Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

ssh: explicitly enable or disable the service at boot (#771)

Browse source 
Signed-off-by: Sevan Murriguian-Watrin <git@byh0ki.fr>
This commit is contained in:
Sevan 2024-06-24 10:26:55 +02:00 committed by GitHub
parent 19ca997bd6
commit b0488e86d4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
roles/ssh_hardening/defaults/main.yml
View file

@ -6,9 +6,12 @@ network_ipv6_enable: true # sshd + ssh
ssh_client_config_file: /etc/ssh/ssh_config # ssh
ssh_server_config_file: /etc/ssh/sshd_config # sshd
# true if sshd should be started and enabled
# true if sshd should be started
ssh_server_enabled: true # sshd
# true if sshd should be enabled at boot
ssh_server_service_enabled: true # sshd
# true if DNS resolutions are needed, look up the remote host name,
# defaults to false from 6.8, see: http://www.openssh.com/txt/release-6.8
ssh_use_dns: false # sshd

5
roles/ssh_hardening/tasks/hardening.yml
View file

@ -144,3 +144,8 @@
when:
- sshd_disable_crypto_policy | bool
- ('crypto-policies' in ansible_facts.packages)
- name: Enable or disable sshd service
ansible.builtin.service:
name: "{{ sshd_service_name }}"
enabled: "{{ ssh_server_service_enabled }}"