From d9a3cc9eb4fcbab709d6be1ea5b46dfdd88e48cc Mon Sep 17 00:00:00 2001
From: nicoo <nicoo@realraum.at>
Date: Wed, 15 Nov 2017 01:31:42 +0100
Subject: [PATCH] ansible: Only allow SSH from group SSH on wuerfel

---
 ansible/host_vars/wuerfel          |    1 +
 ansible/roles/base/tasks/main.yaml |   34 ++++++++++++++++++++++++++++------
 2 files changed, 29 insertions(+), 6 deletions(-)
 create mode 100644 ansible/host_vars/wuerfel

diff --git a/ansible/host_vars/wuerfel b/ansible/host_vars/wuerfel
new file mode 100644
index 0000000..c7f5f5c
--- /dev/null
+++ b/ansible/host_vars/wuerfel
@@ -0,0 +1 @@
+sshd_allowgroup: ssh
diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml
index 7f60b4e..1e53273 100644
--- a/ansible/roles/base/tasks/main.yaml
+++ b/ansible/roles/base/tasks/main.yaml
@@ -6,20 +6,42 @@
      line: "PermitRootLogin without-password"
   notify: restart ssh
 
-- name: limit allowed users (1/2)
+- name: limit allowed users (1/3)
   lineinfile:
      dest: /etc/ssh/sshd_config
-     regexp: "^AllowUsers"
+     regexp: "^#?AllowUsers"
      line: "AllowUsers {{ ' '.join([ 'root' ] | union(sshd_allowusers_group | default([])) | union(sshd_allowusers_host | default([]))) }}"
-  when: sshd_allowusers_set | default(true)
+  when: sshd_allowusers_set is defined and sshd_allowgroup is not defined
   notify: restart ssh
 
-- name: limit allowed users (2/2)
+- block:
+    - name: "limit allowed users (2/3): Make sure AllowUsers is not in sshd_config"
+      lineinfile:
+        dest: /etc/ssh/sshd_config
+        regexp: "^AllowUsers"
+        state: absent
+
+    - name: "limit allowed users (2/3): Set AllowGroups in sshd_config"
+      lineinfile:
+        dest: /etc/ssh/sshd_config
+        regexp: "^#?AllowGroups"
+        line: AllowGroups {{ sshd_allowgroup }}
+
+    - name: "limit allowed users (2/3): Add allowed users to ssh group"
+      user:
+        name: "{{ item }}"
+        groups: "{{ sshd_allowgroup }}"
+        append: True
+      with_items: "{{ [ 'root' ] | union(sshd_allowusers_group | default([])) | union(sshd_allowusers_host | default([])) }}"
+
+  when: sshd_allowgroup is defined
+
+- name: limit allowed users (3/3)
   lineinfile:
      dest: /etc/ssh/sshd_config
-     regexp: "^AllowUsers"
+     regexp: "^Allow(Users|Groups)"
      state: absent
-  when: not sshd_allowusers_set | default(true)
+  when: sshd_allowusers_set is not defined and sshd_allowgroup is not defined
   notify: restart ssh
 
 - name: Set authorized keys for root user
-- 
1.7.10.4