Update README

Multiple HostKeys can now be defined as a list, instead of allowing only one custom HostKey entry

.ansible-lint

@@ -0,0 +1,9 @@
+---
+
+exclude_paths:
+  - test.yaml
+
+warn_list:
+  - internal-error
+
+# vi: ft=yaml

README.md

@@ -12,14 +12,14 @@ If you are running this role with older versions of OpenSSH, such as version 5.3
 This is the default in this role.
 
 ```yaml
-ssh_kexalgorithms:
+openssh_kexalgorithms:
   - curve25519-sha256@libssh.org
   - ecdh-sha2-nistp521
   - ecdh-sha2-nistp384
   - ecdh-sha2-nistp256
   - diffie-hellman-group-exchange-sha256
 
-ssh_ciphers:
+openssh_ciphers:
   - chacha20-poly1305@openssh.com
   - aes256-gcm@openssh.com
   - aes128-gcm@openssh.com
@@ -27,7 +27,7 @@ ssh_ciphers:
   - aes192-ctr
   - aes128-ctr
 
-ssh_macs:
+openssh_macs:
   - hmac-sha2-512-etm@openssh.com
   - hmac-sha2-256-etm@openssh.com
   - umac-128-etm@openssh.com
@@ -38,8 +38,9 @@ ssh_macs:
 
 ### Mozilla Intermediate
 ```yaml
-ssh_hostkey_file: /etc/ssh/ssh_host_rsa_key
+openssh_hostkeys:
-ssh_hostkey_file: /etc/ssh/ssh_host_ecdsa_key
+  - /etc/ssh/ssh_host_rsa_key
+  - /etc/ssh/ssh_host_ecdsa_key
 
 ssh_kexalgorithms:
   - diffie-hellman-group-exchange-sha256

defaults/main.yaml

@@ -1,33 +1,38 @@
 ---
 
-sshd_config_path: /etc/ssh
+openssh_sshd_config_path: /etc/ssh
 
-ssh_port: 22
+openssh_port: 22
-ssh_address_family: any
+openssh_address_family: any
-ssh_listen_addresses:
+openssh_listen_addresses:
   - 0.0.0.0
 
-ssh_allow_groups: ssh
+openssh_hostkeys:
-ssh_login_grace_time: 20
+  - /etc/ssh/ssh_host_ed25519_key
-ssh_permit_root_login: 'no'
+  - /etc/ssh/ssh_host_ecdsa_key
-ssh_strict_modes: 'yes'
+  - /etc/ssh/ssh_host_rsa_key
-ssh_max_auth_tries: 3
-ssh_max_sessions: 2
 
-ssh_pubkey_authentication: 'yes'
+openssh_allow_groups: ssh
+openssh_login_grace_time: 20
+openssh_permit_root_login: 'no'
+openssh_strict_modes: 'yes'
+openssh_max_auth_tries: 3
+openssh_max_sessions: 2
 
-ssh_authorized_keys_file: .ssh/authorized_keys
+openssh_pubkey_authentication: 'yes'
 
-ssh_kexalgorithms:
+openssh_authorized_keys_file: .ssh/authorized_keys
-  # Mozilla Modern
+
+openssh_kexalgorithms:
+  # Compliant with Mozilla Modern
   - curve25519-sha256@libssh.org
   - ecdh-sha2-nistp521
   - ecdh-sha2-nistp384
   - ecdh-sha2-nistp256
   - diffie-hellman-group-exchange-sha256
 
-ssh_ciphers:
+openssh_ciphers:
-  # Mozilla Modern
+  # Compliant with Mozilla Modern
   - chacha20-poly1305@openssh.com
   - aes256-gcm@openssh.com
   - aes128-gcm@openssh.com
@@ -35,8 +40,8 @@ ssh_ciphers:
   - aes192-ctr
   - aes128-ctr
 
-ssh_macs:
+openssh_macs:
-  # Mozilla Modern
+  # Compliant with Mozilla Modern
   - hmac-sha2-512-etm@openssh.com
   - hmac-sha2-256-etm@openssh.com
   - umac-128-etm@openssh.com
@@ -44,27 +49,27 @@ ssh_macs:
   - hmac-sha2-256
   - umac-128@openssh.com
 
-ssh_hostbased_authentication: 'no'
+openssh_hostbased_authentication: 'no'
-ssh_password_authentication: 'no'
+openssh_password_authentication: 'no'
-ssh_permit_empty_passwords: 'no'
+openssh_permit_empty_passwords: 'no'
-ssh_challenge_response_authentication: 'no'
+openssh_challenge_response_authentication: 'no'
-ssh_kerberos_authentication: 'no'
+openssh_kerberos_authentication: 'no'
-ssh_gssapi_authentication: 'no'
+openssh_gssapi_authentication: 'no'
-ssh_use_pam: 'yes'
+openssh_use_pam: 'yes'
 
-ssh_allow_agent_forwarding: 'no'
+openssh_allow_agent_forwarding: 'no'
-ssh_permit_tunnel: 'no'
+openssh_permit_tunnel: 'no'
 
-ssh_x11_forwarding: 'no'
+openssh_x11_forwarding: 'no'
 
-ssh_print_motd: 'no'
+openssh_print_motd: 'no'
 
-ssh_permit_user_env: false
+openssh_permit_user_env: false
-ssh_accept_env:
+openssh_accept_env:
   - LANG
   - 'LC_*'
 
-ssh_banner: true
+openssh_banner: true
-ssh_banner_file: /etc/issue.net
+openssh_banner_file: /etc/issue.net
 
-ssh_loglevel: "VERBOSE"
+openssh_loglevel: "VERBOSE"

makefile

@@ -1,2 +1,17 @@
-test:
+##@ General
+
+# Credit the the Woodpecker-CI team for this awesome help script
+.PHONY: help
+help: ## Display this help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+
+##@ Test
+
+.PHONY: lint
+lint: ## Lint the Ansible role
+	yamllint .
+	ansible-lint
+
+.PHONY: test
+test: lint ## Test the Ansible role
 	ansible-playbook test.yaml

meta/main.yaml

@@ -1,10 +1,11 @@
 ---
 galaxy_info:
   role_name: openssh
+  namespace: coredotbin
   author: Corbin Bartsch
   description: Sensible and secure defaults for OpenSSH server
   license: MIT
-  min_ansible_version: 2.9
+  min_ansible_version: v2.9
   platforms:
     - name: Debian
       versions:

tasks/main.yaml

@@ -6,4 +6,4 @@
     state: present
 
 - name: Create sshd_config file
-  include_tasks: template_config.yaml
+  ansible.builtin.include_tasks: template_config.yaml

tasks/template_config.yaml

@@ -2,14 +2,14 @@
 
 - name: Ensure destination for sshd_config exists
   ansible.builtin.file:
-    path: "{{ sshd_config_path }}"
+    path: "{{ openssh_sshd_config_path }}"
     mode: '0644'
     state: directory
 
 - name: Write sshd_config file
   ansible.builtin.template:
     src: sshd_config.j2
-    dest: "{{ sshd_config_path }}/sshd_config"
+    dest: "{{ openssh_sshd_config_path }}/sshd_config"
     mode: '0644'
   become: true
   notify: Restart sshd
@@ -17,6 +17,6 @@
 - name: Write banner file
   ansible.builtin.template:
     src: issue.net.j2
-    dest: "{{ ssh_banner_file }}"
+    dest: "{{ openssh_banner_file }}"
     mode: '0644'
-  when: ssh_banner
+  when: openssh_banner

templates/sshd_config.j2

@@ -1,72 +1,70 @@
-# {{ ansible_managed }}
+{{ ansible_managed | comment }}
 
-Port {{ ssh_port }}
+Port {{ openssh_port }}
-AddressFamily {{ ssh_address_family }}
+AddressFamily {{ openssh_address_family }}
-{% for a in ssh_listen_addresses %}
+{% for a in openssh_listen_addresses %}
 ListenAddress {{ a }}
 {% endfor %}
 
-{% if ssh_hostkey_file is defined %}
+{% if openssh_hostkeys is defined %}
-HostKey {{ ssh_hostkey_file }}
+{% for hostkey in openssh_hostkeys %}
-{% else %}
+HostKey {{ hostkey }}
-HostKey /etc/ssh/ssh_host_ed25519_key
+{% endfor %}
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ecdsa_key
 {% endif %}
 
-{% if ssh_kexalgorithms is defined %}
+{% if openssh_kexalgorithms is defined %}
-KexAlgorithms {% for alg in ssh_kexalgorithms %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+KexAlgorithms {% for alg in openssh_kexalgorithms %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
 {% endif %}
 
-{% if ssh_ciphers is defined %}
+{% if openssh_ciphers is defined %}
-Ciphers {% for alg in ssh_ciphers %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+Ciphers {% for alg in openssh_ciphers %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
 {% endif %}
 
-{% if ssh_macs is defined %}
+{% if openssh_macs is defined %}
-MACs {% for alg in ssh_macs %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+MACs {% for alg in openssh_macs %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
 {% endif %}
 
 
-AllowGroups {{ ssh_allow_groups }}
+AllowGroups {{ openssh_allow_groups }}
-LoginGraceTime {{ ssh_login_grace_time }}
+LoginGraceTime {{ openssh_login_grace_time }}
-PermitRootLogin {{ ssh_permit_root_login }}
+PermitRootLogin {{ openssh_permit_root_login }}
-StrictModes {{ ssh_strict_modes }}
+StrictModes {{ openssh_strict_modes }}
-MaxAuthTries {{ ssh_max_auth_tries }}
+MaxAuthTries {{ openssh_max_auth_tries }}
-MaxSessions {{ ssh_max_sessions }}
+MaxSessions {{ openssh_max_sessions }}
 
-PubkeyAuthentication {{ ssh_pubkey_authentication }}
+PubkeyAuthentication {{ openssh_pubkey_authentication }}
-AuthorizedKeysFile {{ ssh_authorized_keys_file }}
+AuthorizedKeysFile {{ openssh_authorized_keys_file }}
 
-HostbasedAuthentication {{ ssh_hostbased_authentication }}
+HostbasedAuthentication {{ openssh_hostbased_authentication }}
 
-PasswordAuthentication {{ ssh_password_authentication }}
+PasswordAuthentication {{ openssh_password_authentication }}
-PermitEmptyPasswords {{ ssh_permit_empty_passwords }}
+PermitEmptyPasswords {{ openssh_permit_empty_passwords }}
-ChallengeResponseAuthentication {{ ssh_challenge_response_authentication }}
+ChallengeResponseAuthentication {{ openssh_challenge_response_authentication }}
-KerberosAuthentication {{ ssh_kerberos_authentication }}
+KerberosAuthentication {{ openssh_kerberos_authentication }}
-GSSAPIAuthentication {{ ssh_gssapi_authentication }}
+GSSAPIAuthentication {{ openssh_gssapi_authentication }}
-UsePAM {{ ssh_use_pam }}
+UsePAM {{ openssh_use_pam }}
 
-AllowAgentForwarding {{ ssh_allow_agent_forwarding }}
+AllowAgentForwarding {{ openssh_allow_agent_forwarding }}
-PermitTunnel {{ ssh_permit_tunnel }}
+PermitTunnel {{ openssh_permit_tunnel }}
 
-X11Forwarding {{ ssh_x11_forwarding }}
+X11Forwarding {{ openssh_x11_forwarding }}
-PrintMotd {{ ssh_print_motd }}
+PrintMotd {{ openssh_print_motd }}
 
-{% if ssh_banner == true %}
+{% if openssh_banner == true %}
-Banner {{ ssh_banner_file }}
+Banner {{ openssh_banner_file }}
 {% endif %}
 
-{% if ssh_permit_user_env == true %}
+{% if openssh_permit_user_env == true %}
 PermitUserEnvironment yes
 
-{% for e in ssh_accept_env %}
+{% for e in openssh_accept_env %}
 AcceptEnv {{ e }}
 {% endfor %}
 {% else %}
 PermitUserEnvironment no
 {% endif %}
 
-LogLevel {{ ssh_loglevel }}
+LogLevel {{ openssh_loglevel }}
 
 {% if ansible_facts['os_family'] == 'RedHat' %}
 Subsystem sftp	/usr/libexec/openssh/sftp-server -f AUTHPRIV -l INFO

test.yaml

@@ -1,6 +1,6 @@
-
 ---
-- hosts: 127.0.0.1
+- name: Test the role
+  hosts: 127.0.0.1
   vars_files:
     - defaults/main.yaml
   tasks: