24.2. Configuring OpenSSH servers by using the sshd RHEL system role

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: SSH server configuration
     hosts: managed-node-01.example.com
     tasks:
       - name: Configure sshd to prevent root and password login except from particular subnet
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.sshd
         vars:
           sshd_config:
             PermitRootLogin: no
             PasswordAuthentication: no
             Match:
               - Condition: "Address 192.0.2.0/24"
                 PermitRootLogin: yes
                 PasswordAuthentication: yes

   The settings specified in the example playbook include the following:

   PasswordAuthentication: yes|no

   Controls whether the OpenSSH server (sshd) accepts authentication from clients that use the username and password combination.

   Match:

   The match block allows the root user to login by using a password only from the subnet 192.0.2.0/24.

   For details about the role variables and the OpenSSH configuration options used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.sshd/README.md file and the sshd_config(5) manual page on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Log in to the SSH server:

   $ ssh <username>@<ssh_server>

2. Verify the contents of the sshd_config file on the SSH server:

   $ cat /etc/ssh/sshd_config.d/00-ansible_system_role.conf
   #
   # Ansible managed
   #
   PasswordAuthentication no
   PermitRootLogin no
   Match Address 192.0.2.0/24
     PasswordAuthentication yes
     PermitRootLogin yes

3. Check that you can connect to the server as root from the 192.0.2.0/24 subnet:

   1. Determine your IP address:

      $ hostname -I
      192.0.2.1

      If the IP address is within the 192.0.2.1 - 192.0.2.254 range, you can connect to the server.

   2. Connect to the server as root:

      $ ssh root@<ssh_server>