DerLinkman
30f3e9a4c6
- replace inventory/dmc12.yml with cloudlorean.yml (+ group_vars) and update all README/AGENTS call examples and the inventory table - move admin_password hash into encrypted vault.yml; remove plaintext copies from roles/bootstrap/defaults and group_vars/external.yml - bootstrap.yml loads vault.yml via vars_files (same pattern as monitoring) - monitoring: PSK config/registration updates, docker role defaults, os-updates logging/reboot refinements, ansible.cfg/execute.sh tweaks - add .project-wiki knowledge base and .github agent instructions
59 lines
1.6 KiB
Markdown
59 lines
1.6 KiB
Markdown
---
|
|
id: MOD-007
|
|
type: module
|
|
status: active
|
|
title: Manage SSH Keys Role
|
|
created: 2026-09-09
|
|
updated: 2026-09-09
|
|
tags: [module, ssh, hardening, ansible]
|
|
related: [REQ-006, ALERT-20260909-001]
|
|
source_paths:
|
|
- roles/manage-ssh-keys/
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Manage SSH Keys Role
|
|
|
|
## Responsibility
|
|
|
|
Harden SSH access by enforcing an allow list (`good_keys`) and removing
|
|
deny-listed keys (`bad_keys`) from the target user's authorized keys.
|
|
|
|
## Source Paths
|
|
|
|
- `roles/manage-ssh-keys/tasks/main.yml` → `validate-authorized-keys.yml`,
|
|
`add-goodkeys.yml`, `remove-badkeys.yml`
|
|
- Handlers: `roles/manage-ssh-keys/handlers/main.yml`
|
|
|
|
## Public Interfaces
|
|
|
|
- Playbook: `playbooks/hardening/manage-ssh-keys.yml`
|
|
(binds the role directly; **no Debian guard, no `become`**)
|
|
- Key variables: `ssh_user` (admin), `good_keys` (allow list),
|
|
`bad_keys` (deny list; supports env-provided JSON overrides via commented
|
|
vars in the playbook).
|
|
- Conditional execution: `good_keys.defined and good_keys | length > 0`
|
|
(same for `bad_keys`).
|
|
|
|
## Important Flows
|
|
|
|
1. Validate/ensure `~/.ssh` of the logged-in user (0700).
|
|
2. Add `good_keys` to authorized keys.
|
|
3. Remove `bad_keys` from authorized keys.
|
|
|
|
## Dependencies
|
|
|
|
- None (ansible.builtin).
|
|
|
|
## Tests
|
|
|
|
- None automated.
|
|
|
|
## Notes For Agents
|
|
|
|
- The playbook deviates from the documented convention (Debian guard,
|
|
`become: true`); treat as an intentional gap to confirm before adding
|
|
more hardening playbooks.
|
|
- Keys in `defaults/main.yml` are public keys (not secrets); the same allow
|
|
list also exists in `roles/bootstrap/defaults/main.yml`.
|