Chapter 27. Configuring secure communication by using RHEL system roles

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: SSH server configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure sshd to prevent root and password login except from particular subnet
         ansible.builtin.include_role:
           name: rhel-system-roles.sshd
         vars:
           sshd:
             PermitRootLogin: no
             PasswordAuthentication: no
             Match:
               - Condition: "Address 192.0.2.0/24"
                 PermitRootLogin: yes
                 PasswordAuthentication: yes

   The playbook configures the managed node as an SSH server configured so that:

   • password and root user login is disabled
   • password and root user login is enabled only from the subnet 192.0.2.0/24

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Log in to the SSH server:

   $ ssh <username>@<ssh_server>

2. Verify the contents of the sshd_config file on the SSH server:

   $ cat /etc/ssh/sshd_config
   ...
   PasswordAuthentication no
   PermitRootLogin no
   ...
   Match Address 192.0.2.0/24
     PasswordAuthentication yes
     PermitRootLogin yes
   ...

3. Check that you can connect to the server as root from the 192.0.2.0/24 subnet:

   1. Determine your IP address:

      $ hostname -I
      192.0.2.1

      If the IP address is within the 192.0.2.1 - 192.0.2.254 range, you can connect to the server.

   2. Connect to the server as root:

      $ ssh root@<ssh_server>

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   • For managed nodes that run RHEL 8 or earlier:

     ---
     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: <Configure SSHD to accept some useful environment variables>
           ansible.builtin.include_role:
             name: rhel-system-roles.sshd
           vars:
             sshd_config_namespace: <my-application>
             sshd:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

   • For managed nodes that run RHEL 9 or later:

     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: <Configure sshd to accept some useful environment variables>
           ansible.builtin.include_role:
             name: rhel-system-roles.sshd
           vars:
             sshd_config_file: /etc/ssh/sshd_config.d/<42-my-application>.conf
             sshd:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

     In the sshd_config_file variable, define the .conf file into which the sshd system role writes the configuration options. Use a two-digit prefix, for example 42- to specify the order in which the configuration files will be applied.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Overriding the system-wide cryptographic policy
     hosts: managed-node-01.example.com
     roles:
       - rhel_system_roles.sshd
     vars:
       sshd_sysconfig: true
       sshd_sysconfig_override_crypto_policy: true
       sshd_KexAlgorithms: ecdh-sha2-nistp521
       sshd_Ciphers: aes256-ctr
       sshd_MACs: hmac-sha2-512-etm@openssh.com
       sshd_HostKeyAlgorithms: rsa-sha2-512,rsa-sha2-256

   • sshd_KexAlgorithms:: You can choose key exchange algorithms, for example, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,diffie-hellman-group14-sha1, or diffie-hellman-group-exchange-sha256.
   • sshd_Ciphers:: You can choose ciphers, for example, aes128-ctr, aes192-ctr, or aes256-ctr.
   • sshd_MACs:: You can choose MACs, for example, hmac-sha2-256, hmac-sha2-512, or hmac-sha1.
   • sshd_HostKeyAlgorithms:: You can choose a public key algorithm, for example, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, ssh-rsa, or ssh-dss.

   On RHEL 9 managed nodes, the system role writes the configuration into the /etc/ssh/sshd_config.d/00-ansible_system_role.conf file, where cryptographic options are applied automatically. You can change the file by using the sshd_config_file variable. However, to ensure the configuration is effective, use a file name that lexicographicaly preceeds the /etc/ssh/sshd_config.d/50-redhat.conf file, which includes the configured crypto policies.

   On RHEL 8 managed nodes, you must enable override by setting the sshd_sysconfig_override_crypto_policy and sshd_sysconfig variables to true.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: SSH client configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: "Configure ssh clients"
         ansible.builtin.include_role:
           name: rhel-system-roles.ssh
         vars:
           ssh_user: root
           ssh:
             Compression: true
             GSSAPIAuthentication: no
             ControlMaster: auto
             ControlPath: ~/.ssh/.cm%C
             Host:
               - Condition: example
                 Hostname: server.example.com
                 User: user1
           ssh_ForwardX11: no

   This playbook configures the root user’s SSH client preferences on the managed nodes with the following configurations:

   • Compression is enabled.
   • ControlMaster multiplexing is set to auto.
   • The example alias for connecting to the server.example.com host is user1.
   • The example host alias is created, which represents a connection to the server.example.com host the with the user1 user name.
   • X11 forwarding is disabled.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml