diff --git a/galaxy.yml b/galaxy.yml index c79a793..16e67c5 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -9,3 +9,6 @@ authors: description: Studio Ansible collection containing common roles license: - MIT + +dependencies: + "devsec.hardening": ">=9.0.0" diff --git a/roles/security/tasks/main.yml b/roles/security/tasks/main.yml index 9b9a0fe..097ec39 100644 --- a/roles/security/tasks/main.yml +++ b/roles/security/tasks/main.yml @@ -1,22 +1,10 @@ --- -- name: Create SSH drop-in directory - ansible.builtin.file: - path: /etc/ssh/sshd_config.d - state: directory - owner: root - group: root - mode: "0755" - become: true - -- name: Harden SSH configuration with drop-in template - ansible.builtin.template: - src: sshd.conf.j2 - dest: /etc/ssh/sshd_config.d/sshd.conf - owner: root - group: root - mode: "0644" - notify: Restart sshd - become: true +- name: Harden SSH configuration + ansible.builtin.import_role: + name: devsec.hardening.ssh_hardening + vars: + ssh_permit_root_login: "no" + ssh_password_authentication: "no" - name: Install fail2ban ansible.builtin.apt: diff --git a/roles/security/templates/sshd.conf.j2 b/roles/security/templates/sshd.conf.j2 deleted file mode 100644 index 5bc4370..0000000 --- a/roles/security/templates/sshd.conf.j2 +++ /dev/null @@ -1,5 +0,0 @@ -## Disable root login -PermitRootLogin no - -## Disable password authentication -PasswordAuthentication no