ansible_roles
/
base
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
main
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '89618d5dc2'
${ noResults }
base/tasks/sshd.yml

33 lines
959 B
YAML
Raw Normal View History Unescape Escape

Disallow Password Auth for SSH
5 years ago
---
- name: Restrict SSH to public key authentication
Formatting plus notify in sshd; allow username instead of only name in variables; use which instead of command - Formatting + notify in sshd config - Use which instead of command (because of problems with sudo [no such file or directory]) - Allow using username instead of name in variables (because of compliance with oh-my-zsh role (https://github.com/gantsign/ansible-role-oh-my-zsh))
5 years ago
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?AuthenticationMethods '
line: 'AuthenticationMethods publickey'
ssh: allow to enable password auth
5 years ago
when: not ssh_allow_password
Formatting plus notify in sshd; allow username instead of only name in variables; use which instead of command - Formatting + notify in sshd config - Use which instead of command (because of problems with sudo [no such file or directory]) - Allow using username instead of name in variables (because of compliance with oh-my-zsh role (https://github.com/gantsign/ansible-role-oh-my-zsh))
5 years ago
notify: reload sshd service
- name: Disable SSH password authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PasswordAuthentication '
line: 'PasswordAuthentication no'
ssh: allow to enable password auth
5 years ago
when: not ssh_allow_password
notify: reload sshd service
- name: Restrict SSH to public key and password authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?AuthenticationMethods '
line: 'AuthenticationMethods publickey password'
when: ssh_allow_password
notify: reload sshd service
- name: Enable SSH password authentication
lineinfile:
path: /etc/ssh/sshd_config
regexp: '^#?PasswordAuthentication '
line: 'PasswordAuthentication yes'
when: ssh_allow_password
notify: reload sshd service