From b7f69ea3e09711b3091475934e1a5fc8cfbce071 Mon Sep 17 00:00:00 2001 From: "oleg.vodyanov91@gmail.com" Date: Wed, 14 May 2025 00:40:20 +0400 Subject: [PATCH] add roles --- ansible/hosts | 22 +++-- ansible/roles/ssh/files/sshd_config | 122 ++++++++++++++++++++++++++ ansible/roles/ssh/handlers/main.yml | 6 ++ ansible/roles/ssh/tasks/main.yml | 15 ++++ ansible/roles/sudoers/files/ovodianov | 1 + ansible/roles/sudoers/tasks/main.yml | 8 ++ ansible/test.yml | 6 ++ 7 files changed, 172 insertions(+), 8 deletions(-) create mode 100644 ansible/roles/ssh/files/sshd_config create mode 100644 ansible/roles/ssh/handlers/main.yml create mode 100644 ansible/roles/ssh/tasks/main.yml create mode 100644 ansible/roles/sudoers/files/ovodianov create mode 100644 ansible/roles/sudoers/tasks/main.yml diff --git a/ansible/hosts b/ansible/hosts index 23fe9b4..29e935e 100644 --- a/ansible/hosts +++ b/ansible/hosts @@ -1,8 +1,14 @@ -homelab: - children: - dns: - hosts: - dns1: - ansible_host: ns1.home.lab.local - ansible_user: ovodianov - ansible_ssh_private_key_file: ~/.ssh/home.lab.local \ No newline at end of file +--- +homelab: + children: + dns: + hosts: + dns1: + ansible_host: ns1.home.lab.local + ansible_user: ovodianov + ansible_ssh_private_key_file: ~/.ssh/home.lab.local + pve: + hosts: + pve1: + ansible_host: pve.home.lab.local + ansible_user: root diff --git a/ansible/roles/ssh/files/sshd_config b/ansible/roles/ssh/files/sshd_config new file mode 100644 index 0000000..4f4c299 --- /dev/null +++ b/ansible/roles/ssh/files/sshd_config @@ -0,0 +1,122 @@ +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +Port 22 +#AddressFamily any +ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the KbdInteractiveAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via KbdInteractiveAuthentication may bypass +# the setting of "PermitRootLogin prohibit-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and KbdInteractiveAuthentication to 'no'. +UsePAM yes +PermitRootLogin no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/ansible/roles/ssh/handlers/main.yml b/ansible/roles/ssh/handlers/main.yml new file mode 100644 index 0000000..f060b8c --- /dev/null +++ b/ansible/roles/ssh/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: restart ssh + systemd_service: + name: ssh + state: restarted + daemon_reload: true diff --git a/ansible/roles/ssh/tasks/main.yml b/ansible/roles/ssh/tasks/main.yml new file mode 100644 index 0000000..b20f779 --- /dev/null +++ b/ansible/roles/ssh/tasks/main.yml @@ -0,0 +1,15 @@ +--- +- name: copy sshd config file + copy: + src: sshd_config + dest: /etc/ssh/ + owner: root + group: root + mode: '0644' + notify: restart ssh + +- name: set my token + authorized_key: + user: ovodianov + state: present + key: "{{ lookup('file', '~/.ssh/home.lab.local.pub') }}" diff --git a/ansible/roles/sudoers/files/ovodianov b/ansible/roles/sudoers/files/ovodianov new file mode 100644 index 0000000..9ffbfd5 --- /dev/null +++ b/ansible/roles/sudoers/files/ovodianov @@ -0,0 +1 @@ +ovodianov ALL=(ALL) NOPASSWD:ALL diff --git a/ansible/roles/sudoers/tasks/main.yml b/ansible/roles/sudoers/tasks/main.yml new file mode 100644 index 0000000..ac46d2e --- /dev/null +++ b/ansible/roles/sudoers/tasks/main.yml @@ -0,0 +1,8 @@ +--- +- name: copy sudoers config file + copy: + src: ovodianov + dest: /etc/sudoers.d/ + owner: root + group: root + mode: '0440' diff --git a/ansible/test.yml b/ansible/test.yml index e69de29..d080273 100644 --- a/ansible/test.yml +++ b/ansible/test.yml @@ -0,0 +1,6 @@ +--- +- hosts: homelab + become: true + roles: + - ssh + - sudoers