james/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

basessh: remove rhel7 stuff and clean up template

Browse source 
This should largely have no effect, but makes things easiler to
follow/read. We have 0 rhel7 instances left so removing all those
conditionals.

Also, rename the sshd_config teplate to be .j2 like all our other
templates.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2025-07-16 11:57:10 -07:00
commit 9d22211952
2 changed files with 2 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

13
roles/basessh/tasks/main.yml
View file

@ -25,16 +25,6 @@
- /root/.ssh/known_hosts
when: birthday is defined
- name: Make sure libselinux-python is installed
ansible.builtin.package: name=libselinux-python state=present
tags:
- basessh
- sshd_config
- config
- sshd
- selinux
when: ansible_distribution == 'RedHat' and ansible_distribution_major_version|int < 8
- name: Make sure python3-libselinux is installed
ansible.builtin.package: name=python3-libselinux state=present
tags:
@ -43,7 +33,6 @@
- config
- sshd
- selinux
when: ( ansible_distribution == 'Fedora' and ansible_distribution_major_version|int >= 30 ) or ( ansible_distribution == 'RedHat' and ansible_distribution_major_version|int >= 8 )
- name: Check if sshd port is already known by selinux
ansible.builtin.shell: semanage port -l | grep ssh
@ -72,7 +61,7 @@
- base
- name: Sshd_config
ansible.builtin.template: src=sshd_config dest=/etc/ssh/sshd_config mode=0600
ansible.builtin.template: src=sshd_config.j2 dest=/etc/ssh/sshd_config mode=0600
notify:
- Restart sshd
tags:

19
roles/basessh/templates/sshd_config → roles/basessh/templates/sshd_config.j2
View file

@ -2,30 +2,17 @@ Protocol 2
Port {{ sshd_port }}
{% if ansible_distribution_major_version|int == 7 %}
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
{% else %}
# This system is following system-wide crypto policy. The changes to
# crypto properties (Ciphers, MACs, ...) will not have any effect in
# this or following included files. To override some configuration option,
# write it before this block or include it before this file.
# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
# Also look in /usr/lib/systemd/system/sshd.service for how it is called.
{% endif %}
{% if ansible_distribution_major_version|int >= 9 and ansible_distribution == 'RedHat' %}
{% if ansible_distribution_major_version|int >= 9 %}
# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf
{% endif %}
{% if ansible_distribution_major_version|int >= 36 and ansible_distribution == 'Fedora' %}
# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf
{% endif %}
HostKey /etc/ssh/ssh_host_rsa_key
{% if not ansible_hostname.startswith(('pkgs01','pagure02')) %}
@ -53,10 +40,6 @@ AllowAgentForwarding no
X11Forwarding no
PermitTunnel no
{% if ansible_distribution_major_version|int == 7 %}
UsePrivilegeSeparation sandbox
{% endif %}
# Accept locale-related environment
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT