roles/ssh_conf_hardening/library/ssh_conf.py

   1 #!/bin/python
   2
   3 # Copyright 2019 Nokia
   4
   5 # Licensed under the Apache License, Version 2.0 (the "License");
   6 # you may not use this file except in compliance with the License.
   7 # You may obtain a copy of the License at
   8 #
   9 #     http://www.apache.org/licenses/LICENSE-2.0
  10 #
  11 # Unless required by applicable law or agreed to in writing, software
  12 # distributed under the License is distributed on an "AS IS" BASIS,
  13 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14 # See the License for the specific language governing permissions and
  15 # limitations under the License.
  16
  17 import os
  18 import re
  19 from ansible.module_utils.basic import AnsibleModule
  20
  21 class SshdConf(object):
  22
  23     def __init__(self):
  24         self.module = AnsibleModule(argument_spec=dict(regexp=dict(required=True),
  25                                                        values=dict(required=True)))
  26         self.used_regexp = self.module.params["regexp"]
  27         self.set_values = self.module.params["values"]
  28         self.sshd_contents = None
  29         self.changed = False
  30         self.target = "/etc/ssh/sshd_config"
  31
  32     def _read_sshd_conf(self):
  33         os.system("sync")
  34         with open(self.target, "r") as sshd_file:
  35             self.sshd_contents = sshd_file.readlines()
  36
  37     def _write_sshd_conf(self):
  38         os.system("sync")
  39         os.remove(self.target)
  40         os.system("sync")
  41         for line in self.sshd_contents:
  42             with open(self.target, "a") as out:
  43                 out.write(line)
  44                 os.system("sync")
  45         os.system("sync")
  46         os.system("chmod 600 "+ self.target)
  47         os.system("sync")
  48         os.system("chown root:root "+ self.target)
  49         os.system("sync")
  50
  51     def _start_finder(self):
  52         end = start = None
  53         index = 0
  54
  55         for line in self.sshd_contents:
  56             if start is None and re.compile("^[A-Za-z].*").search(line):
  57                 start = index + 1
  58             if re.compile("^[#\s]*Match ").search(line):
  59                 end = index
  60                 break
  61             index += 1
  62
  63         if end is None:
  64             end = index - 1
  65
  66         if start is None:
  67             start = 0
  68
  69         return start, end
  70
  71     def ssh_checker_and_setter(self, line):
  72         if self.changed:
  73             self.sshd_contents[line] = ''
  74         else:
  75             self.sshd_contents[line] = self.module.params["values"]
  76             self.changed = True
  77
  78     def _configuration(self, start, end):
  79         for line in range(0, end):
  80             if re.compile("^"+self.module.params["regexp"]).search(self.sshd_contents[line]):
  81                 self.ssh_checker_and_setter(line)
  82         if not self.changed:
  83             for line in range(0, end):
  84                 if re.compile("^#"+self.module.params["regexp"]).search(self.sshd_contents[line]) and not self.changed:
  85                     self.sshd_contents[line] = self.sshd_contents[line]+self.module.params["values"]
  86                     self.changed = True
  87             if not self.changed:
  88                 self.sshd_contents.insert(start, self.module.params["values"])
  89                 self.changed = True
  90
  91     def run(self):
  92         self._read_sshd_conf()
  93
  94         indexes = self._start_finder()
  95         start_index = indexes[0]
  96         end_index = indexes[1]
  97
  98         self._configuration(start_index, end_index)
  99
 100         self._write_sshd_conf()
 101
 102         self.module.exit_json(changed=self.changed, msg=self.module.params["values"]+" configured")
 103
 104     @staticmethod
 105     def main():
 106         SshdConf().run()
 107
 108 if __name__ == '__main__':
 109     SshdConf.main()