41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
---
|
|
- name: Adjust SSHD config
|
|
ansible.builtin.lineinfile:
|
|
path: /mnt/etc/ssh/sshd_config
|
|
regexp: ^\s*#?{{ item.option }}\s+.*$
|
|
line: "{{ item.option }} {{ item.value }}"
|
|
loop: "{{ cis_cfg.sshd_options }}"
|
|
loop_control:
|
|
label: "{{ item.option }}"
|
|
|
|
- name: Detect target OpenSSH version
|
|
ansible.builtin.shell: >-
|
|
set -o pipefail && {{ chroot_command }} ssh -V 2>&1 | grep -oP 'OpenSSH_\K[0-9]+\.[0-9]+'
|
|
args:
|
|
executable: /bin/bash
|
|
register: cis_sshd_openssh_version
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Append CIS specific configurations to sshd_config
|
|
vars:
|
|
cis_sshd_has_mlkem: "{{ (cis_sshd_openssh_version.stdout | default('0.0') is version('9.9', '>=')) }}"
|
|
cis_sshd_kex: >-
|
|
{{
|
|
(['mlkem768x25519-sha256'] if cis_sshd_has_mlkem | bool else [])
|
|
+ ['curve25519-sha256@libssh.org', 'ecdh-sha2-nistp521', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp256']
|
|
}}
|
|
ansible.builtin.blockinfile:
|
|
path: /mnt/etc/ssh/sshd_config
|
|
marker: "# {mark} CIS SSH HARDENING"
|
|
block: |-
|
|
## CIS Specific
|
|
### Ciphers and keying ###
|
|
RekeyLimit 512M 6h
|
|
KexAlgorithms {{ cis_sshd_kex | join(',') }}
|
|
Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
|
|
###########################
|
|
AllowStreamLocalForwarding no
|
|
PermitUserRC no
|