Chapter 1. Using secure communications between two systems with OpenSSH

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: SSH server configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure sshd to prevent root and password login except from particular subnet
         ansible.builtin.include_role:
           name: rhel-system-roles.sshd
         vars:
           sshd:
             PermitRootLogin: no
             PasswordAuthentication: no
             Match:
               - Condition: "Address 192.0.2.0/24"
                 PermitRootLogin: yes
                 PasswordAuthentication: yes

   The settings specified in the example playbook include the following:

   PasswordAuthentication: yes|no

   Controls whether the OpenSSH server (sshd) accepts authentication from clients that use the username and password combination.

   Match:

   The match block allows the root user login by using password only from the subnet 192.0.2.0/24.

   For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Log in to the SSH server:

   $ ssh <username>@<ssh_server>

2. Verify the contents of the sshd_config file on the SSH server:

   $ cat /etc/ssh/sshd_config.d/00-ansible_system_role.conf
   #
   # Ansible managed
   #
   PasswordAuthentication no
   PermitRootLogin no
   Match Address 192.0.2.0/24
     PasswordAuthentication yes
     PermitRootLogin yes

3. Check that you can connect to the server as root from the 192.0.2.0/24 subnet:

   1. Determine your IP address:

      $ hostname -I
      192.0.2.1

      If the IP address is within the 192.0.2.1 - 192.0.2.254 range, you can connect to the server.

   2. Connect to the server as root:

      $ ssh root@<ssh_server>

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   • For managed nodes that run RHEL 8 or earlier:

     ---
     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure SSHD to accept environment variables
           ansible.builtin.include_role:
             name: rhel-system-roles.sshd
           vars:
             sshd_config_namespace: <my-application>
             sshd:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

   • For managed nodes that run RHEL 9 or later:

     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure sshd to accept environment variables
           ansible.builtin.include_role:
             name: rhel-system-roles.sshd
           vars:
             sshd_config_file: /etc/ssh/sshd_config.d/<42-my-application>.conf
             sshd:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

     The settings specified in the example playbooks include the following:

     sshd_config_namespace: <my-application>

     The role places the configuration that you specify in the playbook to configuration snippets in the existing configuration file under the given namespace. You need to select a different namespace when running the role from different context.

     sshd_config_file: /etc/ssh/sshd_config.d/<42-my-application>.conf

     In the sshd_config_file variable, define the .conf file into which the sshd system role writes the configuration options. Use a two-digit prefix, for example 42- to specify the order in which the configuration files will be applied.

     AcceptEnv:

     Controls which environment variables the OpenSSH server (sshd) will accept from a client:

     • LANG: defines the language and locale settings.
     • LS_COLORS: defines the displaying color scheme for the ls command in the terminal.
     • EDITOR: specifies the default text editor for the command-line programs that need to open an editor.

     For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   - name: Deploy SSH configuration for OpenSSH server
     hosts: managed-node-01.example.com
     tasks:
       - name: Overriding the system-wide cryptographic policy
         ansible.builtin.include_role:
           name: rhel-system-roles.sshd
         vars:
           sshd_sysconfig: true
           sshd_sysconfig_override_crypto_policy: true
           sshd_KexAlgorithms: ecdh-sha2-nistp521
           sshd_Ciphers: aes256-ctr
           sshd_MACs: hmac-sha2-512-etm@openssh.com
           sshd_HostKeyAlgorithms: rsa-sha2-512,rsa-sha2-256

   The settings specified in the example playbook include the following:

   sshd_KexAlgorithms

   You can choose key exchange algorithms, for example, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521,diffie-hellman-group14-sha1, or diffie-hellman-group-exchange-sha256.

   sshd_Ciphers

   You can choose ciphers, for example, aes128-ctr, aes192-ctr, or aes256-ctr.

   sshd_MACs

   You can choose MACs, for example, hmac-sha2-256, hmac-sha2-512, or hmac-sha1.

   sshd_HostKeyAlgorithms

   You can choose a public key algorithm, for example, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-rsa.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file on the control node.

   On RHEL 9 managed nodes, the system role writes the configuration into the /etc/ssh/sshd_config.d/00-ansible_system_role.conf file, where cryptographic options are applied automatically. You can change the file by using the sshd_config_file variable. However, to ensure the configuration is effective, use a file name that lexicographically precedes the /etc/ssh/sshd_config.d/50-redhat.conf file, which includes the configured crypto policies.

   On RHEL 8 managed nodes, you must enable override by setting the sshd_sysconfig_override_crypto_policy and sshd_sysconfig variables to true.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: SSH client configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure ssh clients
         ansible.builtin.include_role:
           name: rhel-system-roles.ssh
         vars:
           ssh_user: root
           ssh:
             Compression: true
             GSSAPIAuthentication: no
             ControlMaster: auto
             ControlPath: ~/.ssh/.cm%C
             Host:
               - Condition: example
                 Hostname: server.example.com
                 User: user1
           ssh_ForwardX11: no

   The settings specified in the example playbook include the following:

   ssh_user: root

   Configures the root user’s SSH client preferences on the managed nodes with certain configuration specifics.

   Compression: true

   Compression is enabled.

   ControlMaster: auto

   ControlMaster multiplexing is set to auto.

   Host

   Creates alias example for connecting to the server.example.com host as a user called user1.

   ssh_ForwardX11: no

   X11 forwarding is disabled.

   For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.ssh/README.md file and the ssh_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml