diff --git a/playbooks/hardening/manage-ssh-keys.yml b/playbooks/hardening/manage-ssh-keys.yml index e6c7be9..de71c49 100644 --- a/playbooks/hardening/manage-ssh-keys.yml +++ b/playbooks/hardening/manage-ssh-keys.yml @@ -2,5 +2,6 @@ # vars: # good_keys: "{{ lookup('env', 'good_keys') | from_json }}" # bad_keys: "{{ lookup('env', 'bad_keys') | from_json }}" + user: admin roles: - role: manage-ssh-keys \ No newline at end of file diff --git a/roles/manage-ssh-keys/defaults/main.yml b/roles/manage-ssh-keys/defaults/main.yml index 6ff24ad..c77322d 100644 --- a/roles/manage-ssh-keys/defaults/main.yml +++ b/roles/manage-ssh-keys/defaults/main.yml @@ -1,12 +1,11 @@ --- -ssh_user: "root" -authorized_keys_file: >- - {{ "/root/.ssh/authorized_keys" if ssh_user == "root" else "/home/{{ ssh_user }}/.ssh/authorized_keys" }} +ssh_user: "admin" # Liste der erwünschten (Good) Keys good_keys: - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL/XwF0Na+YH7lRqGtwEcyIMVGTQZetNDrC9sZ8ofjC5 niklas@Linkman-PC" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPHSP1qvaoJDwMtka6UV9aOw24cKHBOa2Eyx7JBmhEg dennis@DESKTOP-V99ARL9" + - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA+EvtGavPlXfv7b00jSYsXX2+IEsqFWupEs6Rzf5z9q root@ansible" # Liste der unerwünschten (Bad) Keys bad_keys: diff --git a/roles/manage-ssh-keys/tasks/main.yml b/roles/manage-ssh-keys/tasks/main.yml index 90551d8..6a1e452 100644 --- a/roles/manage-ssh-keys/tasks/main.yml +++ b/roles/manage-ssh-keys/tasks/main.yml @@ -5,8 +5,8 @@ - name: Füge Good Keys hinzu import_tasks: add-goodkeys.yml - when: good_keys + when: good_keys.defined and good_keys | length > 0 - name: Entferne Bad Keys import_tasks: remove-badkeys.yml - when: bad_keys \ No newline at end of file + when: bad_keys.defined and bad_keys | length > 0 \ No newline at end of file diff --git a/roles/manage-ssh-keys/tasks/validate-authorized-keys.yml b/roles/manage-ssh-keys/tasks/validate-authorized-keys.yml index b6e4e60..22dafef 100644 --- a/roles/manage-ssh-keys/tasks/validate-authorized-keys.yml +++ b/roles/manage-ssh-keys/tasks/validate-authorized-keys.yml @@ -1,8 +1,8 @@ --- -- name: Stelle sicher, dass das .ssh-Verzeichnis existiert +- name: Prüfe das .ssh-Verzeichnis des eingeloggten Users file: - path: "{{ authorized_keys_file | dirname }}" + path: "{{ ansible_env.HOME }}/.ssh" state: directory - owner: "{{ ssh_user }}" - group: "{{ ssh_user }}" + owner: "{{ ansible_user_id }}" + group: "{{ ansible_user_gid | default(ansible_user_id) }}" mode: '0700' \ No newline at end of file