From d1a11a71daa6898595f5dcebd9cb418e18d2559a Mon Sep 17 00:00:00 2001
From: Florian Fischer <florian.fischer@muhq.space>
Date: Sat, 13 Aug 2022 14:06:08 +0200
Subject: add ssh_authorize_host implementation

---
 README.md         | 21 ++++++++++-------
 defaults/main.yml |  2 ++
 tasks/main.yml    | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++----
 vars/main.yml     |  4 ++++
 4 files changed, 83 insertions(+), 12 deletions(-)
 create mode 100644 defaults/main.yml
 create mode 100644 vars/main.yml

diff --git a/README.md b/README.md
index ef191dc..1bd746f 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,15 @@
-# Ansible Role Template
+# Ansible authorize ssh host key role
 
-Description of what this role does.
+Role to authorize the host key of `ssh_hostname`.
+
+The role tries to authorize the host key globally at `/etc/ssh/ssh_known_hosts` or
+`~/.ssh/known_hosts` as fallback.
+
+## Variables
+
+* `ssh_hostname` the host to authorize
+* `use_host_ip_addresses` also authorize the IP addresses reported from DNS
+*
 
 ## Example Playbook
 
@@ -8,10 +17,6 @@ Description of what this role does.
 ---
 - hosts: host-pattern
   roles:
-    - this-role
+    - role: ssh_authorize_host
+      ssh_hostname: example.org
 ```
-
-## License
-
-This ansible role is licensed under the term of the GPLv3.  
-For further information see the `COPYING` file or [https://www.gnu.org/licenses/gpl-3.0.en.html](https://www.gnu.org/licenses/gpl-3.0.en.html).
diff --git a/defaults/main.yml b/defaults/main.yml
new file mode 100644
index 0000000..e3cf4cd
--- /dev/null
+++ b/defaults/main.yml
@@ -0,0 +1,2 @@
+ssh_port: 22
+use_host_ip_addresses: false
diff --git a/tasks/main.yml b/tasks/main.yml
index b2a8d54..e1cc02a 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,4 +1,64 @@
----
-- name: Template role
-  ansible.builtin.debug:
-    msg: "This is a template"
+- name: Authorize the "{{ ssh_relayed_hostname | default(ssh_hostname) }}" host key
+  tags:
+    - ssh
+  block:
+    - name: Retrieve the host's key
+      ansible.builtin.command: cat /etc/ssh/ssh_host_ed25519_key.pub
+      register: host_key
+      delegate_to: "{{ ssh_relayed_hostname | default(ssh_hostname) }}"
+      changed_when: false
+
+    - name: Authorize the host key on a linux host
+      when: ansible_facts['os_family'] != 'Windows'
+      vars:
+        known_hosts_path: "{{ system_known_hosts_path if system_known_hosts_file.stat.exists and system_known_hosts_file.stat.writeable else user_known_hosts_path }}"
+      block:
+        - name: Detect if global known hosts file is writable
+          ansible.builtin.stat:
+            path: "{{ system_known_hosts_path }}"
+          register: system_known_hosts_file
+
+        - name: Authorize the {{ ssh_hostname }} host key
+          vars:
+            host_line: "{% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}"
+          ansible.builtin.known_hosts:
+            path: "{{ known_hosts_path }}"
+            name: "{{ host_line }}"
+            key: "{{ host_line }} {{ host_key.stdout }}"
+
+        - name: "Authorize the {{ ssh_hostname }} IP addresses"
+          when: include_host_ip_addresses
+          block:
+            - name: Authorize the {{ ssh_hostname }} IPv4 Address
+              vars:
+                ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}"
+                host_line: "{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}"
+              ansible.builtin.known_hosts:
+                path: "{{ known_hosts_path }}"
+                name: "{{ host_line}}"
+                key: "{{ host_line }} {{ host_key.stdout }}"
+
+            - name: Authorize the {{ ssh_hostname }} IPv6 Address
+              vars:
+                ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}"
+                host_line: "{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}"
+              ansible.builtin.known_hosts:
+                path: "{{ known_hosts_path }}"
+                name: "{{ host_line}}"
+                key: "{{ host_line }} {{ host_key.stdout }}"
+
+    - name: Authorize the host key on a windows host
+      when: ansible_facts['os_family'] == 'Windows'
+      vars:
+        ipv4_address: "{{ lookup('community.general.dig', ssh_hostname) }}"
+        ipv6_address: "{{ lookup('community.general.dig', ssh_hostname, 'qtype=AAAA') }}"
+        host_line: >-
+          {% if ssh_port == 22 %}{{ ssh_hostname }}{% else %}[{{ ssh_hostname }}]:{{ ssh_port }}{% endif %}"
+          {% if include_host_ip_addresses %}
+          ,{% if ssh_port == 22 %}{{ ipv4_address }}{% else %}[{{ ipv4_address }}]:{{ ssh_port }}{% endif %}"
+          ,{% if ssh_port == 22 %}{{ ipv6_address }}{% else %}[{{ ipv6_address }}]:{{ ssh_port }}{% endif %}"
+          {% endif %}
+      community.windows.win_lineinfile:
+        create: true
+        path: "{{ windows_system_known_hosts_path }}"
+        line: "{{ host_line }} {{ host_key.stdout }}"
diff --git a/vars/main.yml b/vars/main.yml
new file mode 100644
index 0000000..15d2653
--- /dev/null
+++ b/vars/main.yml
@@ -0,0 +1,4 @@
+system_known_hosts_path: /etc/ssh/ssh_known_hosts
+user_known_hosts_path: ~/.ssh/known_hosts
+
+windows_system_known_hosts_path: C:\ProgramData\ssh\ssh_known_hosts
-- 
cgit v1.2.3