Skip to content
This repository has been archived by the owner on Dec 26, 2020. It is now read-only.

Oracle support #5

Merged
merged 1 commit into from
Apr 28, 2015
Merged

Oracle support #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions roles/ansible-ssh-hardening/templates/openssh.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@
# ===================

# Address family should always be limited to the active network configuration.
AddressFamily {% if network_ipv6_enable %}any{% else %}inet{% endif %}
AddressFamily {% if network_ipv6_enable -%}any{% else -%}inet{% endif %}

# Restrict the following configuration to be limited to this Host.
{% for host in ssh_remote_hosts %}
{% for host in ssh_remote_hosts -%}
Host {{host}}
{% endfor %}

# The port at the destination should be defined
{% for port in ssh_ports %}
{% for port in ssh_ports -%}
Port {{port}}
{% endfor %}

Expand Down Expand Up @@ -48,15 +48,15 @@ StrictHostKeyChecking ask
# -- see: (http://net-ssh.github.com/net-ssh/classes/Net/SSH/Transport/CipherFactory.html)
#
{% if ssh_client_cbc_required %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
Ciphers {{ciphers_66_weak}}
{% else %}
{% else -%}
Ciphers {{ciphers_53_weak}}
{% endif %}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
Ciphers {{ciphers_66_default}}
{% else %}
{% else -%}
Ciphers {{ciphers_53_default}}
{% endif %}
{% endif %}
Expand All @@ -66,21 +66,21 @@ Ciphers {{ciphers_53_default}}
# eg Ruby's Net::SSH at around 2.2.* doesn't support sha2 for hmac, so this will have to be set true in this case.
#
{% if ssh_server_weak_hmac %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_weak}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' %}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' %}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
{% else %}
MACs {{macs_59_weak}}
{% endif %}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_default}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' %}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' %}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
{% else %}
MACs {{macs_59_default}}
Expand All @@ -101,7 +101,7 @@ MACs {{macs_59_default}}
KexAlgorithms {{kex_66_default}}
{% endif %}
{% else -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
#KexAlgorithms
{% else -%}
KexAlgorithms {{kex_59_default}}
Expand Down
8 changes: 4 additions & 4 deletions roles/ansible-ssh-hardening/templates/opensshd.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ Ciphers {{ciphers_53_default}}
{% if ssh_server_weak_hmac -%}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_weak}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' -%}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
Expand All @@ -86,7 +86,7 @@ MACs {{macs_59_weak}}
{% else %}
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_version >= '14.04' -%}
MACs {{macs_66_default}}
{% elif ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6' -%}
{% elif (ansible_os_family == 'RedHat' and ansible_distribution_major_version <= '6') or ansible_os_family == 'Oracle Linux' -%}
MACs {{macs_53_default}}
{% elif ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6' -%}
MACs {{macs_53_default}}
Expand All @@ -109,7 +109,7 @@ MACs {{macs_59_default}}
KexAlgorithms {{kex_66_default}}
{% endif %}
{% else -%}
{% if ansible_os_family == 'RedHat' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
{% if ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux' or (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') -%}
#KexAlgorithms
{% else -%}
KexAlgorithms {{kex_59_default}}
Expand All @@ -121,7 +121,7 @@ MACs {{macs_59_default}}

# Secure Login directives.
UseLogin no
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'RedHat' -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}
UsePrivilegeSeparation {% if (ansible_distribution == 'Debian' and ansible_distribution_major_version <= '6') or ansible_os_family == 'RedHat' or ansible_os_family == 'Oracle Linux' -%}{{ssh_ps53}}{% else %}{{ssh_ps59}}{% endif %}

PermitUserEnvironment no
LoginGraceTime 30s
Expand Down
1 change: 1 addition & 0 deletions roles/ansible-ssh-hardening/vars/Oracle Linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
sshd_service_name: sshd