34 lines
1006 B
YAML
34 lines
1006 B
YAML
|
---
|
|||
|
|
- name: user | disable SSH access for root
|
|||
|
|
replace:
|
|||
|
|
dest: /etc/ssh/sshd_config
|
|||
|
|
regexp: '^PermitRootLogin (yes|without-password|prohibit-password)'
|
|||
|
|
replace: "PermitRootLogin no"
|
|||
|
|
validate: '/usr/sbin/sshd -T -f %s'
|
|||
|
|
notify: reload shd
|
|||
|
|
|
|||
|
|
#- name: user | verify AllowUsers directive
|
|||
|
|
# command: "grep -E '^AllowUsers' /etc/ssh/sshd_config"
|
|||
|
|
# changed_when: False
|
|||
|
|
# failed_when: False
|
|||
|
|
# register: grep_allowusers_ssh
|
|||
|
|
#
|
|||
|
|
#- name: "add AllowUsers sshd directive"
|
|||
|
|
# lineinfile:
|
|||
|
|
# dest: /etc/ssh/sshd_config
|
|||
|
|
# line: "\nAllowUsers "
|
|||
|
|
# insertafter: 'Subsystem'
|
|||
|
|
# validate: '/usr/sbin/sshd -T -f %s'
|
|||
|
|
# register: allowusers_added
|
|||
|
|
# when: grep_allowusers_ssh.rc != 0
|
|||
|
|
|
|||
|
|
#- name: "append username to AllowUsers sshd directive"
|
|||
|
|
# replace:
|
|||
|
|
# dest: /etc/ssh/sshd_config
|
|||
|
|
# regexp: '^(AllowUsers(?!.*\b{{ item.key }}\b).*)$'
|
|||
|
|
# replace: '\1 {{ item.key }}'
|
|||
|
|
# validate: '/usr/sbin/sshd -T -f %s'
|
|||
|
|
# with_dict: "{{ user.name }}"
|
|||
|
|
# when: allowusers_added
|
|||
|
|
# notify: "reload SSH"
|