roles/common/defaults/main.yml

@@ -10,8 +10,4 @@ fail2ban_findtime: 3600
 fail2ban_bantime: 1209600
 fail2ban_ignoreip: 127.0.0.1/8 172.26.0.0/16 192.168.5.0/24
 
-# Disable SSH passwords. Must use SSH keys. This is OK because we add the keys
-# before re-configuring the SSH daemon to disable passwords.
-ssh_password_authentication: disabled
-
 # vim: set ts=2 sw=2:

roles/common/templates/sshd_config_Debian-11.j2

@@ -56,11 +56,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-{% if ssh_password_authentication == 'disabled' %}
+#PasswordAuthentication yes
-PasswordAuthentication no
-{% else %}
-PasswordAuthentication yes
-{% endif %}
 #PermitEmptyPasswords no
 
 # Change to yes to enable challenge-response passwords (beware issues with

roles/common/templates/sshd_config_Debian-12.j2

@@ -56,12 +56,8 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-{% if ssh_password_authentication == 'disabled' %}
-PasswordAuthentication no
-{% else %}
 PasswordAuthentication yes
-{% endif %}
+PermitEmptyPasswords no
-#PermitEmptyPasswords no
 
 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)
@@ -134,7 +130,7 @@ Subsystem	sftp	/usr/lib/openssh/sftp-server
 # See: https://github.com/jtesta/ssh-audit/blob/master/src/ssh_audit/policy.py
 # See: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
 KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
 
 {% if ssh_allowed_users is defined and ssh_allowed_users %}

roles/common/templates/sshd_config_Ubuntu-20.04.j2

@@ -56,11 +56,7 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-{% if ssh_password_authentication == 'disabled' %}
+#PasswordAuthentication yes
-PasswordAuthentication no
-{% else %}
-PasswordAuthentication yes
-{% endif %}
 #PermitEmptyPasswords no
 
 # Change to yes to enable challenge-response passwords (beware issues with
@@ -126,6 +122,7 @@ Subsystem sftp	/usr/lib/openssh/sftp-server
 #	AllowTcpForwarding no
 #	PermitTTY no
 #	ForceCommand cvs server
+PasswordAuthentication yes
 
 # Originally from: https://stribika.github.io/2015/01/04/secure-secure-shell.html
 # ... but with ciphers and MACs with < 256 bits removed, as NSA's Suite B now

roles/nginx/tasks/main.yml

@@ -1,25 +1,13 @@
 ---
 - name: Add nginx.org apt signing key
-  ansible.builtin.apt_key:
+  ansible.builtin.apt_key: id=0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 url=https://nginx.org/keys/nginx_signing.key state=present
-    id: 0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62
-    url: https://nginx.org/keys/nginx_signing.key
-    state: present
   register: add_nginx_apt_key
-  tags:
+  tags: nginx, packages
-    - nginx
-    - packages
 
 - name: Add nginx.org repo
-  ansible.builtin.template:
+  ansible.builtin.template: src=nginx_org_sources.list.j2 dest=/etc/apt/sources.list.d/nginx_org_sources.list owner=root group=root mode=0644
-    src: nginx_org_sources.list.j2
-    dest: /etc/apt/sources.list.d/nginx_org_sources.list
-    owner: root
-    group: root
-    mode: 0644
   register: add_nginx_apt_repository
-  tags:
+  tags: nginx, packages
-    - nginx
-    - packages
 
 - name: Update apt cache
   ansible.builtin.apt:
@@ -29,32 +17,17 @@
     add_nginx_apt_repository is changed
 
 - name: Install nginx
-  ansible.builtin.apt:
+  ansible.builtin.apt: pkg=nginx cache_valid_time=3600 state=present
-    pkg: nginx
+  tags: nginx, packages
-    cache_valid_time: 3600
-    state: present
-  tags:
-    - nginx
-    - packages
 
 - name: Copy nginx.conf
-  ansible.builtin.template:
+  ansible.builtin.template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf mode=0644 owner=root group=root
-    src: nginx.conf.j2
-    dest: /etc/nginx/nginx.conf
-    mode: 0644
-    owner: root
-    group: root
   notify:
     - reload nginx
   tags: nginx
 
 - name: Copy extra nginx configs
-  ansible.builtin.copy:
+  ansible.builtin.copy: src={{ item }} dest=/etc/nginx/{{ item }} mode=0644 owner=root group=root
-    src: "{{ item }}"
-    dest: "/etc/nginx/{{ item }}"
-    mode: 0644
-    owner: root
-    group: root
   loop:
     - extra-security.conf
     - fastcgi_cache
@@ -63,18 +36,11 @@
   tags: nginx
 
 - name: Remove default nginx vhost
-  ansible.builtin.file:
+  ansible.builtin.file: path=/etc/nginx/conf.d/default.conf state=absent
-    path: /etc/nginx/conf.d/default.conf
-    state: absent
   tags: nginx
 
 - name: Create fastcgi cache dir
-  ansible.builtin.file:
+  ansible.builtin.file: path=/var/cache/nginx/cached/fastcgi state=directory owner=nginx group=nginx mode=0755
-    path: /var/cache/nginx/cached/fastcgi
-    state: directory
-    owner: nginx
-    group: nginx
-    mode: 0755
   tags: nginx
 
 - name: Configure nginx virtual hosts
@@ -88,32 +54,19 @@
   tags: wordpress
 
 - name: Configure blank nginx vhost
-  ansible.builtin.template:
+  ansible.builtin.template: src=blank-vhost.conf.j2 dest={{ nginx_confd_path }}/blank-vhost.conf  mode=0644 owner=root group=root
-    src: blank-vhost.conf.j2
-    dest: "{{ nginx_confd_path }}/blank-vhost.conf"
-    mode: 0644
-    owner: root
-    group: root
   notify:
     - reload nginx
   tags: nginx
 
 - name: Configure munin vhost
-  ansible.builtin.copy:
+  ansible.builtin.copy: src=munin.conf dest=/etc/nginx/conf.d/munin.conf mode=0644 owner=root group=root
-    src: munin.conf
-    dest: /etc/nginx/conf.d/munin.conf
-    mode: 0644
-    owner: root
-    group: root
   notify:
     - reload nginx
   tags: nginx
 
 - name: Start and enable nginx service
-  ansible.builtin.systemd:
+  ansible.builtin.systemd: name=nginx state=started enabled=true
-    name: nginx
-    state: started
-    enabled: true
   tags: nginx
 
 - name: Configure Let's Encrypt