Merge pull request #236 from ansible-lockdown/sshd_config_create

Sshd config create
ansible-lockdown · Sep 6, 2024 · 4fb533b · 4fb533b
2 parents 9b076de + 3cdd2a0
commit 4fb533b
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 27 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -962,7 +962,7 @@ rhel9cis_logrotate: "daily"
 # This value, containing the absolute filepath of the produced 'sshd' config file, allows usage of
 # drop-in files('/etc/ssh/ssh_config.d/{ssh_drop_in_name}.conf', supported by RHEL9) when CIS adopts them.
 # Otherwise, the default value is '/etc/ssh/ssh_config'.
-rhel9_cis_sshd_config_file: /etc/ssh/sshd_config
+rhel9cis_sshd_config_file: /etc/ssh/sshd_config
 
 ## Controls:
 ## - 5.2.4  - Ensure SSH access is limited

diff --git a/tasks/prelim.yml b/tasks/prelim.yml
@@ -242,18 +242,16 @@
 # Added to ensure ssh drop in file exists if not default /etc/ssh/sshd_config
 - name: "PRELIM | Section 5.2 | SSH"
   ansible.builtin.file:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       owner: root
       group: root
       mode: '0600'
       state: touch
   when:
-      - rhel9_cis_sshd_config_file != '/etc/ssh/sshd_config'
+      - rhel9cis_sshd_config_file != '/etc/ssh/sshd_config'
       - "'openssh-server' in ansible_facts.packages"
   tags:
-      - ssh
-      - level1_server
-      - level1_workstation
+      - always
 
 - name: "PRELIM | 5.3.4 | Find all sudoers files."
   ansible.builtin.shell: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"

diff --git a/tasks/section_5/cis_5.2.x.yml b/tasks/section_5/cis_5.2.x.yml
@@ -77,7 +77,7 @@
   block:
       - name: "5.2.4 | PATCH | Ensure SSH access is limited | Add line to sshd_config for allowusers"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^AllowUsers"
             line: "AllowUsers {{ rhel9cis_sshd['allowusers'] }}"
             validate: sshd -t -f %s
@@ -86,7 +86,7 @@
 
       - name: "5.2.4 | PATCH | Ensure SSH access is limited | Add line to sshd_config for allowgroups"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^AllowGroups"
             line: "AllowGroups {{ rhel9cis_sshd['allowgroups'] }}"
             validate: sshd -t -f %s
@@ -95,7 +95,7 @@
 
       - name: "5.2.4 | PATCH | Ensure SSH access is limited | Add line to sshd_config for denyusers"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^DenyUsers"
             line: "DenyUsers {{ rhel9cis_sshd['denyusers'] }}"
             validate: sshd -t -f %s
@@ -104,7 +104,7 @@
 
       - name: "5.2.4 | PATCH | Ensure SSH access is limited | Add line to sshd_config for denygroups"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^DenyGroups"
             line: "DenyGroups {{ rhel9cis_sshd['denygroups'] }}"
             validate: sshd -t -f %s
@@ -121,7 +121,7 @@
 
 - name: "5.2.5 | PATCH | Ensure SSH LogLevel is appropriate"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#LogLevel|^LogLevel"
       line: 'LogLevel {{ rhel9cis_ssh_loglevel }}'
       validate: sshd -t -f %s
@@ -137,7 +137,7 @@
 
 - name: "5.2.6 | PATCH | Ensure SSH PAM is enabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#UsePAM|^UsePAM"
       line: 'UsePAM yes'
       validate: sshd -t -f %s
@@ -155,7 +155,7 @@
   block:
       - name: "5.2.7 | PATCH | Ensure SSH root login is disabled | config file"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^#PermitRootLogin|^PermitRootLogin"
             line: 'PermitRootLogin no'
             validate: sshd -t -f %s
@@ -176,7 +176,7 @@
 
 - name: "5.2.8 | PATCH | Ensure SSH HostbasedAuthentication is disabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#HostbasedAuthentication|^HostbasedAuthentication"
       line: 'HostbasedAuthentication no'
       validate: sshd -t -f %s
@@ -192,7 +192,7 @@
 
 - name: "5.2.9 | PATCH | Ensure SSH PermitEmptyPasswords is disabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#PermitEmptyPasswords|^PermitEmptyPasswords"
       line: 'PermitEmptyPasswords no'
       validate: sshd -t -f %s
@@ -208,7 +208,7 @@
 
 - name: "5.2.10 | PATCH | Ensure SSH PermitUserEnvironment is disabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#PermitUserEnvironment|^PermitUserEnvironment"
       line: 'PermitUserEnvironment no'
       validate: sshd -t -f %s
@@ -224,7 +224,7 @@
 
 - name: "5.2.11 | PATCH | Ensure SSH IgnoreRhosts is enabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#IgnoreRhosts|^IgnoreRhosts"
       line: 'IgnoreRhosts yes'
       validate: sshd -t -f %s
@@ -243,7 +243,7 @@
 
       - name: "5.2.12 | PATCH | Ensure SSH X11 forwarding is disabled | config file"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: "^#X11Forwarding|^X11Forwarding"
             line: 'X11Forwarding no'
             validate: sshd -t -f %s
@@ -267,7 +267,7 @@
 
 - name: "5.2.13 | PATCH | Ensure SSH AllowTcpForwarding is disabled"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#AllowTcpForwarding|^AllowTcpForwarding"
       line: 'AllowTcpForwarding no'
       validate: sshd -t -f %s
@@ -304,7 +304,7 @@
 
 - name: "5.2.15 | PATCH | Ensure SSH warning banner is configured"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: '^Banner'
       line: 'Banner /etc/issue.net'
   notify: Restart sshd
@@ -319,7 +319,7 @@
 
 - name: "5.2.16 | PATCH | Ensure SSH MaxAuthTries is set to 4 or less"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: '^(#)?MaxAuthTries \d'
       line: 'MaxAuthTries 4'
       validate: sshd -t -f %s
@@ -335,7 +335,7 @@
 
 - name: "5.2.17 | PATCH | Ensure SSH MaxStartups is configured"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#MaxStartups|^MaxStartups"
       line: 'MaxStartups 10:30:60'
       validate: sshd -t -f %s
@@ -351,7 +351,7 @@
 
 - name: "5.2.18 | PATCH | Ensure SSH MaxSessions is set to 10 or less"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#MaxSessions|^MaxSessions"
       line: 'MaxSessions {{ rhel9cis_ssh_maxsessions }}'
       validate: sshd -t -f %s
@@ -367,7 +367,7 @@
 
 - name: "5.2.19 | PATCH | Ensure SSH LoginGraceTime is set to one minute or less"
   ansible.builtin.lineinfile:
-      path: "{{ rhel9_cis_sshd_config_file }}"
+      path: "{{ rhel9cis_sshd_config_file }}"
       regexp: "^#LoginGraceTime|^LoginGraceTime"
       line: "LoginGraceTime {{ rhel9cis_sshd['logingracetime'] }}"
       validate: sshd -t -f %s
@@ -385,15 +385,15 @@
   block:
       - name: "5.2.20 | PATCH | Ensure SSH Idle Timeout Interval is configured | Add line in sshd_config for ClientAliveInterval"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: '^ClientAliveInterval'
             line: "ClientAliveInterval {{ rhel9cis_sshd['clientaliveinterval'] }}"
             validate: sshd -t -f %s
         notify: Restart sshd
 
       - name: "5.2.20 | PATCH | Ensure SSH Idle Timeout Interval is configured | Ensure SSH ClientAliveCountMax set to <= 3"
         ansible.builtin.lineinfile:
-            path: "{{ rhel9_cis_sshd_config_file }}"
+            path: "{{ rhel9cis_sshd_config_file }}"
             regexp: '^ClientAliveCountMax'
             line: "ClientAliveCountMax {{ rhel9cis_sshd['clientalivecountmax'] }}"
             validate: sshd -t -f %s

diff --git a/templates/ansible_vars_goss.yml.j2 b/templates/ansible_vars_goss.yml.j2
@@ -462,7 +462,7 @@ rhel9cis_syslog: {{ rhel9cis_syslog }}
 
 # Section 5
 # This will allow use of drop in files when CIS adopts them.
-rhel9_cis_sshd_config_file: {{ rhel9_cis_sshd_config_file }}
+rhel9_cis_sshd_config_file: {{ rhel9cis_sshd_config_file }}
 
 ## 5.2.4 Note the following to understand precedence and layout
 rhel9cis_sshd_limited: false