X-Git-Url: https://gerrit.akraino.org/r/gitweb?a=blobdiff_plain;f=roles%2Fssh_conf_hardening%2Ftasks%2Fmain.yaml;h=b9d86f5120b72d44a74fce2c472bc5e5bee41e1e;hb=3711c3e8a073609f097d3346acb8add006a6dabc;hp=cfc4425106779da579c920ef518bede8f3ce891b;hpb=3af9a356135ef1622e46dfafd215ebcea2db5bac;p=ta%2Finfra-ansible.git diff --git a/roles/ssh_conf_hardening/tasks/main.yaml b/roles/ssh_conf_hardening/tasks/main.yaml index cfc4425..b9d86f5 100644 --- a/roles/ssh_conf_hardening/tasks/main.yaml +++ b/roles/ssh_conf_hardening/tasks/main.yaml @@ -130,6 +130,11 @@ insertafter: '^[\s]*ListenAddress 0.0.0.0' line: 'ListenAddress ::' +- name: Enable verbose logging for SSH daemon + ssh_conf: + regexp: '[\s]*LogLevel" + values: "LogLevel VERBOSE" + - name: "Disable Kerberos Authentication" ssh_conf: regexp: '[\s]*KerberosAuthentication' @@ -150,10 +155,10 @@ regexp: '[\s]*ClientAliveCountMax' values: "ClientAliveCountMax 0\n" -- name: "Limit logins to members of {{ users['admin_user_name'] }} group" +- name: "Limit logins to members of admin, keystone, and ironic groups" ssh_conf: regexp: '[\s]*AllowGroups' - values: "AllowGroups {{ users['admin_user_name'] }}\n" + values: "AllowGroups {{ users['admin_user_name'] }} {{ keystone_system_group_name |default('keystone') }} {{ ironic_system_group_name | default('ironic') }}\n" - name: "Disable SSH Support for User Known Hosts" ssh_conf: