24.3. Using the sshd RHEL system role for non-exclusive configuration

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   • For managed nodes that run RHEL 8 or earlier:

     ---
     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure SSHD to accept environment variables
           ansible.builtin.include_role:
             name: redhat.rhel_system_roles.sshd
           vars:
             sshd_config_namespace: <my_application>
             sshd_config:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

   • For managed nodes that run RHEL 9 or later:

     - name: Non-exclusive sshd configuration
       hosts: managed-node-01.example.com
       tasks:
         - name: Configure sshd to accept environment variables
           ansible.builtin.include_role:
             name: redhat.rhel_system_roles.sshd
           vars:
             sshd_config_file: /etc/ssh/sshd_config.d/<42-my_application>.conf
             sshd_config:
               # Environment variables to accept
               AcceptEnv:
                 LANG
                 LS_COLORS
                 EDITOR

     The settings specified in the example playbooks include the following:

     sshd_config_namespace: <my_application>

     The role places the configuration that you specify in the playbook to configuration snippets in the existing configuration file under the given namespace. You need to select a different namespace when running the role from a different context.

     sshd_config_file: /etc/ssh/sshd_config.d/<42-my_application>.conf

     In the sshd_config_file variable, define the .conf file into which the sshd system role writes the configuration options. Use a two-digit prefix, for example 42- to specify the order in which the configuration files will be applied.

     AcceptEnv:

     Controls which environment variables the OpenSSH server (sshd) will accept from a client:

     • LANG: defines the language and locale settings.
     • LS_COLORS: defines the displaying color scheme for the ls command in the terminal.
     • EDITOR: specifies the default text editor for the command-line programs that need to open an editor.

     For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml