Majic Projects
Majic Ansible Roles
Go to the previous open issue
Go to the previous issue (open or closed)
star_faded.png
Please log in to bookmark issues
icon_project.png Majic Ansible Roles / Open Enhancement MAR-202 Switch to using modular configuration for OpenSSH server
Go to the next issue (open or closed)
Go to the next open issue
branko (@branko) has been working on this issue since March 08, 2024 (00:20)
Issue basics
  • Type of issue
    Enhancement
  • Category
    General
  • Targetted for
    Not determined
  • Status
    New
  • Progress
  • Priority
    Normal
User pain
  • Type of bug
    Not triaged
  • Likelihood
    Not triaged
  • Effect
    Not triaged
Affected by this issue (0)
There are no items
People involved
Times and dates
  • Posted at
  • Last updated
  • Estimated time
    2 hours
  • Time spent
    No time spent
    Click here to see time logged against this issue
Issue details
Attachments (0)
There is nothing attached to this issue
Duplicate issues (0)
This issue does not have any duplicates
Description

The common role currently selectively modifies portions of the OpenSSH server configuration (/etc/ssh/sshd_config) for hardening purposes.

There are two problems with this:

  • Each time support for new distribution release is added, some of the regular expressions may become invalid.
  • During upgrades to next distribution release, it is necessary to overwrite the custom modifications and reapply them again to ensure that the configuration file is consistent with distribution defaults.

With the latest two Debian releases (Bullseye/Bookworm), it is possible to instead supply custom configuration using the conf.d mechanism, overriding the settings in the main configuration file. This would make for a way cleaner way to apply the changes, and also negate the issues listed for current configuration method.

The following should be done:

  • Update the common and backup_server roles.
    • Switch to using /etc/ssh/sshd_config.d/ directory for deploying customisations.
  • Update tests that modify the configuration file to instead place override in the .d directory.
  • Figure out if any kind of change would be required for the backup_server role (probably not).
  • Update role reference documentation.
  • Update usage instructions.
  • Update release notes.
Todos (0 / 0)
There are no comments