.path }}" mode="{{ item.filemode | default(0600) }}" owner="{{ item.owner| default(ssh_owner) }}" group="{{ item.group | default(ssh_group) }}"
12-
with_items: "{{ ssh_authorized_principals }}"
21+
template:
22+
src: 'authorized_principals.j2'
23+
dest: '{{ item.path }}'
24+
mode: '{{ item.filemode | default(0600) }}'
25+
owner: '{{ item.owner| default(ssh_owner) }}'
26+
group: '{{ item.group | default(ssh_group) }}'
27+
with_items: '{{ ssh_authorized_principals }}'

‎tasks/crypto.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,80 +19,80 @@
1919

2020
- name: set weak macs according to openssh-version if openssh >= 7.6
2121
set_fact:
22-
ssh_macs: "{{ssh_macs_76_default}}"
22+
ssh_macs: '{{ ssh_macs_76_default }}'
2323
when: sshd_version.stdout >= '7.6' and not ssh_macs
2424

2525
- name: set weak macs according to openssh-version if openssh >= 6.6
2626
set_fact:
27-
ssh_macs: "{{ssh_macs_66_weak}}"
27+
ssh_macs: '{{ ssh_macs_66_weak }}'
2828
when: sshd_version.stdout >= '6.6' and ssh_server_weak_hmac and not ssh_macs
2929

3030
- name: set macs according to openssh-version if openssh >= 6.6
3131
set_fact:
32-
ssh_macs: "{{ssh_macs_66_default}}"
32+
ssh_macs: '{{ ssh_macs_66_default }}'
3333
when: sshd_version.stdout >= '6.6' and not ssh_macs
3434

3535
- name: set weak macs according to openssh-version
3636
set_fact:
37-
ssh_macs: "{{ssh_macs_59_weak}}"
37+
ssh_macs: '{{ ssh_macs_59_weak }}'
3838
when: sshd_version.stdout >= '5.9' and ssh_server_weak_hmac and not ssh_macs
3939

4040
- name: set macs according to openssh-version
4141
set_fact:
42-
ssh_macs: "{{ssh_macs_59_default}}"
42+
ssh_macs: '{{ ssh_macs_59_default }}'
4343
when: sshd_version.stdout >= '5.9' and not ssh_macs
4444

4545
- name: set macs according to openssh-version
4646
set_fact:
47-
ssh_macs: "{{ssh_macs_53_default}}"
47+
ssh_macs: '{{ ssh_macs_53_default }}'
4848
when: sshd_version.stdout >= '5.3' and not ssh_macs
4949

5050
- name: set macs according to openssh-version
5151
set_fact:
52-
ssh_macs: "{{ssh_macs_53_default}}"
52+
ssh_macs: '{{ ssh_macs_53_default }}'
5353
when: sshd_version.stdout >= '5.3' and not ssh_macs
5454

5555
###
5656

5757
- name: set weak ciphers according to openssh-version if openssh >= 6.6
5858
set_fact:
59-
ssh_ciphers: "{{ssh_ciphers_66_weak}}"
59+
ssh_ciphers: '{{ ssh_ciphers_66_weak }}'
6060
when: sshd_version.stdout >= '6.6' and ssh_server_cbc_required and not ssh_ciphers
6161

6262
- name: set ciphers according to openssh-version if openssh >= 6.6
6363
set_fact:
64-
ssh_ciphers: "{{ssh_ciphers_66_default}}"
64+
ssh_ciphers: '{{ ssh_ciphers_66_default }}'
6565
when: sshd_version.stdout >= '6.6' and not ssh_ciphers
6666

6767
- name: set weak ciphers according to openssh-version
6868
set_fact:
69-
ssh_ciphers: "{{ssh_ciphers_53_weak}}"
69+
ssh_ciphers: '{{ ssh_ciphers_53_weak }}'
7070
when: sshd_version.stdout >= '5.3' and ssh_server_cbc_required and not ssh_ciphers
7171

7272
- name: set ciphers according to openssh-version
7373
set_fact:
74-
ssh_ciphers: "{{ssh_ciphers_53_default}}"
74+
ssh_ciphers: '{{ ssh_ciphers_53_default }}'
7575
when: sshd_version.stdout >= '5.3' and not ssh_ciphers
7676

7777
###
7878

7979
- name: set weak kex according to openssh-version if openssh >= 6.6
8080
set_fact:
81-
ssh_kex: "{{ssh_kex_66_weak}}"
81+
ssh_kex: '{{ ssh_kex_66_weak }}'
8282
when: sshd_version.stdout >= '6.6' and ssh_server_weak_hmac and not ssh_kex
8383

8484
- name: set kex according to openssh-version if openssh >= 6.6
8585
set_fact:
86-
ssh_kex: "{{ssh_kex_66_default}}"
86+
ssh_kex: '{{ ssh_kex_66_default }}'
8787
when: sshd_version.stdout >= '6.6' and not ssh_kex
8888

8989
- name: set weak kex according to openssh-version
9090
set_fact:
91-
ssh_kex: "{{ssh_kex_59_weak}}"
91+
ssh_kex: '{{ ssh_kex_59_weak }}'
9292
when: sshd_version.stdout >= '5.9' and ssh_server_weak_hmac and not ssh_kex
9393

9494
- name: set kex according to openssh-version
9595
set_fact:
96-
ssh_kex: "{{ssh_kex_59_default}}"
96+
ssh_kex: '{{ ssh_kex_59_default }}'
9797
when: sshd_version.stdout >= '5.9' and not ssh_kex
9898

‎tasks/main.yml‎

Lines changed: 32 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
- name: Set OS dependent variables
3-
include_vars: "{{ item }}"
3+
include_vars: '{{ item }}'
44
with_first_found:
5-
- "{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml"
6-
- "{{ ansible_distribution }}.yml"
7-
- "{{ ansible_os_family }}_{{ ansible_distribution_major_version }}.yml"
8-
- "{{ ansible_os_family }}.yml"
5+
- '{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml'
6+
- '{{ ansible_distribution }}.yml'
7+
- '{{ ansible_os_family }}_{{ ansible_distribution_major_version }}.yml'
8+
- '{{ ansible_os_family }}.yml'
99

1010
- name: get openssh-version
1111
shell: ssh -V 2>&1 | sed -r 's/.*_([0-9]*\.[0-9]).*/\1/g'
@@ -18,17 +18,33 @@
1818
- include_tasks: crypto.yml
1919

2020
- name: create revoked_keys and set permissions to root/600
21-
template: src='revoked_keys.j2' dest='/etc/ssh/revoked_keys' mode=0600 owner="{{ ssh_owner }}" group="{{ ssh_group }}"
21+
template:
22+
src: 'revoked_keys.j2'
23+
dest: '/etc/ssh/revoked_keys'
24+
mode: '0600'
25+
owner: '{{ ssh_owner }}'
26+
group: '{{ ssh_group }}'
2227
notify: restart sshd
2328
when: ssh_server_hardening
2429

2530
- name: create sshd_config and set permissions to root/600
26-
template: src='opensshd.conf.j2' dest='/etc/ssh/sshd_config' mode=0600 owner="{{ ssh_owner }}" group="{{ ssh_group }}" validate="/usr/sbin/sshd -T -f %s"
31+
template:
32+
src: 'opensshd.conf.j2'
33+
dest: '/etc/ssh/sshd_config'
34+
mode: '0600'
35+
owner: '{{ ssh_owner }}'
36+
group: '{{ ssh_group }}'
37+
validate: '/usr/sbin/sshd -T -f %s'
2738
notify: restart sshd
2839
when: ssh_server_hardening
2940

3041
- name: create ssh_config and set permissions to root/644
31-
template: src='openssh.conf.j2' dest='/etc/ssh/ssh_config' mode=0644 owner="{{ ssh_owner }}" group="{{ ssh_group }}"
42+
template:
43+
src: 'openssh.conf.j2'
44+
dest: '/etc/ssh/ssh_config'
45+
mode: '0644'
46+
owner: '{{ ssh_owner }}'
47+
group: '{{ ssh_group }}'
3248
when: ssh_client_hardening
3349

3450
- name: Check if /etc/ssh/moduli contains weak DH parameters
@@ -46,98 +62,19 @@
4662
- include_tasks: ca_keys_and_principals.yml
4763
when: ssh_trusted_user_ca_keys_file != ''
4864

49-
- name: test to see if selinux is installed and running
50-
command: getenforce
51-
register: sestatus
52-
failed_when: false
53-
changed_when: false
54-
check_mode: no
55-
5665
# Install the 2FA packages and setup the config in PAM and SSH
57-
58-
- block:
59-
- name: Install google authenticator PAM module
60-
apt: name=libpam-google-authenticator state=present
61-
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
62-
63-
- name: Install google authenticator PAM module
64-
yum: name=google-authenticator state=present
65-
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
66-
67-
- name: Add google auth module to PAM
68-
pamd:
69-
name: sshd
70-
type: auth
71-
control: required
72-
module_path: pam_google_authenticator.so
73-
74-
- name: Remove password auth from PAM
75-
pamd:
76-
name: sshd
77-
type: auth
78-
control: substack
79-
module_path: password-auth
80-
state: absent
81-
when: ansible_distribution == 'RedHat' or ansible_distribution == 'Oracle Linux' or ansible_distribution == 'Amazon'
82-
83-
- name: Remove password auth from PAM
84-
replace:
85-
dest: /etc/pam.d/sshd
86-
regexp: '^@include common-auth'
87-
replace: '#@include common-auth'
88-
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
89-
66+
- include_tasks: 2fa.yml
9067
when:
9168
- ssh_use_pam
9269
- ssh_challengeresponseauthentication
9370
- ssh_google_auth
9471

72+
- name: test to see if selinux is installed and running
73+
command: getenforce
74+
register: sestatus
75+
failed_when: false
76+
changed_when: false
77+
check_mode: no
9578

96-
- block: # only runs when selinux is installed
97-
- name: install selinux dependencies when selinux is installed on RHEL or Oracle Linux
98-
package: name="{{item}}" state=present
99-
with_items:
100-
- policycoreutils-python
101-
- checkpolicy
102-
when: ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux'
103-
104-
- name: install selinux dependencies when selinux is installed on Debian or Ubuntu
105-
apt: name="{{item}}" state=present
106-
with_items:
107-
- policycoreutils
108-
- checkpolicy
109-
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
110-
111-
- name: check if ssh_password module is already installed
112-
shell: "semodule -l | grep ssh_password"
113-
register: ssh_password_module
114-
failed_when: false
115-
changed_when: false
116-
check_mode: no
117-
118-
# The following tasks only get executed when selinux is in state enforcing, UsePam is "no" and the ssh_password module is installed.
119-
# See this issue for more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
120-
- block:
121-
- name: Create selinux custom policy drop folder
122-
file: path='{{ ssh_custom_selinux_dir }}' state=directory owner=root group=root mode=0750
123-
124-
- name: Distributing custom selinux policies
125-
copy: src='ssh_password' dest='{{ ssh_custom_selinux_dir }}'
126-
127-
- name: check and compile policy
128-
shell: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
129-
130-
- name: create selinux policy module package
131-
shell: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
132-
133-
- name: install selinux policy
134-
shell: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp
135-
136-
when: not ssh_use_pam and sestatus.stdout != 'Disabled' and ssh_password_module.stdout.find('ssh_password') != 0
137-
138-
# The following tasks only get executed when selinux is installed, UsePam is "yes" and the ssh_password module is installed.
139-
- name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk (http://danwalsh.livejournal.com/12333.html)
140-
command: semodule -r ssh_password
141-
when: ssh_use_pam and ssh_password_module.stdout.find('ssh_password') == 0
142-
79+
- include_tasks: selinux.yml
14380
when: sestatus.rc == 0

0 commit comments

Comments
 (0)