Graham McIntire
c64f59929e
Add an RPZ blocklist on the Unbound resolvers that returns NXDOMAIN for a set of domains (and subdomains) and logs only those matches under rpz-log tag "blocklist". Domains are templated from resolver_blocked_domains (single source of truth) into /etc/unbound/blocklist.rpz; respip module enabled for RPZ support. Fix deprecation warnings across the Ansible tree: - apt_repository -> deb822_repository (monitor, aprsc, uisp, grafana), removing stale .list files and adding update_cache where deb822 drops it - community.mysql.* -> ansible.mysql.* (monitor) and requirements.yml - top-level facts -> ansible_facts[...] (ansible_os_family, distribution_release, fqdn, architecture, default_ipv4) repo-wide
89 lines
2.9 KiB
YAML
89 lines
2.9 KiB
YAML
---
|
|
# One-time playbook to regenerate SSH host keys on existing hosts
|
|
# Usage: ansible-playbook -l "vm1,pangolin,birdnet" regenerate-ssh-keys.yml
|
|
#
|
|
# After running this playbook, you'll need to update your local known_hosts:
|
|
# ssh-keygen -R hostname
|
|
# Or clear all affected entries and re-accept on next connection.
|
|
|
|
- name: Regenerate SSH host keys on existing hosts
|
|
hosts: all
|
|
become: true
|
|
gather_facts: true
|
|
|
|
tasks:
|
|
- name: Remove existing SSH host keys
|
|
file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_rsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
- /etc/ssh/ssh_host_ed25519_key.pub
|
|
- /etc/ssh/ssh_host_dsa_key
|
|
- /etc/ssh/ssh_host_dsa_key.pub
|
|
|
|
- name: Regenerate SSH host keys (Debian/Ubuntu)
|
|
command: dpkg-reconfigure openssh-server
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
|
|
- name: Regenerate SSH host keys (RHEL/CentOS)
|
|
shell: |
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
|
|
- name: Regenerate SSH host keys (Alpine)
|
|
shell: |
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
when: ansible_facts['os_family'] == "Alpine"
|
|
|
|
- name: Set correct permissions on private keys
|
|
file:
|
|
path: "{{ item }}"
|
|
mode: '0600'
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
ignore_errors: true
|
|
|
|
- name: Set correct permissions on public keys
|
|
file:
|
|
path: "{{ item }}"
|
|
mode: '0644'
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
- /etc/ssh/ssh_host_ed25519_key.pub
|
|
ignore_errors: true
|
|
|
|
- name: Restart SSH service
|
|
service:
|
|
name: "{{ 'ssh' if ansible_facts['os_family'] == 'Debian' else 'sshd' }}"
|
|
state: restarted
|
|
|
|
- name: Create marker file to indicate keys were regenerated
|
|
file:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
state: touch
|
|
mode: '0644'
|
|
|
|
- name: Display new SSH host key fingerprints
|
|
shell: |
|
|
echo "=== New SSH Host Key Fingerprints for {{ inventory_hostname }} ==="
|
|
for key in /etc/ssh/ssh_host_*_key.pub; do
|
|
ssh-keygen -lf "$key" 2>/dev/null || true
|
|
done
|
|
register: fingerprints
|
|
changed_when: false
|
|
|
|
- name: Show fingerprints
|
|
debug:
|
|
msg: "{{ fingerprints.stdout_lines }}"
|