SSH Config

A lot of security hardening has to do with editing existing files so that they comply with security baselines. Review the ssh_hardening.yml playbook. It uses the lineinfile module to change the contents of the SSH config file. It uses a regular expression to make content and to change it to the value that we want.

Note that backup is set to true. This is not the default behavior but is very important when manipulating files. It’s very easy to get the syntax wrong when making changes and clobber the file.

Execute the playbook.

ansible-playbook ssh_hardening.yml

After the playbook completes successfully, logon to one of the systems to verify what happened.

ssh -i /workspaces/ansible-workshop/home/${CODER_USER}/.ssh/id_rsa ${CODER_USER}@${CODER_USER}-vm1.sandbox.fdlabs.dev
sudo ls -l /etc/ssh/sshd_config*
sudo grep PermitRoot /etc/ssh/sshd_config
exit

Edit the playbook to add an additional task to search for #MaxAuthTries and replace it with MaxAuthTries 3

After re-running, the playbook login again and verify the file has been updated as expected.

After it completes, execute the playbook a third time and notice the handler to restart the service is skipped since no changes were implemented.