From 0b878ece70250b6d0bb1a8f0725b9ade984afd3b Mon Sep 17 00:00:00 2001 From: nazunalika Date: Thu, 2 Jun 2022 14:47:36 -0700 Subject: [PATCH] add 9 --- .../custom/sssd-rocky/RedHat-9-nsswitch.conf | 6 + .../custom/sssd-rocky/RedHat-9-system-auth | 40 ++++ .../custom/sssd-rocky/Rocky-9-nsswitch.conf | 1 + .../custom/sssd-rocky/Rocky-9-system-auth | 1 + tasks/ssh_config.yml | 37 ++++ .../etc/audit/rules.d/collection.rules.j2 | 97 ++++++++++ templates/etc/chrony.conf.j2 | 37 ++++ templates/etc/modprobe.d/cis.conf.j2 | 4 + templates/etc/resolv.conf.j2 | 3 + templates/etc/ssh/CentOS-8-sshd_config.j2 | 1 + templates/etc/ssh/CentOS-9-sshd_config.j2 | 1 + templates/etc/ssh/RedHat-8-sshd_config.j2 | 174 ++++++++++++++++++ templates/etc/ssh/RedHat-9-sshd_config.j2 | 130 +++++++++++++ templates/etc/ssh/Rocky-8-sshd_config.j2 | 1 + templates/etc/ssh/Rocky-9-sshd_config.j2 | 1 + vars/RedHat.yml | 4 + 16 files changed, 538 insertions(+) create mode 100644 files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf create mode 100644 files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth create mode 120000 files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf create mode 120000 files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth create mode 100644 templates/etc/audit/rules.d/collection.rules.j2 create mode 100644 templates/etc/chrony.conf.j2 create mode 100644 templates/etc/modprobe.d/cis.conf.j2 create mode 100644 templates/etc/resolv.conf.j2 create mode 120000 templates/etc/ssh/CentOS-8-sshd_config.j2 create mode 120000 templates/etc/ssh/CentOS-9-sshd_config.j2 create mode 100644 templates/etc/ssh/RedHat-8-sshd_config.j2 create mode 100644 templates/etc/ssh/RedHat-9-sshd_config.j2 create mode 120000 templates/etc/ssh/Rocky-8-sshd_config.j2 create mode 120000 templates/etc/ssh/Rocky-9-sshd_config.j2 diff --git a/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf b/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf new file mode 100644 index 0000000..91c9fe9 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf @@ -0,0 +1,6 @@ +passwd: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-passwd"} +group: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-group"} +netgroup: sss files {exclude if "with-custom-netgroup"} +automount: sss files {exclude if "with-custom-automount"} +services: sss files {exclude if "with-custom-services"} +sudoers: files sss {include if "with-sudo"} diff --git a/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth b/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth new file mode 100644 index 0000000..6e17e8a --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth @@ -0,0 +1,40 @@ +{imply "with-smartcard" if "with-smartcard-required"} +auth required pam_env.so +auth required pam_faildelay.so delay=2000000 +auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900 {include if "with-faillock"} +auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"} +auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"} +auth sufficient pam_fprintd.so {include if "with-fingerprint"} +auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} +auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular +auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"} +auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"} +auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"} +auth sufficient pam_unix.so {if not "without-nullok":nullok} try_first_pass +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular +auth sufficient pam_sss.so forward_pass +auth required pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900 {include if "with-faillock"} +auth required pam_deny.so + +account required pam_access.so {include if "with-pamaccess"} +account required pam_faillock.so {include if "with-faillock"} +account required pam_unix.so +account sufficient pam_localuser.so {exclude if "with-files-access-provider"} +account sufficient pam_usertype.so issystem +account [default=bad success=ok user_unknown=ignore] pam_sss.so +account required pam_permit.so + +password requisite pam_pwquality.so try_first_pass local_users_only minlen=14 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 retry=3 +password requisite pam_pwhistory.so use_authok remember=5 +password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} try_first_pass use_authtok +password sufficient pam_sss.so use_authtok +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +-session optional pam_systemd.so +session optional pam_oddjob_mkhomedir.so umask=0077 {include if "with-mkhomedir"} +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so +session optional pam_sss.so diff --git a/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf b/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf new file mode 120000 index 0000000..1ff8004 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf @@ -0,0 +1 @@ +RedHat-9-nsswitch.conf \ No newline at end of file diff --git a/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth b/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth new file mode 120000 index 0000000..cbddfcd --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth @@ -0,0 +1 @@ +RedHat-9-system-auth \ No newline at end of file diff --git a/tasks/ssh_config.yml b/tasks/ssh_config.yml index ab7dd0f..523c44d 100644 --- a/tasks/ssh_config.yml +++ b/tasks/ssh_config.yml @@ -22,6 +22,43 @@ validate: /usr/sbin/sshd -t -f %s backup: true notify: restart_sshd + + - name: Ensure sshd_config.d dir exists + ansible.builtin.file: + state: directory + path: "/etc/ssh/sshd_config.d" + owner: root + group: root + mode: '0700' + notify: restart_sshd + + - name: Default Modular Configuration + when: + - (ansible_facts['distribution'] == 'Fedora') or + (ansible_facts['distribution'] in el_distro_name and ansible_facts['distribution_major_version']|int >= 9) + block: + - name: Modular configuration (redhat) + template: + src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-50-redhat.conf.j2" + dest: "{{ ssh_modular_config }}" + owner: root + group: root + mode: '0600' + validate: /usr/sbin/sshd -t -f %s + backup: yes + notify: restart_sshd + + - name: Custom Modular Configuration + template: + src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-60-shootthej.conf.j2" + dest: "/etc/ssh/sshd_config.d/60-shootthej.conf" + owner: root + group: root + mode: '0600' + validate: /usr/sbin/sshd -t -f %s + backup: yes + notify: restart_sshd + rescue: - name: Print errors for configuration and validation debug: diff --git a/templates/etc/audit/rules.d/collection.rules.j2 b/templates/etc/audit/rules.d/collection.rules.j2 new file mode 100644 index 0000000..bfd4119 --- /dev/null +++ b/templates/etc/audit/rules.d/collection.rules.j2 @@ -0,0 +1,97 @@ +# Ignore CWD logs +-a exclude,always -F msgtype=CWD + +-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change +-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change +-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change +-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change +-w /etc/localtime -p wa -k time-change + +## Records when events occur that modify user and group passwords and ID's +{% for y in audit_identity_list %} +-w {{ y }} -p wa -k identity +{% endfor %} + +## Records changes to network environment files or system calls +-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale +-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale +-w /etc/issue -p wa -k system-locale +-w /etc/issue.net -p wa -k system-locale +-w /etc/hosts -p wa -k system-locale +-w /etc/hostname -p wa -k system-locale +-w /etc/sysconfig/network -p wa -k system-locale +-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale + +## Monitors SELinux Mandatory Access Controls +-w /etc/selinux/ -p wa -k MAC-policy +-w /usr/share/selinux/ -p wa -k MAC-policy + +## Monitors login/logout/failed login events +# To be fair, these are normally logged in /var/log/secure +{% for y in audit_logins %} +-w {{ y }} -p wa -k logins +{% endfor %} + +## Monitor session initiation events +## This will track file changes within sessions +{% for y in audit_session %} +-w {{ y }} -p wa -k session +{% endfor %} + +## Monitor changes for files for UID's above {{ audit_auid }} +# You can take this out if you are on a non-PCI system +-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod +-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>={{ audit_auid }} -F auid!=4294967295 -k access +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>={{ audit_auid }} -F auid!=4294967295 -k access +-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>={{ audit_auid }} -F auid!=4294967295 -k access +-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>={{ audit_auid }} -F auid!=4294967295 -k access + +## Monitors mounting events for users +# You can probably take these out +-a always,exit -F arch=b64 -S mount -F auid>={{ audit_auid }} -F auid!=4294967295 -k mounts +-a always,exit -F arch=b32 -S mount -F auid>={{ audit_auid }} -F auid!=4294967295 -k mounts +## Collect file deletion events by a user +-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>={{ audit_auid }} -F auid!=4294967295 -k delete +-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>={{ audit_auid }} -F auid!=4294967295 -k delete +## Collect changes to System Administration Scope +# Note: This only records /etc/sudoers and doesn't watch /etc/sudoers.d +-w /etc/sudoers -p wa -k scope +-w /etc/sudoers.d -p wa -k scope +## Collect System Administrator Actions (sudolog) +-w /var/log/sudo.log -p wa -k actions +## Collect Kernel Module Loading and Unloading +-w /sbin/kmod -p x -k modules +-w /sbin/insmod -p x -k modules +-w /sbin/rmmod -p x -k modules +-w /sbin/modprobe -p x -k modules +-a always,exit -F arch=b64 -S init_module,finit_module -S delete_module -k modules +-a always,exit -F arch=b32 -S init_module,finit_module -S delete_module -k modules + +{% for y in audit_suid_list %} +-a always,exit -F path={{ y }} -F perm=x -F auid>={{ audit_auid }} -F auid!=4294967295 -k privileged +{% endfor %} + +# Is someone messing with our audit logs? +-w /var/log/audit/ -k audit-logs + +-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=4294967295 -F key=audit-logs +-a always,exit -F path=/usr/sbin/ausearch -F perm=x -F key=audit-logs +-a always,exit -F path=/usr/sbin/aureport -F perm=x -F key=audit-logs +-a always,exit -F path=/usr/sbin/aulast -F perm=x -F key=audit-logs +-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -F key=audit-logs +-a always,exit -F path=/usr/sbin/auvirt -F perm=x -F key=audit-logs + +# Privilege elevation +-a always,exit -F arch=b64 -S setuid -Fa0=0 -F exe={{ bin_su }} -F key=privileged +-a always,exit -F arch=b32 -S setuid -Fa0=0 -F exe={{ bin_su }} -F key=privileged +-a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe={{ bin_sudo }} -F key=privileged +-a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe={{ bin_sudo }} -F key=privileged +-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=privileged +-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=privileged + +-e 2 diff --git a/templates/etc/chrony.conf.j2 b/templates/etc/chrony.conf.j2 new file mode 100644 index 0000000..b3384c3 --- /dev/null +++ b/templates/etc/chrony.conf.j2 @@ -0,0 +1,37 @@ +# Remote servers for client association. +{% for s in chrony_timeservers %} +server {{ s }} iburst {% if loop.first %}prefer{% endif %} +{% endfor %} + +# Ignore stratum in source selection. +stratumweight 0 + +# Record the rate at which the system clock gains/losses time. +driftfile {{ chrony_homedir }}/drift + +# Allow the system clock to be stepped in the first three updates +# if its offset is larger than 1.0 second. +makestep 1.0 3 + +# If chrony_server=true allow clients to connect +{% if chrony_server is sameas true %} +allow {{ chrony_allow_cidr }} +bindaddress 0.0.0.0 +{% else %} +# Else If Client Deny NTP client access. +deny all +{% endif %} + +# Allow cmdaccess for localhost only (monitoring sometimes requires this to be opened to mgmt interface) +bindcmdaddress 127.0.0.1 +bindcmdaddress ::1 +cmdallow + +# Send a message to syslog if a clock adjustment is larger than 0.5 seconds. +logchange 0.5 + +# Specify directory for log files. +logdir {{ chrony_logdir }} + +# Enable kernel synchronization of the real-time clock (RTC). +rtcsync diff --git a/templates/etc/modprobe.d/cis.conf.j2 b/templates/etc/modprobe.d/cis.conf.j2 new file mode 100644 index 0000000..55dddfa --- /dev/null +++ b/templates/etc/modprobe.d/cis.conf.j2 @@ -0,0 +1,4 @@ +# Generated by Ansible +{% for fs in modprobe_unused_filesystems %} +install {{ fs }} /bin/true +{% endfor %} diff --git a/templates/etc/resolv.conf.j2 b/templates/etc/resolv.conf.j2 new file mode 100644 index 0000000..dd91a8d --- /dev/null +++ b/templates/etc/resolv.conf.j2 @@ -0,0 +1,3 @@ +# Generated by Ansible +search {{ ipareplica_domain }} +nameserver {{ ipa_dns_master }} diff --git a/templates/etc/ssh/CentOS-8-sshd_config.j2 b/templates/etc/ssh/CentOS-8-sshd_config.j2 new file mode 120000 index 0000000..33d30c5 --- /dev/null +++ b/templates/etc/ssh/CentOS-8-sshd_config.j2 @@ -0,0 +1 @@ +RedHat-8-sshd_config.j2 \ No newline at end of file diff --git a/templates/etc/ssh/CentOS-9-sshd_config.j2 b/templates/etc/ssh/CentOS-9-sshd_config.j2 new file mode 120000 index 0000000..968dc7b --- /dev/null +++ b/templates/etc/ssh/CentOS-9-sshd_config.j2 @@ -0,0 +1 @@ +RedHat-9-sshd_config.j2 \ No newline at end of file diff --git a/templates/etc/ssh/RedHat-8-sshd_config.j2 b/templates/etc/ssh/RedHat-8-sshd_config.j2 new file mode 100644 index 0000000..f5dc70a --- /dev/null +++ b/templates/etc/ssh/RedHat-8-sshd_config.j2 @@ -0,0 +1,174 @@ +# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# If you want to change the port on a SELinux system, you have to tell +# SELinux about this change. +# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER +# +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# System-wide Crypto policy: +# This system is following system-wide crypto policy. The changes to +# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any +# effect here. They will be overridden by command-line options passed on +# the server start up. +# To opt out, uncomment a line with redefinition of CRYPTO_POLICY= +# variable in /etc/sysconfig/sshd to overwrite the policy. +# For more information, see manual page for update-crypto-policies(8). + +# Logging +#SyslogFacility AUTH +SyslogFacility AUTHPRIV +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin yes +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes +#ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no +#KerberosUseKuserok yes + +# GSSAPI options +GSSAPIAuthentication yes +GSSAPICleanupCredentials no +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no +#GSSAPIEnablek5users no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +# WARNING: 'UsePAM no' is not supported in Fedora and may cause several +# problems. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes + +# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd, +# as it is more configurable and versatile than the built-in version. +PrintMotd no + +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#ShowPatchLevel no +#UseDNS no +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Accept locale-related environment variables +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS + +# override default of no subsystems +Subsystem sftp /usr/libexec/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server + +################################################################################ +# Below managed by {{ ansible_managed }} +# +Banner /etc/rockybanner +PermitRootLogin no +X11Forwarding no +LoginGraceTime 1m + +# FIPS Compliant +# This has no effect in RHEL 8 or Fedora. However, in the case of compliance +# higher than that of PCI, it may be a good idea to override it. +MACs hmac-sha2-512,hmac-sha2-256 +Ciphers aes256-ctr,aes192-ctr,aes128-ctr + +# IPA +AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys +AuthorizedKeysCommandUser nobody +ChallengeResponseAuthentication yes +PasswordAuthentication no + +Include /etc/ssh/sshd_config.d/*.conf + +{% if 'gitlabservers' in group_names %} +AllowUsers git@* *@10.* +{% endif %} diff --git a/templates/etc/ssh/RedHat-9-sshd_config.j2 b/templates/etc/ssh/RedHat-9-sshd_config.j2 new file mode 100644 index 0000000..d0717f9 --- /dev/null +++ b/templates/etc/ssh/RedHat-9-sshd_config.j2 @@ -0,0 +1,130 @@ +# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +# To modify the system-wide sshd configuration, create a *.conf file under +# /etc/ssh/sshd_config.d/ which will be automatically included below +Include /etc/ssh/sshd_config.d/*.conf + +# If you want to change the port on a SELinux system, you have to tell +# SELinux about this change. +# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER +# +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#KbdInteractiveAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no +#KerberosUseKuserok yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no +#GSSAPIEnablek5users no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +# WARNING: 'UsePAM no' is not supported in Fedora and may cause several +# problems. +#UsePAM no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/templates/etc/ssh/Rocky-8-sshd_config.j2 b/templates/etc/ssh/Rocky-8-sshd_config.j2 new file mode 120000 index 0000000..33d30c5 --- /dev/null +++ b/templates/etc/ssh/Rocky-8-sshd_config.j2 @@ -0,0 +1 @@ +RedHat-8-sshd_config.j2 \ No newline at end of file diff --git a/templates/etc/ssh/Rocky-9-sshd_config.j2 b/templates/etc/ssh/Rocky-9-sshd_config.j2 new file mode 120000 index 0000000..968dc7b --- /dev/null +++ b/templates/etc/ssh/Rocky-9-sshd_config.j2 @@ -0,0 +1 @@ +RedHat-9-sshd_config.j2 \ No newline at end of file diff --git a/vars/RedHat.yml b/vars/RedHat.yml index 2af88ed..16570c8 100644 --- a/vars/RedHat.yml +++ b/vars/RedHat.yml @@ -1,6 +1,10 @@ # Variables for our common module for RedHat --- +el_distro_name: + - CentOS + - Rocky + bin_su: /usr/bin/su bin_sudo: /usr/bin/sudo