wip commit to conf.d

tasks/configuration-sshd.yml

@@ -0,0 +1,26 @@
+---
+
+- name: configure sshd in /etc/ssh/sshd_config
+  ansible.builtin.template:
+    src: '{{ lookup("first_found", __ssh_sshd_config_templates) }}'
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: 0644
+    validate: /usr/sbin/sshd -t -f %s
+  become: yes
+  register: __sshd_configuration
+
+- name: configure sshd in /etc/ssh/sshd_config.d/10-ansible.conf
+  ansible.builtin.template:
+    src: '{{ lookup("first_found", __ssh_sshd_config_d_templates) }}'
+    dest: /etc/ssh/sshd_config.d/10-ansible.conf
+    owner: root
+    group: root
+    mode: 0600
+    validate: /usr/sbin/sshd -t -f %s
+  become: yes
+  when: __ssh_has_conf_d
+  register: __sshd_configuration_conf_d
+
+...

tasks/main.yml

@@ -128,42 +128,11 @@
 # sshd_config
 # -----------------------------------------------------------------------------
 
-- name: deploy SSH daemon configuration
-  ansible.builtin.template:
-    src: '{{ lookup("first_found", __ssh_sshd_config_templates) }}'
-    dest: /etc/ssh/sshd_config
-    owner: root
-    group: root
-    mode: 0644
-    validate: /usr/sbin/sshd -t -f %s
-  become: yes
-  register: __sshd_configuration
-  tags:
-    - ssh-banner
-    - ssh-sshd-config
-
-- name: do we need conf.d
-  ansible.builtin.set_fact:
-    __ssh_sshd_config_d_enabled: '{{ __ssh_os_version == "redhat_9" }}'
-
-- name: show conf.d enabled
-  ansible.builtin.debug:
-    var: __ssh_sshd_config_d_enabled
-  when: ansible_check_mode | bool
-
-- name: deploy SSH daemon configuration to conf.d
-  ansible.builtin.template:
-    src: '{{ lookup("first_found", __ssh_sshd_config_d_templates) }}'
-    dest: /etc/ssh/sshd_config.d/10-ansible.conf
-    owner: root
-    group: root
-    mode: 0600
-    validate: /usr/sbin/sshd -t -f %s
-  become: yes
-  when: __ssh_sshd_config_d_enabled
-  register: __sshd_configuration_conf_d
+- name: ssh server configuration
+  ansible.builtin.import_tasks: configuration-sshd.yml
   tags:
     - ssh-banner
+    - ssh-config
     - ssh-sshd-config
 
 # -----------------------------------------------------------------------------

tasks/preflight-configuration.yml

@@ -0,0 +1,29 @@
+---
+
+- name: get current sshd configuration /etc/ssh/sshd_config
+  ansible.builtin.slurp:
+    src: /etc/ssh/sshd_config.pacnew
+  register: __ssh_etc_ssh_sshd_config_raw
+
+- name: parse sshd configuration
+  ansible.builtin.set_fact:
+    __ssh_etc_ssh_sshd_config: >-
+      {{
+        (__ssh_etc_ssh_sshd_config_raw.content | b64decode).splitlines()
+      }}
+
+- name: show sshd configuration
+  ansible.builtin.debug:
+    var: __ssh_etc_ssh_sshd_config
+
+- name: assert sshd configuration contains the include
+  ansible.builtin.assert:
+    that: >-
+      'Include /etc/ssh/sshd_config.d/*.conf' in __ssh_etc_ssh_sshd_config
+    success_msg: >-
+      `/etc/ssh/sshd_config` contains `Include /etc/ssh/sshd_config.d/*.conf`.
+    fail_msg: >-
+      `/etc/ssh/sshd_config` does not contain `Include
+      /etc/ssh/sshd_config.d/*.conf`.
+
+...

templates/sshd_config_archlinux.conf

@@ -1,4 +1,5 @@
-# {{ ansible_managed }}
+# Include drop-in configurations
+Include /etc/ssh/sshd_config.d/*.conf
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -15,64 +16,26 @@
 #ListenAddress 0.0.0.0
 #ListenAddress ::
 
-{% if ssh_host_keys is defined %}
-{% for key in ssh_host_keys %}
-HostKey {{ key }}
-{% endfor %}
-{% else %}
 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key
 #HostKey /etc/ssh/ssh_host_ed25519_key
-{% endif %}
-{% if ssh_host_key_algorithms is defined %}
-
-HostKeyAlgorithms {{ ssh_host_key_algorithms | join(',') }}
-{% endif %}
 
 # Ciphers and keying
 #RekeyLimit default none
-{% if ssh_ciphers is defined %}
-Ciphers {{ ssh_ciphers | join(',') }}
-{% endif %}
-{% if ssh_kex_algorithms is defined %}
-KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
-{% endif %}
-{% if ssh_macs is defined %}
-MACs {{ ssh_macs | join(',') }}
-{% endif %}
 
 # Logging
 #SyslogFacility AUTH
-{% if ssh_log_level is defined %}
-LogLevel {{ ssh_log_level }}
-{% else %}
 #LogLevel INFO
-{% endif %}
 
 # Authentication:
 
 #LoginGraceTime 2m
-{% if ssh_permit_root_login is defined %}
-PermitRootLogin {{ ssh_permit_root_login }}
-{% else %}
 #PermitRootLogin prohibit-password
-{% endif %}
-{% if ssh_strict_modes is defined %}
-StrictModes {{ ssh_strict_modes | ternary('yes', 'no') }}
-{% else %}
 #StrictModes yes
-{% endif %}
 #MaxAuthTries 6
 #MaxSessions 10
 
-{% if ssh_pubkey_authentication is defined %}
-PubkeyAuthentication {{ ssh_pubkey_authentication | ternary('yes', 'no') }}
-{% else %}
 #PubkeyAuthentication yes
-{% endif %}
-{% if ssh_pubkey_accepted_key_types is defined %}
-PubkeyAcceptedKeyTypes {{ ssh_pubkey_accepted_key_types | join(',') }}
-{% endif %}
 
 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
 # but this is overridden so installations will only check .ssh/authorized_keys
@@ -92,23 +55,11 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-{% if ssh_password_authentication is defined %}
-PasswordAuthentication {{ ssh_password_authentication | ternary('yes', 'no') }}
-{% else %}
 #PasswordAuthentication yes
-{% endif %}
-{% if ssh_permit_empty_password is defined %}
-PermitEmptyPasswords {{ ssh_permit_empty_password | ternary('yes', 'no') }}
-{% else %}
 #PermitEmptyPasswords no
-{% endif %}
 
 # Change to no to disable s/key passwords
-{% if ssh_challenge_response_authentication is defined %}
-ChallengeResponseAuthentication {{ ssh_challenge_response_authentication | ternary('yes', 'no') }}
-{% else %}
-ChallengeResponseAuthentication no
-{% endif %}
+#KbdInteractiveAuthentication yes
 
 # Kerberos options
 #KerberosAuthentication no
@@ -117,48 +68,28 @@ ChallengeResponseAuthentication no
 #KerberosGetAFSToken no
 
 # GSSAPI options
-{% if ssh_gssapi_authentication is defined %}
-GSSAPIAuthentication {{ ssh_gssapi_authentication | ternary('yes', 'no') }}
-{% else %}
 #GSSAPIAuthentication no
-{% endif %}
-{% if ssh_gssapi_cleanup_credentials is defined %}
-GSSAPICleanupCredentials {{ ssh_gssapi_cleanup_credentials | ternary('yes', 'no') }}
-{% else %}
 #GSSAPICleanupCredentials yes
-{% endif %}
 
 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
+# be allowed through the KbdInteractiveAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
-UsePAM yes
+# and KbdInteractiveAuthentication to 'no'.
+#UsePAM no
 
-{% if ssh_agent_forwarding is defined %}
-AllowAgentForwarding {{ ssh_agent_forwarding | ternary('yes', 'no') }}
-{% else %}
 #AllowAgentForwarding yes
-{% endif %}
-{% if ssh_tcp_forwarding is defined %}
-AllowTcpForwarding {{ ssh_tcp_forwarding | ternary('yes', 'no') }}
-{% else %}
 #AllowTcpForwarding yes
-{% endif %}
 #GatewayPorts no
-{% if ssh_x11_forwarding is defined %}
-X11Forwarding {{ ssh_x11_forwarding | ternary('yes', 'no') }}
-{% else %}
 #X11Forwarding no
-{% endif %}
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PermitTTY yes
-PrintMotd no # pam does that
+#PrintMotd yes
 #PrintLastLog yes
 #TCPKeepAlive yes
 #PermitUserEnvironment no
@@ -172,55 +103,15 @@ PrintMotd no # pam does that
 #ChrootDirectory none
 #VersionAddendum none
 
-{% if ssh_banner is defined and ssh_banner.dest is defined %}
-Banner {{ ssh_banner.dest }}
-{% else %}
 # no default banner path
 #Banner none
-{% endif %}
-
-{% if ssh_accept_env is defined %}
-{% for env in ssh_accept_env %}
-AcceptEnv {{ env }}
-{% endfor %}
-{% endif %}
-
-{% if ssh_subsystems is defined %}
-{% if ssh_subsystems | length %}
-
-{% for subsystem in ssh_subsystems %}
-Subsystem	{{ subsystem.name }}	{{ subsystem.command }}
-{% endfor %}
-{% endif %}
-{% else %}
 
 # override default of no subsystems
 Subsystem	sftp	/usr/lib/ssh/sftp-server
-{% endif %}
-{% if ssh_users is defined %}
-{% if ssh_users %}
-
-{% for user in ssh_users %}
-Match User {{ user.name }}
-{% if user.settings is defined %}
-{% for key, value in user.settings.items() %}
-        {{ key }} {{ value }}
-{% endfor %}
-{% endif %}
-{% if user.authorized_keys is defined %}
-        AuthorizedKeysFile /etc/ssh/authorized_keys/{{ user.name }}
-{% endif %}
-{% if not loop.last %}
-
-{% endif %}
-{% endfor %}
-{% endif %}
-{% else %}
 
 # Example of overriding settings on a per-user basis
 #Match User anoncvs
 #	X11Forwarding no
 #	AllowTcpForwarding no
 #	PermitTTY no
 #	ForceCommand cvs server
-{% endif %}

templates/sshd_config_d_default.conf

@@ -1,3 +1,5 @@
+# {{ ansible_managed }}
+
 {% if ssh_host_keys is defined %}
 {% for key in ssh_host_keys %}
 HostKey {{ key }}

vars/archlinux.yml

@@ -4,4 +4,6 @@ __ssh_packages: openssh
 
 __ssh_genkeys: sshdgenkeys.service
 
+__ssh_has_conf_d: yes
+
 ...

vars/debian.yml

@@ -2,4 +2,6 @@
 
 __ssh_packages: openssh-server
 
+__ssh_has_conf_d: yes
+
 ...

vars/debian_18.yml

@@ -0,0 +1,7 @@
+---
+
+__ssh_packages: openssh-server
+
+__ssh_has_conf_d: no
+
+...

vars/redhat.yml

@@ -4,4 +4,6 @@ __ssh_packages: openssh-server
 
 __ssh_genkeys: sshd-keygen.target
 
+__ssh_has_conf_d: yes
+
 ...

vars/redhat_8.yml

@@ -0,0 +1,9 @@
+---
+
+__ssh_packages: openssh-server
+
+__ssh_genkeys: sshd-keygen.target
+
+__ssh_has_conf_d: no
+
+...