Inline ssh_allow_user file
This commit is contained in:
parent
e79455efae
commit
f73667ea3c
|
@ -47,6 +47,28 @@
|
||||||
- ssh_allowgroups
|
- ssh_allowgroups
|
||||||
- not ssh_allowusers
|
- not ssh_allowusers
|
||||||
|
|
||||||
|
- name: "Add AllowUsers sshd directive with all users"
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
line: "\nAllowUsers {{ evolinux_users|map(attribute='name')|join(',') }}"
|
||||||
|
insertafter: 'Subsystem'
|
||||||
|
validate: '/usr/sbin/sshd -t -f %s'
|
||||||
|
notify: reload sshd
|
||||||
|
when:
|
||||||
|
- grep_allowusers_ssh.rc == 0
|
||||||
|
- ssh_allowusers
|
||||||
|
- not ssh_allowgroups
|
||||||
|
|
||||||
|
- name: "Append '{{ item.name }}' to AllowUsers sshd directive"
|
||||||
|
replace:
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
regexp: '^(AllowUsers ((?!\b{{ item.name }}\b).)*)$'
|
||||||
|
replace: '\1 {{ item.name }}'
|
||||||
|
validate: '/usr/sbin/sshd -t -f %s'
|
||||||
|
with_dict: "{{ evolinux_users }}"
|
||||||
|
notify: reload sshd
|
||||||
|
when: grep_allowusers_ssh.rc != 0
|
||||||
|
|
||||||
- name: "verify Match User directive"
|
- name: "verify Match User directive"
|
||||||
command: "grep -E '^Match User' /etc/ssh/sshd_config"
|
command: "grep -E '^Match User' /etc/ssh/sshd_config"
|
||||||
changed_when: False
|
changed_when: False
|
||||||
|
@ -57,16 +79,7 @@
|
||||||
- ssh_allowusers
|
- ssh_allowusers
|
||||||
- not ssh_allowgroups
|
- not ssh_allowgroups
|
||||||
|
|
||||||
- name: "Add AllowUsers sshd directive with all users"
|
- name: "Add Match User sshd directive with all users"
|
||||||
lineinfile:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
line: "\nAllowUsers {{ evolinux_users|map(attribute='name')|join(',') }}"
|
|
||||||
insertafter: 'Subsystem'
|
|
||||||
validate: '/usr/sbin/sshd -t -f %s'
|
|
||||||
notify: reload sshd
|
|
||||||
when: grep_allowusers_ssh.rc == 0
|
|
||||||
|
|
||||||
- name: "Add Match User sshd directive with '{{ user.name }}'"
|
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/ssh/sshd_config
|
dest: /etc/ssh/sshd_config
|
||||||
line: "\nMatch User {{ evolinux_users|map(attribute='name')|join(',') }}\n PasswordAuthentication no"
|
line: "\nMatch User {{ evolinux_users|map(attribute='name')|join(',') }}\n PasswordAuthentication no"
|
||||||
|
@ -75,11 +88,15 @@
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
when: grep_matchuser_ssh == 0
|
when: grep_matchuser_ssh == 0
|
||||||
|
|
||||||
- include: ssh_allowusers.yml
|
- name: "Append '{{ item.name }}' to Match User's sshd directive"
|
||||||
vars:
|
replace:
|
||||||
user: "{{ item.value }}"
|
dest: /etc/ssh/sshd_config
|
||||||
|
regexp: '^(Match User ((?!{{ item.name }}).)*)$'
|
||||||
|
replace: '\1,{{ item.name }}'
|
||||||
|
validate: '/usr/sbin/sshd -t -f %s'
|
||||||
with_dict: "{{ evolinux_users }}"
|
with_dict: "{{ evolinux_users }}"
|
||||||
when: (grep_allowusers_ssh.rc != 0) or (grep_matchuser_ssh != 0)
|
notify: reload sshd
|
||||||
|
when: grep_matchuser_ssh.rc != 0
|
||||||
|
|
||||||
- name: disable root login
|
- name: disable root login
|
||||||
replace:
|
replace:
|
||||||
|
|
|
@ -1,17 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- name: "Append '{{ user.name }}' to AllowUsers sshd directive"
|
|
||||||
replace:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: '^(AllowUsers ((?!\b{{ user.name }}\b).)*)$'
|
|
||||||
replace: '\1 {{ user.name }}'
|
|
||||||
validate: '/usr/sbin/sshd -t -f %s'
|
|
||||||
notify: reload sshd
|
|
||||||
|
|
||||||
- name: "Append '{{ user.name }}' to Match User's sshd directive"
|
|
||||||
replace:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: '^(Match User ((?!{{ user.name }}).)*)$'
|
|
||||||
replace: '\1,{{ user.name }}'
|
|
||||||
validate: '/usr/sbin/sshd -t -f %s'
|
|
||||||
notify: reload sshd
|
|
Loading…
Reference in a new issue