Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit a82e1a7

Browse files
schurzischurzi
authored
fix litner errors (#322)
* fix litner errors Signed-off-by: Martin Schurz <[email protected]> * make linter more happy Signed-off-by: Martin Schurz <[email protected]>
1 parent e698433 commit a82e1a7

12 files changed

+154
-145
lines changed

‎.github/workflows/release.yml

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1+
---
12
name: New release
23

3-
on:
4+
on: # yamllint disable-line rule:truthy
45
push:
56
branches:
67
- master
@@ -59,7 +60,7 @@ jobs:
5960
id: create_release
6061
uses: actions/create-release@v1
6162
env:
62-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
63+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
6364
with:
6465
release_name: ${{ steps.version.outputs.next-version }}
6566
tag_name: ${{ steps.version.outputs.next-version }}

‎.kitchen.aws.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ provisioner:
2424
playbook: default.yml
2525

2626
platforms:
27-
- name: centos-7
28-
- name: ubuntu-16.04
27+
- name: centos-7
28+
- name: ubuntu-16.04
2929

3030
verifier:
3131
name: inspec
@@ -34,4 +34,4 @@ verifier:
3434
- https://github.com/dev-sec/tests-ssh-hardening
3535

3636
suites:
37-
- name: os
37+
- name: os

‎.kitchen.vagrant.yml

+31-31
Original file line numberDiff line numberDiff line change
@@ -21,36 +21,36 @@ provisioner:
2121
https_proxy: <%= ENV['https_proxy'] || nil %>
2222

2323
platforms:
24-
- name: ubuntu-16.04
25-
driver_config:
26-
box: bento/ubuntu-16.04
27-
- name: ubuntu-18.04
28-
driver_config:
29-
box: bento/ubuntu-18.04
30-
- name: centos-6
31-
driver_config:
32-
box: bento/centos-6
33-
- name: centos-7
34-
driver_config:
35-
box: bento/centos-7
36-
- name: centos-8
37-
driver_config:
38-
box: bento/centos-8
39-
- name: oracle-6
40-
driver_config:
41-
box: bento/oracle-6
42-
- name: oracle-7
43-
driver_config:
44-
box: bento/oracle-7
45-
- name: debian-9
46-
driver_config:
47-
box: bento/debian-9
48-
- name: debian-10
49-
driver_config:
50-
box: bento/debian-10
51-
- name: amazon
52-
driver_config:
53-
box: bento/amazonlinux-2
24+
- name: ubuntu-16.04
25+
driver_config:
26+
box: bento/ubuntu-16.04
27+
- name: ubuntu-18.04
28+
driver_config:
29+
box: bento/ubuntu-18.04
30+
- name: centos-6
31+
driver_config:
32+
box: bento/centos-6
33+
- name: centos-7
34+
driver_config:
35+
box: bento/centos-7
36+
- name: centos-8
37+
driver_config:
38+
box: bento/centos-8
39+
- name: oracle-6
40+
driver_config:
41+
box: bento/oracle-6
42+
- name: oracle-7
43+
driver_config:
44+
box: bento/oracle-7
45+
- name: debian-9
46+
driver_config:
47+
box: bento/debian-9
48+
- name: debian-10
49+
driver_config:
50+
box: bento/debian-10
51+
- name: amazon
52+
driver_config:
53+
box: bento/amazonlinux-2
5454

5555
verifier:
5656
name: inspec
@@ -59,4 +59,4 @@ verifier:
5959
- https://github.com/dev-sec/ssh-baseline/
6060

6161
suites:
62-
- name: ssh
62+
- name: ssh

‎.kitchen.yml

+96-96
Original file line numberDiff line numberDiff line change
@@ -33,101 +33,101 @@ provisioner:
3333
- "--skip-tags=sysctl"
3434

3535
platforms:
36-
- name: centos6-ansible-latest
37-
driver:
38-
image: rndmh3ro/docker-centos6-ansible:latest
39-
platform: centos
40-
provision_command:
41-
- sed -i '/loginuid/d' /etc/pam.d/sshd
42-
43-
- name: centos7-ansible-latest
44-
driver:
45-
image: rndmh3ro/docker-centos7-ansible:latest
46-
platform: centos
47-
provision_command:
48-
- sed -i '/nologin/d' /etc/pam.d/sshd
49-
- systemctl enable sshd.service
50-
51-
- name: centos8-ansible-latest
52-
driver:
53-
image: rndmh3ro/docker-centos8-ansible:latest
54-
platform: centos
55-
provision_command:
56-
- sed -i '/nologin/d' /etc/pam.d/sshd
57-
- systemctl enable sshd.service
58-
provisioner:
59-
ansible_binary_path: "/usr/local/bin"
60-
61-
- name: oracle6-ansible-latest
62-
driver:
63-
image: rndmh3ro/docker-oracle6-ansible:latest
64-
platform: centos
65-
provision_command:
66-
- sed -i '/loginuid/d' /etc/pam.d/sshd
67-
68-
- name: oracle7-ansible-latest
69-
driver:
70-
image: rndmh3ro/docker-oracle7-ansible:latest
71-
platform: centos
72-
provision_command:
73-
- sed -i '/nologin/d' /etc/pam.d/sshd
74-
- systemctl enable sshd.service
75-
76-
- name: ubuntu1604-ansible-latest
77-
driver:
78-
image: rndmh3ro/docker-ubuntu1604-ansible:latest
79-
platform: ubuntu
80-
provision_command:
81-
- systemctl enable ssh.service
82-
83-
- name: ubuntu1804-ansible-latest
84-
driver:
85-
image: rndmh3ro/docker-ubuntu1804-ansible:latest
86-
platform: ubuntu
87-
provision_command:
88-
- systemctl enable ssh.service
89-
90-
- name: debian9-ansible-latest
91-
driver:
92-
image: rndmh3ro/docker-debian9-ansible:latest
93-
platform: debian
94-
provision_command:
95-
- apt install -y systemd-sysv
96-
- systemctl enable ssh.service
97-
98-
- name: debian10-ansible-latest
99-
driver:
100-
image: rndmh3ro/docker-debian10-ansible
101-
platform: debian
102-
provision_command:
103-
- apt install -y systemd-sysv
104-
- systemctl enable ssh.service
105-
106-
- name: amazon-ansible-latest
107-
driver:
108-
image: rndmh3ro/docker-amazon-ansible:latest
109-
platform: centos
110-
provision_command:
111-
- sed -i '/nologin/d' /etc/pam.d/sshd
112-
- systemctl enable sshd.service
113-
114-
- name: fedora-ansible-latest
115-
driver:
116-
image: rndmh3ro/docker-fedora-ansible:latest
117-
platform: centos
118-
provision_command:
119-
- dnf install -y python procps-ng
120-
- sed -i '/nologin/d' /etc/pam.d/sshd
121-
- systemctl enable sshd.service
122-
123-
- name: arch-ansible-latest
124-
driver:
125-
image: rndmh3ro/docker-arch-ansible:latest
126-
platform: arch
127-
run_command: /usr/lib/systemd/systemd
128-
provision_command:
129-
- sed -i '/nologin/d' /etc/pam.d/sshd
130-
- systemctl enable sshd.service
36+
- name: centos6-ansible-latest
37+
driver:
38+
image: rndmh3ro/docker-centos6-ansible:latest
39+
platform: centos
40+
provision_command:
41+
- sed -i '/loginuid/d' /etc/pam.d/sshd
42+
43+
- name: centos7-ansible-latest
44+
driver:
45+
image: rndmh3ro/docker-centos7-ansible:latest
46+
platform: centos
47+
provision_command:
48+
- sed -i '/nologin/d' /etc/pam.d/sshd
49+
- systemctl enable sshd.service
50+
51+
- name: centos8-ansible-latest
52+
driver:
53+
image: rndmh3ro/docker-centos8-ansible:latest
54+
platform: centos
55+
provision_command:
56+
- sed -i '/nologin/d' /etc/pam.d/sshd
57+
- systemctl enable sshd.service
58+
provisioner:
59+
ansible_binary_path: "/usr/local/bin"
60+
61+
- name: oracle6-ansible-latest
62+
driver:
63+
image: rndmh3ro/docker-oracle6-ansible:latest
64+
platform: centos
65+
provision_command:
66+
- sed -i '/loginuid/d' /etc/pam.d/sshd
67+
68+
- name: oracle7-ansible-latest
69+
driver:
70+
image: rndmh3ro/docker-oracle7-ansible:latest
71+
platform: centos
72+
provision_command:
73+
- sed -i '/nologin/d' /etc/pam.d/sshd
74+
- systemctl enable sshd.service
75+
76+
- name: ubuntu1604-ansible-latest
77+
driver:
78+
image: rndmh3ro/docker-ubuntu1604-ansible:latest
79+
platform: ubuntu
80+
provision_command:
81+
- systemctl enable ssh.service
82+
83+
- name: ubuntu1804-ansible-latest
84+
driver:
85+
image: rndmh3ro/docker-ubuntu1804-ansible:latest
86+
platform: ubuntu
87+
provision_command:
88+
- systemctl enable ssh.service
89+
90+
- name: debian9-ansible-latest
91+
driver:
92+
image: rndmh3ro/docker-debian9-ansible:latest
93+
platform: debian
94+
provision_command:
95+
- apt install -y systemd-sysv
96+
- systemctl enable ssh.service
97+
98+
- name: debian10-ansible-latest
99+
driver:
100+
image: rndmh3ro/docker-debian10-ansible
101+
platform: debian
102+
provision_command:
103+
- apt install -y systemd-sysv
104+
- systemctl enable ssh.service
105+
106+
- name: amazon-ansible-latest
107+
driver:
108+
image: rndmh3ro/docker-amazon-ansible:latest
109+
platform: centos
110+
provision_command:
111+
- sed -i '/nologin/d' /etc/pam.d/sshd
112+
- systemctl enable sshd.service
113+
114+
- name: fedora-ansible-latest
115+
driver:
116+
image: rndmh3ro/docker-fedora-ansible:latest
117+
platform: centos
118+
provision_command:
119+
- dnf install -y python procps-ng
120+
- sed -i '/nologin/d' /etc/pam.d/sshd
121+
- systemctl enable sshd.service
122+
123+
- name: arch-ansible-latest
124+
driver:
125+
image: rndmh3ro/docker-arch-ansible:latest
126+
platform: arch
127+
run_command: /usr/lib/systemd/systemd
128+
provision_command:
129+
- sed -i '/nologin/d' /etc/pam.d/sshd
130+
- systemctl enable sshd.service
131131

132132
verifier:
133133
name: inspec
@@ -136,4 +136,4 @@ verifier:
136136
- https://github.com/dev-sec/ssh-baseline
137137

138138
suites:
139-
- name: ssh
139+
- name: ssh

‎.travis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ env:
1616
- distro=oracle6
1717
volume=":"
1818
run_opts=""
19-
# - distro=oracle7
19+
# - distro=oracle7
2020
- distro=ubuntu1604
2121
- distro=ubuntu1804
2222
- distro=debian9

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
8585
|`sshd_custom_options` | [] | Custom lines for SSH daemon configuration |
8686
|`sshd_syslog_facility` | 'AUTH' | The facility code that is used when logging messages from sshd |
8787
|`sshd_log_level` | 'VERBOSE' | the verbosity level that is used when logging messages from sshd |
88-
|`sshd_strict_modes` | 'yes' | Check file modes and ownership of the user's files and home directory before accepting login |
88+
|`sshd_strict_modes` | true | Check file modes and ownership of the user's files and home directory before accepting login |
8989
|`sshd_authenticationmethods` | `publickey` | Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
9090

9191
## Configuring settings not listed in role-variables

‎defaults/main.yml

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
# true if IPv6 is needed
23
network_ipv6_enable: false # sshd + ssh
34

@@ -141,7 +142,7 @@ ssh_print_last_log: false # sshd
141142
# false to disable serving ssh warning banner before authentication is allowed
142143
ssh_banner: false # sshd
143144

144-
# path to file with ssh warning banner
145+
# path to file with ssh warning banner
145146
ssh_banner_path: '/etc/ssh/banner.txt'
146147

147148
# false to disable distribution version leakage during initial protocol handshake
@@ -233,7 +234,7 @@ ssh_kex_59_default:
233234
ssh_kex_66_default:
234235
- [email protected]
235236
- diffie-hellman-group-exchange-sha256
236-
237+
237238
ssh_kex_80_default:
238239
- [email protected]
239240
- [email protected]
@@ -265,7 +266,7 @@ sshd_custom_options: []
265266
sshd_syslog_facility: 'AUTH'
266267
sshd_log_level: 'VERBOSE'
267268

268-
sshd_strict_modes: yes
269+
sshd_strict_modes: true
269270

270271
# disable CRYPTO_POLICY to take settings from sshd configuration
271272
# see: https://access.redhat.com/solutions/4410591

‎handlers/main.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1+
---
12
- name: restart sshd
23
service:
34
name: '{{ sshd_service_name }}'
45
state: restarted
56
when: ssh_server_enabled | bool
6-
become: yes
7+
become: true

0 commit comments

Comments
 (0)