diff --git a/tasks/main.yml b/tasks/main.yml index 153ca4a..415ba43 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -67,9 +67,6 @@ register: ssh_hardening_use_policies -- debug: var=ssh_hardening_use_policies.stat.exists - - - name: "The (RedHat) crypto policy way..." include_tasks: restrictions_crypto_policy.yml when: ssh_hardening_use_policies.stat.exists diff --git a/tasks/moduli.yml b/tasks/moduli.yml index 8ec9d36..197c0b9 100644 --- a/tasks/moduli.yml +++ b/tasks/moduli.yml @@ -4,16 +4,20 @@ path: "{{ ssh_hardening_moduli_backup }}" register: ssh_hardening_moduli_backup_file + - name: 'Moduli: Backup "moduli.not-hardened"' shell: 'cp -a {{ ssh_hardening_moduli }} {{ ssh_hardening_moduli_backup }}' when: not ssh_hardening_moduli_backup_file.stat.exists + - name: 'Moduli: Check for small Diffie-Hellman moduli' shell: "grep -c ' 1535 \\| 2047 ' /etc/ssh/moduli || true" changed_when: False register: ssh_hardening_moduli_small + - name: 'Moduli: Remove small Diffie-Hellman moduli' shell: "TMPF=$(mktemp) && awk '$5 >= 3071' /etc/ssh/moduli >${TMPF} && mv ${TMPF} /etc/ssh/moduli" when: ssh_hardening_moduli_small.stdout|int > 0 + diff --git a/tasks/restrictions_configfile.yml b/tasks/restrictions_configfile.yml index 5a0c26c..fa61b24 100644 --- a/tasks/restrictions_configfile.yml +++ b/tasks/restrictions_configfile.yml @@ -4,7 +4,6 @@ changed_when: False register: ssh_hardening_includedir -- debug: var=ssh_hardening_includedir - name: Write restrictions to include file template: