dotfiles/roles/system/sshd/tasks/main.yml
Matej Focko fc34091749
fix(system/sshd): handle firewall
Signed-off-by: Matej Focko <me@mfocko.xyz>
2024-07-10 15:16:47 +02:00

56 lines
1.3 KiB
YAML

---
- name: Packages
ansible.builtin.include_tasks: install.yml
tags: install
- name: Set sshd systemd unit for Ubuntu
ansible.builtin.set_fact:
system_sshd_unit: ssh
when: ansible_distribution == "Ubuntu"
- name: Set sshd systemd unit for co-Ubuntu
ansible.builtin.set_fact:
system_sshd_unit: sshd
when: ansible_distribution != "Ubuntu"
- name: Enable SSH server
ansible.builtin.service:
name: "{{ system_sshd_unit }}"
enabled: true
- name: Harden the SSH config
ansible.builtin.template:
src: templates/10-harden.conf
dest: /etc/ssh/sshd_config.d/10-harden.conf
mode: 0600
owner: root
group: root
notify: "Restart SSH server"
- name: Notify SELinux about new port
community.general.seport:
ports: "{{ system_sshd_port }}"
proto: "tcp"
setype: "ssh_port_t"
state: "present"
when: ansible_facts.selinux.status == 'enabled'
- name: Enable the new SSH port on firewall
ansible.posix.firewalld:
port: "{{ system_sshd_port }}/tcp"
immediate: true
permanent: true
state: enabled
notify: "Restart SSH server"
tags: firewall
- name: Disable the default SSH port
ansible.posix.firewalld:
service: ssh
permanent: true
state: disabled
tags: firewall
- name: Set trusted CA
ansible.builtin.include_tasks: trusted_ca.yml
when: system_sshd_auth_trusted_ca