Commit 2c5fc1dc authored by Simon Michnowicz's avatar Simon Michnowicz
Browse files

Fixes up issues with known_hosts file. Renamed file. Included...

Fixes up issues with known_hosts file. Renamed file. Included ecdsa-sha2-nistp256 keys. Deleted unencrypted file. Fixed read protections
parent 42444e8f
- name: "Templating /etc/ssh/known_hosts"
template: src=known_hosts.j2 dest=/etc/ssh/known_hosts owner=root group=root mode=600
template: src=known_hosts.j2 dest=/etc/ssh/ssh_known_hosts owner=root group=root mode=644
sudo: true
register: sshknowhost
register: sshknownhost
- name: ecrypt the hosts file
shell: ssh-keygen -H -f /etc/ssh/known_hosts
- name: encrypt the hosts file
shell: ssh-keygen -H -f /etc/ssh/ssh_known_hosts
sudo: true
when: sshknownhost.changed
- name: set read permissions
file: path=/etc/ssh/ssh_known_hosts owner=root group=root mode=644 state=file
sudo: true
- name: delete ssh_known_hosts.old
file: path=/etc/ssh/ssh_known_hosts.old state=absent
sudo: true
when: sshknowhost.changed
......@@ -2,14 +2,22 @@
{% for node in groups['all'] %}
{% for interface in hostvars[node]['ansible_interfaces'] %}
{% if interface != "lo" %}
{% set host = {'name': node, 'ip': hostvars[node]['ansible_'+interface]['ipv4']['address'], 'rsa': hostvars[node]['ansible_ssh_host_key_rsa_public']} %}
{% if hostvars[node]['ansible_ssh_host_key_rsa_public'] %}
{% set host = {'name': node, 'ip': hostvars[node]['ansible_'+interface]['ipv4']['address'], 'keytype':'ssh-rsa', 'key': hostvars[node]['ansible_ssh_host_key_rsa_public']} %}
{% if nodelist.append(host) %}
{% endif %}
{% endif %}
{% if hostvars[node]['ansible_ssh_host_key_ecdsa_public'] %}
#{% set host = {'name': node, 'ip': hostvars[node]['ansible_'+interface]['ipv4']['address'], 'keytype':'ssh-ecdsa', 'key': hostvars[node]['ansible_ssh_host_key_ecdsa_public']} %}
{% set host = {'name': node, 'ip': hostvars[node]['ansible_'+interface]['ipv4']['address'], 'keytype':'ecdsa-sha2-nistp256', 'key': hostvars[node]['ansible_ssh_host_key_ecdsa_public']} %}
{% if nodelist.append(host) %}
{% endif %}
{% endif %}
{% endif %}
{% endfor %}
{% endfor %}
{% for host in nodelist|unique %}
{{ host.ip }} ssh-rsa {{ host.rsa }}
{{ host.name }} ssh-rsa {{ host.rsa }}
{% for host in nodelist %}
{{ host.ip }} {{ host.keytype }} {{ host.key }}
{{ host.name }} {{ host.keytype }} {{ host.key }}
{% endfor %}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment