Rework manage-ssh-keys: default to admin user, use ansible facts for home dir, guard key lists

playbooks/hardening/manage-ssh-keys.yml

@@ -2,5 +2,6 @@
   # vars:
   #   good_keys: "{{ lookup('env', 'good_keys') | from_json }}"
   #   bad_keys: "{{ lookup('env', 'bad_keys') | from_json }}"
+  user: admin
   roles:
     - role: manage-ssh-keys

roles/manage-ssh-keys/defaults/main.yml

@@ -1,12 +1,11 @@
 ---
-ssh_user: "root"
+ssh_user: "admin"
-authorized_keys_file: >-
-  {{ "/root/.ssh/authorized_keys" if ssh_user == "root" else "/home/{{ ssh_user }}/.ssh/authorized_keys" }}
 
 # Liste der erwünschten (Good) Keys
 good_keys:
   - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL/XwF0Na+YH7lRqGtwEcyIMVGTQZetNDrC9sZ8ofjC5 niklas@Linkman-PC"
   - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPHSP1qvaoJDwMtka6UV9aOw24cKHBOa2Eyx7JBmhEg dennis@DESKTOP-V99ARL9"
+  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA+EvtGavPlXfv7b00jSYsXX2+IEsqFWupEs6Rzf5z9q root@ansible"
 
 # Liste der unerwünschten (Bad) Keys
 bad_keys:

roles/manage-ssh-keys/tasks/main.yml

@@ -5,8 +5,8 @@
 
 - name: Füge Good Keys hinzu
   import_tasks: add-goodkeys.yml
-  when: good_keys
+  when: good_keys.defined and good_keys | length > 0
 
 - name: Entferne Bad Keys
   import_tasks: remove-badkeys.yml
-  when: bad_keys
+  when: bad_keys.defined and bad_keys | length > 0

roles/manage-ssh-keys/tasks/validate-authorized-keys.yml

@@ -1,8 +1,8 @@
 ---
-- name: Stelle sicher, dass das .ssh-Verzeichnis existiert
+- name: Prüfe das .ssh-Verzeichnis des eingeloggten Users
   file:
-    path: "{{ authorized_keys_file | dirname }}"
+    path: "{{ ansible_env.HOME }}/.ssh"
     state: directory
-    owner: "{{ ssh_user }}"
+    owner: "{{ ansible_user_id }}"
-    group: "{{ ssh_user }}"
+    group: "{{ ansible_user_gid | default(ansible_user_id) }}"
     mode: '0700'