-
Notifications
You must be signed in to change notification settings - Fork 198
Conversation
- name: set hostkeys according to openssh-version | ||
set_fact: | ||
ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key'] | ||
when: sshd_version.stdout >= '5.3' and not ssh_host_key_files |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would do that using one set_fact
or even better in the defaults file. Something like:
ssh_host_key_files: '{{ ['/etc/ssh/ssh_host_rsa_key'] if sshd_version.stdout >= '6.0' else ... }}'
This way, the whole file can be reduced to Jinja2 templating in defaults/main.yml
. This also helps with performance :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried and did not find a proper solution with the correct syntax.
"[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key]" if sshd_version.stdout >= 6.0 else \ }}
"[/etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key]" if sshd_version.stdout >= 6.3 }}'```
This and variations of it do not work. They always give some error like:
``` fatal: [localhost]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ssh_host_key_files}}): __init__() takes at least 3 arguments (2 given)"}
- "openssh-client" | ||
- "openssh-server" | ||
ignore_errors: true | ||
- file: path="/var/run/sshd" state=directory |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please always use YAML syntax.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll fix this in a separate PR where I'll change it everywhere.
templates/opensshd.conf.j2
Outdated
@@ -275,3 +240,4 @@ Match User {{ item.user }} | |||
{{ item.rules | indent(4) }} | |||
{% endfor %} | |||
{% endif %} | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why add a trailing empty line :) ? This is usually unneeded. Maybe you will find https://github.com/ypid/dotfiles/blob/33ec82ad4bf59409a37891086c765e58c06713a6/vimrc#L888-L898 useful depending on your editor.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed, thanks.
@ypid can you take a look again? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rndmh3ro it looks good from my point of view. great!!! any objection? otherwise i would merge it
thanks @rndmh3ro, great work!!! |
This PR changes the logic, which macs, kex and cipher to use. For one, it moves the evaluation to the tasks instead of the templates (similar to the hostkey-logic).
It also lets the conficuration depend on the installed ssh-version, not the operating system.
It also add support for ssh 7.6 where ripemd is removed (fixes #135).