diff options
| -rw-r--r-- | README.md | 21 | ||||
| -rw-r--r-- | defaults/main.yml | 2 | ||||
| -rw-r--r-- | tasks/main.yml | 68 | ||||
| -rw-r--r-- | vars/main.yml | 4 |
4 files changed, 83 insertions, 12 deletions
@@ -1,6 +1,15 @@ -# Ansible Role Template +# Ansible authorize ssh host key role -Description of what this role does. +Role to authorize the host key of `ssh_hostname`. + +The role tries to authorize the host key globally at `/etc/ssh/ssh_known_hosts` or +`~/.ssh/known_hosts` as fallback. + +## Variables + +* `ssh_hostname` the host to authorize +* `use_host_ip_addresses` also authorize the IP addresses reported from DNS +* ## Example Playbook @@ -8,10 +17,6 @@ Description of what this role does. --- - hosts: host-pattern roles: - - this-role + - role: ssh_authorize_host + ssh_hostname: example.org ``` - -## License - -This ansible role is licensed under the term of the GPLv3. -For further information see the `COPYING` file or [https://www.gnu.org/licenses/gpl-3.0.en.html](https://www.gnu.org/licenses/gpl-3.0.en.html). diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..e3cf4cd --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,2 @@ +ssh_port: 22 +use_host_ip_addresses: false diff --git a/tasks/main.yml b/tasks/main.yml index b2a8d54..e1cc02a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,4 +1,64 @@ ---- -- name: Template role - ansible.builtin.debug: - msg: "This is a template" +- name: Authorize the "{{ ssh_relayed_hostname | default(ssh_hostname) }}" host key + tags: + - ssh + block: + - name: Retrieve the host's key + ansible.builtin.command: cat /etc/ssh/ssh_host_ed25519_key.pub + register: host_key + delegate_to: "{{ ssh_relayed_hostname | default(ssh_hostname) }}" + changed_when: false + + - name: Authorize the host key on a linux host + when: ansible_facts['os_family'] != 'Windows' + vars: + known_hosts_path: "{{ system_known_hosts_path if system_known_hosts_file.stat.exists and system_known_hosts_file.stat.writeable else user_known_hosts_path }}" + block: + - name: Detect if global known hosts file is writable + ansible.builtin.stat: + path: "{{ system_known_hosts_path }}" + register: system_known_hosts_file + + - name: Authorize the {{ ssh_hostname }} host key + vars: + host_line: "{% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}" + ansible.builtin.known_hosts: + path: "{{ known_hosts_path }}" + name: "{{ host_line }}" + key: "{{ host_line }} {{ host_key.stdout }}" + + - name: "Authorize the {{ ssh_hostname }} IP addresses" + when: include_host_ip_addresses + block: + - name: Authorize the {{ ssh_hostname }} IPv4 Address + vars: + ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}" + host_line: "{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}" + ansible.builtin.known_hosts: + path: "{{ known_hosts_path }}" + name: "{{ host_line}}" + key: "{{ host_line }} {{ host_key.stdout }}" + + - name: Authorize the {{ ssh_hostname }} IPv6 Address + vars: + ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}" + host_line: "{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}" + ansible.builtin.known_hosts: + path: "{{ known_hosts_path }}" + name: "{{ host_line}}" + key: "{{ host_line }} {{ host_key.stdout }}" + + - name: Authorize the host key on a windows host + when: ansible_facts['os_family'] == 'Windows' + vars: + ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}" + ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}" + host_line: >- + {% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}" + {% if include_host_ip_addresses %} + ,{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}" + ,{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}" + {% endif %} + community.windows.win_lineinfile: + create: true + path: "{{ windows_system_known_hosts_path }}" + line: "{{ host_line }} {{ host_key.stdout }}" diff --git a/vars/main.yml b/vars/main.yml new file mode 100644 index 0000000..15d2653 --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,4 @@ +system_known_hosts_path: /etc/ssh/ssh_known_hosts +user_known_hosts_path: ~/.ssh/known_hosts + +windows_system_known_hosts_path: C:\ProgramData\ssh\ssh_known_hosts |