Graham McIntire
ee72c64246
- Convert ~290 short module names to FQCNs across all roles - Change become: yes/no to become: true/false, gather_facts: no to false - Remove deprecated inject_facts_as_vars from ansible.cfg - Add missing task names to import_tasks/include_role calls - Add become: yes to librenms clone task (partial-become fix) - Add pipefail to risky shell command in udp-gro-fix.yml - Quote all octal mode values - Harden .ansible-lint with production profile and empty skip_list - Update findings.md with all fixes
88 lines
No EOL
2.6 KiB
YAML
88 lines
No EOL
2.6 KiB
YAML
---
|
|
# System configuration tasks
|
|
|
|
# SSH host key regeneration for cloned VMs
|
|
# Only runs once per host (marker file prevents re-running)
|
|
- name: Check if SSH host keys have been regenerated
|
|
ansible.builtin.stat:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
register: ssh_keys_marker
|
|
|
|
- name: Regenerate SSH host keys (first boot after clone)
|
|
when: not ssh_keys_marker.stat.exists
|
|
block:
|
|
- name: Remove existing SSH host keys
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /etc/ssh/ssh_host_rsa_key
|
|
- /etc/ssh/ssh_host_rsa_key.pub
|
|
- /etc/ssh/ssh_host_ecdsa_key
|
|
- /etc/ssh/ssh_host_ecdsa_key.pub
|
|
- /etc/ssh/ssh_host_ed25519_key
|
|
- /etc/ssh/ssh_host_ed25519_key.pub
|
|
- /etc/ssh/ssh_host_dsa_key
|
|
- /etc/ssh/ssh_host_dsa_key.pub
|
|
|
|
- name: Regenerate SSH host keys
|
|
ansible.builtin.command:
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_os_family == "Debian"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (RHEL)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_os_family == "RedHat"
|
|
notify: restart ssh
|
|
|
|
- name: Regenerate SSH host keys (Alpine)
|
|
ansible.builtin.shell:
|
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
|
|
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
|
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
|
|
args:
|
|
creates: /etc/ssh/ssh_host_ed25519_key
|
|
when: ansible_os_family == "Alpine"
|
|
notify: restart ssh
|
|
|
|
- name: Create marker file to prevent re-running
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/.host_keys_regenerated
|
|
state: touch
|
|
mode: '0644'
|
|
|
|
- name: Install SSH banner
|
|
ansible.builtin.template:
|
|
src: issue.net.j2
|
|
dest: /etc/issue.net
|
|
mode: '0644'
|
|
tags:
|
|
- ssh
|
|
|
|
- name: Configure SSH to use banner
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: '^Banner'
|
|
line: 'Banner /etc/issue.net'
|
|
state: present
|
|
notify: restart ssh
|
|
tags:
|
|
- ssh
|
|
|
|
# Uncomment if you want to disable root SSH access
|
|
# - name: Disallow root SSH access
|
|
# lineinfile:
|
|
# path: /etc/ssh/sshd_config
|
|
# regexp: "^PermitRootLogin"
|
|
# line: "PermitRootLogin no"
|
|
# state: present
|
|
# notify: restart ssh
|
|
# tags:
|
|
# - ssh |