1 files changed, 46 insertions, 0 deletions

diff --git a/roles/services/ssh/tasks/main.yml b/roles/services/ssh/tasks/main.yml
new file mode 100644
index 0000000..d2cabab
--- /dev/null
+++ b/roles/services/ssh/tasks/main.yml
@@ -0,0 +1,46 @@
+- name: explicitly only allow pubkey auth
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?AuthenticationMethods.*"
+    line: "AuthenticationMethods publickey"
+
+- name: disable root ssh login
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PermitRootLogin"
+    line: "PermitRootLogin no"
+
+- name: enable publickey authentication
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PubkeyAuthentication.*"
+    line: "PubkeyAuthentication yes"
+
+- name: disable password authentication
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?PasswordAuthentication.*"
+    line: "PasswordAuthentication no"
+
+- name: disable challenge response
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?ChallengeResponseAuthentication.*"
+    line: "ChallengeResponseAuthentication no"
+
+- name: disable pam
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "^#?UsePAM.*"
+    line: "UsePAM no"
+
+- name: ensure sshd is enabled
+  systemd:
+    name: sshd
+    enabled: yes
+    masked: no
+
+- name: restart sshd
+  service:
+    name: sshd
+    state: restarted