Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: New options in OpenSSH + fixes for bugx in OpenSSH 9.9p1 #304

Merged
merged 3 commits into from
Dec 17, 2024
+28 −8
Merged

feat: New options in OpenSSH + fixes for bugx in OpenSSH 9.9p1 #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
639742c
Add new options from OpenSSH 9.9p1
Jakuje Dec 16, 2024
11e2100
ci: Add CentOS10
Jakuje Dec 16, 2024
1e602d9
tests: Use LogLevel option for testing to avoid OpenSSH 9.9 bug
Jakuje Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/ansible-centos-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,3 +74,17 @@ jobs:
hosts: localhost
targets: "tests/tests_*.yml"
requirements: tests/requirements.yml

centos-10:
runs-on: ubuntu-latest
steps:
- name: checkout PR
uses: actions/checkout@v4

- name: ansible check with centos 10
uses: roles-ansible/check-ansible-centos-centos10-action@main
with:
group: local
hosts: localhost
targets: "tests/tests_*.yml"
requirements: tests/requirements.yml
1 change: 1 addition & 0 deletions meta/options_body
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ PubkeyAuthOptions
PubkeyAuthentication
RSAAuthentication
RSAMinSize
RefuseConnection
RekeyLimit
RequiredRSASize
RevokedKeys
Expand Down
1 change: 1 addition & 0 deletions meta/options_match
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ PubkeyAcceptedAlgorithms
PubkeyAuthentication
PubkeyAuthOptions
RDomain
RefuseConnection
RekeyLimit
RevokedKeys
RequiredRSASize
Expand Down
2 changes: 2 additions & 0 deletions templates/sshd_config.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ Match {{ match["Condition"] }}
{{ render_option("PubkeyAuthentication",match["PubkeyAuthentication"],true) -}}
{{ render_option("PubkeyAuthOptions",match["PubkeyAuthOptions"],true) -}}
{{ render_option("RDomain",match["RDomain"],true) -}}
{{ render_option("RefuseConnection",match["RefuseConnection"],true) -}}
{{ render_option("RekeyLimit",match["RekeyLimit"],true) -}}
{{ render_option("RevokedKeys",match["RevokedKeys"],true) -}}
{{ render_option("RequiredRSASize",match["RequiredRSASize"],true) -}}
Expand Down Expand Up @@ -221,6 +222,7 @@ Match {{ match["Condition"] }}
{{ body_option("PubkeyAuthentication",sshd_PubkeyAuthentication) -}}
{{ body_option("RSAAuthentication",sshd_RSAAuthentication) -}}
{{ body_option("RSAMinSize",sshd_RSAMinSize) -}}
{{ body_option("RefuseConnection",sshd_RefuseConnection) -}}
{{ body_option("RekeyLimit",sshd_RekeyLimit) -}}
{{ body_option("RequiredRSASize",sshd_RequiredRSASize) -}}
{{ body_option("RevokedKeys",sshd_RevokedKeys) -}}
Expand Down
2 changes: 2 additions & 0 deletions templates/sshd_config_snippet.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ Match {{ match["Condition"] }}
{{ render_option("PubkeyAuthentication",match["PubkeyAuthentication"],true) -}}
{{ render_option("PubkeyAuthOptions",match["PubkeyAuthOptions"],true) -}}
{{ render_option("RDomain",match["RDomain"],true) -}}
{{ render_option("RefuseConnection",match["RefuseConnection"],true) -}}
{{ render_option("RekeyLimit",match["RekeyLimit"],true) -}}
{{ render_option("RevokedKeys",match["RevokedKeys"],true) -}}
{{ render_option("RequiredRSASize",match["RequiredRSASize"],true) -}}
Expand Down Expand Up @@ -219,6 +220,7 @@ Match {{ match["Condition"] }}
{{ body_option("PubkeyAuthentication",sshd_PubkeyAuthentication) -}}
{{ body_option("RSAAuthentication",sshd_RSAAuthentication) -}}
{{ body_option("RSAMinSize",sshd_RSAMinSize) -}}
{{ body_option("RefuseConnection",sshd_RefuseConnection) -}}
{{ body_option("RekeyLimit",sshd_RekeyLimit) -}}
{{ body_option("RequiredRSASize",sshd_RequiredRSASize) -}}
{{ body_option("RevokedKeys",sshd_RevokedKeys) -}}
Expand Down
8 changes: 4 additions & 4 deletions tests/tests_alternative_file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
AcceptEnv: LANG
Banner: /etc/issue
Ciphers: aes256-ctr
sshd_Compression: false # noqa var-naming
sshd_LogLevel: DEBUG1 # noqa var-naming

- name: Configure second alternative sshd_config file
ansible.builtin.include_role:
Expand Down Expand Up @@ -95,7 +95,7 @@
- "'AcceptEnv LANG' in config.content | b64decode"
- "'Banner /etc/issue' in config.content | b64decode"
- "'Ciphers aes256-ctr' in config.content | b64decode"
- "'Compression no' in config.content | b64decode"
- "'LogLevel DEBUG1' in config.content | b64decode"

- name: Check Fedora/RHEL9+ defaults are present in the first configuration file
ansible.builtin.assert:
Expand Down Expand Up @@ -159,7 +159,7 @@
- "'Ciphers aes128-ctr' in config2.content | b64decode"
- "'HostKey' not in config2.content | b64decode"
- "'MaxStartups 100' in config2.content | b64decode"
- "'Compression no' not in config2.content | b64decode"
- "'LogLevel DEBUG1' not in config2.content | b64decode"

- name: Check content of the main configuration file
ansible.builtin.assert:
Expand All @@ -169,7 +169,7 @@
- "'HostKey /tmp/ssh_host_ecdsa_key' in config3.content | b64decode"
- "'PasswordAuthentication no' in config3.content | b64decode"
- "'MaxStartups 100' not in config3.content | b64decode"
- "'Compression no' not in config3.content | b64decode"
- "'LogLevel DEBUG1' not in config3.content | b64decode"

- name: Check the main configuration file contains some default values for RHEL 9
ansible.builtin.assert:
Expand Down
8 changes: 4 additions & 4 deletions tests/tests_alternative_file_role.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
AcceptEnv: LANG
Banner: /etc/issue
Ciphers: aes256-ctr
sshd_Compression: false # noqa var-naming
sshd_LogLevel: DEBUG1 # noqa var-naming

# Configure second alternative sshd_config file
- name: Test first alternative role file
Expand Down Expand Up @@ -113,7 +113,7 @@
- "'AcceptEnv LANG' in config.content | b64decode"
- "'Banner /etc/issue' in config.content | b64decode"
- "'Ciphers aes256-ctr' in config.content | b64decode"
- "'Compression no' in config.content | b64decode"
- "'LogLevel DEBUG1' in config.content | b64decode"

- name: Check Fedora/RHEL9+ defaults are present in the first configuration file
ansible.builtin.assert:
Expand Down Expand Up @@ -177,7 +177,7 @@
- "'Ciphers aes128-ctr' in config2.content | b64decode"
- "'HostKey' not in config2.content | b64decode"
- "'MaxStartups 100' in config2.content | b64decode"
- "'Compression no' not in config2.content | b64decode"
- "'LogLevel DEBUG1' not in config2.content | b64decode"

- name: Check content of the main configuration file
ansible.builtin.assert:
Expand All @@ -187,7 +187,7 @@
- "'HostKey /tmp/ssh_host_ecdsa_key' in config3.content | b64decode"
- "'PasswordAuthentication no' in config3.content | b64decode"
- "'MaxStartups 100' not in config3.content | b64decode"
- "'Compression no' not in config3.content | b64decode"
- "'LogLevel DEBUG1' not in config3.content | b64decode"

- name: Check the main configuration file contains some default values for RHEL 9
ansible.builtin.assert:
Expand Down
Loading