From 67c1086e2c2c84864164515395f4a849193b0ff5 Mon Sep 17 00:00:00 2001 From: Christoph Date: Sat, 14 Nov 2026 10:42:42 +0100 Subject: [PATCH] Role common: add task sftpd.yml for chrooted SFTP access. - group 'sftpusers' (GID 200 or next free), sshd drop-in /etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h, ForceCommand internal-sftp), PasswordAuthentication via 'sftp_password_authentication' - new sftp users (UID 201 or next free) with root owned chroot home, upload dir and root owned authorized_keys (always created) - existing users (e.g. www-data, suexec users) can be added to the group; chroot requirements of their home are checked, not changed - passwords: update_password defaults to 'always', password of users with shell access is never changed - controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd' - add empty sftpd section to all host_vars *-common.yml Co-Authored-By: Claude Opus 5.5 --- group_vars/all/main.yml | 93 +++++ host_vars/a.mx.oopen.de/a.mx-common.yml | 5 + host_vars/a.ns.oopen.de/a.ns-common.yml | 5 + host_vars/ak-plan.oopen.de/ak-plan-common.yml | 5 + host_vars/anita.wf.netz/anita-common.yml | 5 + .../at-10-neu.ak.netz/at-10-neu-common.yml | 5 + host_vars/b.mx.oopen.de/b.mx-common.yml | 5 + host_vars/b.ns.oopen.de/b.ns-common.yml | 5 + host_vars/backup.oopen.de/backup-common.yml | 5 + .../backup.warenform.de/backup-common.yml | 5 + host_vars/c.mx.oopen.de/c.mx-common.yml | 5 + host_vars/cl-01.oopen.de/cl-01-common.yml | 5 + host_vars/cl-02.oopen.de/cl-02-common.yml | 5 + .../cl-dissens.oopen.de/cl-dissens-common.yml | 5 + host_vars/cl-flr.oopen.de/cl-flr-common.yml | 5 + host_vars/cl-fm.oopen.de/cl-fm-common.yml | 5 + .../cl-irights.oopen.de/cl-irights-common.yml | 5 + .../cl-nd-test.oopen.de/cl-nd-test-common.yml | 5 + host_vars/cl-nd.oopen.de/cl-nd-common.yml | 5 + host_vars/cl-ndm.oopen.de/cl-ndm-common.yml | 5 + host_vars/cl-opp.oopen.de/cl-opp-common.yml | 5 + host_vars/cl-test.oopen.de/cl-test-common.yml | 5 + host_vars/cloud.akweb.de/cloud-common.yml | 5 + host_vars/cp-01.oopen.de/cp-01-common.yml | 5 + host_vars/cp-flr.oopen.de/cp-flr-common.yml | 5 + host_vars/d.mx.oopen.de/d.mx-common.yml | 5 + host_vars/dc-opp.oopen.de/dc-opp-common.yml | 5 + .../devel-db.wf.netz/devel-db-common.yml | 5 + .../devel-php.wf.netz/devel-php-common.yml | 5 + .../devel-repos-common.yml | 5 + .../devel-root.wf.netz/devel-root-common.yml | 5 + .../devel-wiki.wf.netz/devel-wiki-common.yml | 5 + host_vars/dns0.warenform.de/dns0-common.yml | 5 + host_vars/dns1.warenform.de/dns1-common.yml | 5 + host_vars/e.mx.oopen.de/e.mx-common.yml | 5 + .../file-ah-common.yml | 5 + .../file-blkr.blkr.netz/file-blkr-common.yml | 5 + .../file-dissens-common.yml | 5 + .../file-ebs.ebs.netz/file-ebs-common.yml | 5 + .../file-fhxb.fhxb.netz/file-fhxb-common.yml | 5 + host_vars/file-fm.fm.netz/file-fm-common.yml | 5 + .../file-kb.anw-kb.netz/file-kb-common.yml | 5 + .../file-km-alt-common.yml | 5 + .../file-km.anw-km.netz/file-km-common.yml | 5 + .../formbricks-nd-common.yml | 5 + host_vars/g.mx.oopen.de/g.mx-common.yml | 5 + .../ga-al-gw.oopen.de/ga-al-gw-common.yml | 5 + .../ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml | 5 + .../ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml | 5 + .../ga-al-relay-common.yml | 5 + .../ga-gh-gw.oopen.de/ga-gh-gw-common.yml | 5 + .../ga-nh-gw.oopen.de/ga-nh-gw-common.yml | 5 + .../ga-st-gw-ersatz-common.yml | 5 + .../ga-st-gw.ga.netz/ga-st-gw-common.yml | 5 + .../ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml | 5 + .../ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml | 5 + .../ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml | 5 + .../ga-st-mail.ga.netz/ga-st-mail-common.yml | 5 + .../ga-st-services-common.yml | 5 + host_vars/git.oopen.de/git-common.yml | 5 + host_vars/git.warenform.de/git-common.yml | 5 + host_vars/gw-123.oopen.de/gw-123-common.yml | 5 + host_vars/gw-ah.oopen.de/gw-ah-common.yml | 5 + host_vars/gw-ak.oopen.de/gw-ak-common.yml | 5 + host_vars/gw-akb.oopen.de/gw-akb-common.yml | 5 + host_vars/gw-b3.oopen.de/gw-b3-common.yml | 5 + host_vars/gw-blkr.oopen.de/gw-blkr-common.yml | 5 + .../gw-campus.oopen.de/gw-campus-common.yml | 5 + .../gw-ckubu.local.netz/gw-ckubu-common.yml | 5 + host_vars/gw-d11.oopen.de/gw-d11-common.yml | 5 + .../gw-dissens.oopen.de/gw-dissens-common.yml | 5 + host_vars/gw-ebs.oopen.de/gw-ebs-common.yml | 5 + .../gw-elster.oopen.de/gw-elster-common.yml | 5 + host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml | 5 + host_vars/gw-flr.oopen.de/gw-flr-common.yml | 5 + host_vars/gw-fm.oopen.de/gw-fm-common.yml | 5 + .../gw-irights.oopen.de/gw-irights-common.yml | 5 + host_vars/gw-kb.oopen.de/gw-kb-common.yml | 5 + host_vars/gw-km.oopen.de/gw-km-common.yml | 5 + host_vars/gw-mbr.oopen.de/gw-mbr-common.yml | 5 + host_vars/gw-opp.oopen.de/gw-opp-common.yml | 5 + .../gw-replacement-common.yml | 5 + host_vars/gw-spr.oopen.de/gw-spr-common.yml | 5 + host_vars/h.mx.oopen.de/h.mx-common.yml | 5 + host_vars/iam-nd.oopen.de/iam-nd-common.yml | 5 + .../initiativenserver-common.yml | 5 + .../keycloak-nd-common.yml | 5 + .../lists.mx.warenform.de/lists.mx-common.yml | 5 + .../lxc-host-kb-common.yml | 5 + host_vars/mail.cadus.org/mail-common.yml | 5 + .../mail.faire-mobilitaet.de/mail-common.yml | 5 + .../matomo-01.oopen.de/matomo-01-common.yml | 5 + host_vars/meet.akweb.de/meet-common.yml | 5 + host_vars/meet.oopen.de/meet-common.yml | 5 + .../mm-irights.oopen.de/mm-irights-common.yml | 5 + .../mm-nd-test.oopen.de/mm-nd-test-common.yml | 5 + host_vars/mm-nd.oopen.de/mm-nd-common.yml | 5 + host_vars/mm-rav.oopen.de/mm-rav-common.yml | 5 + host_vars/mm.oopen.de/mm-common.yml | 5 + host_vars/munin.oopen.de/munin-common.yml | 5 + host_vars/mx.warenform.de/mx-common.yml | 5 + .../nd-archiv-common.yml | 5 + .../nd-live.warenform.de/nd-live-common.yml | 5 + host_vars/nd.warenform.de/nd-common.yml | 5 + host_vars/o12.oopen.de/o12-common.yml | 5 + .../o13-cryptpad-common.yml | 5 + .../o13-mail.oopen.de/o13-mail-common.yml | 5 + .../o13-mumble.oopen.de/o13-mumble-common.yml | 5 + host_vars/o13-pad.oopen.de/o13-pad-common.yml | 5 + .../o13-staging-board-common.yml | 5 + host_vars/o13-web.oopen.de/o13-web-common.yml | 5 + host_vars/o13.oopen.de/o13-common.yml | 5 + host_vars/o17.oopen.de/o17-common.yml | 5 + host_vars/o18.oopen.de/o18-common.yml | 5 + host_vars/o19.oopen.de/o19-common.yml | 5 + host_vars/o20.oopen.de/o20-common.yml | 5 + host_vars/o21.oopen.de/o21-common.yml | 5 + host_vars/o22.oopen.de/o22-common.yml | 5 + host_vars/o23.oopen.de/o23-common.yml | 5 + host_vars/o24.oopen.de/o24-common.yml | 5 + host_vars/o25.oopen.de/o25-common.yml | 5 + host_vars/o26.oopen.de/o26-common.yml | 5 + host_vars/o27.oopen.de/o27-common.yml | 5 + host_vars/o28.oopen.de/o28-common.yml | 5 + host_vars/o29.oopen.de/o29-common.yml | 5 + host_vars/o30.oopen.de/o30-common.yml | 5 + host_vars/o31.oopen.de/o31-common.yml | 5 + host_vars/o32.oopen.de/o32-common.yml | 5 + host_vars/o34.oopen.de/o34-common.yml | 5 + host_vars/o35.oopen.de/o35-common.yml | 5 + host_vars/o36.oopen.de/o36-common.yml | 5 + host_vars/o38.oopen.de/o38-common.yml | 5 + host_vars/o39.oopen.de/o39-common.yml | 5 + host_vars/o40.oopen.de/o40-common.yml | 5 + host_vars/o41.oopen.de/o41-common.yml | 5 + host_vars/o42.oopen.de/o42-common.yml | 5 + host_vars/o43.oopen.de/o43-common.yml | 5 + host_vars/o44.oopen.de/o44-common.yml | 5 + host_vars/o45.oopen.de/o45-common.yml | 5 + .../oolm-shop-dev-common.yml | 5 + .../oolm-shop.oopen.de/oolm-shop-common.yml | 5 + .../oolm-web.oopen.de/oolm-web-common.yml | 5 + host_vars/piwik.warenform.de/piwik-common.yml | 5 + .../prometheus-nd-common.yml | 5 + .../psono-ndm.oopen.de/psono-ndm-common.yml | 5 + host_vars/rage.so36.net/rage-common.yml | 5 + .../server18.warenform.de/server18-common.yml | 5 + .../server22.warenform.de/server22-common.yml | 5 + .../server23.warenform.de/server23-common.yml | 5 + .../server24.warenform.de/server24-common.yml | 5 + .../server25.warenform.de/server25-common.yml | 5 + .../server26.warenform.de/server26-common.yml | 5 + .../server27.warenform.de/server27-common.yml | 5 + host_vars/sftp-nd.oopen.de/sftp-nd-common.yml | 5 + .../stolpersteine-common.yml | 5 + .../test.mariadb-common.yml | 5 + host_vars/test.mx.oopen.de/test.mx-common.yml | 5 + .../verdi-django-common.yml | 5 + .../vvn-shop.warenform.de/vvn-shop-common.yml | 5 + .../vvn-www.warenform.de/vvn-www-common.yml | 5 + host_vars/web-01.oopen.de/web-01-common.yml | 5 + host_vars/web-02.oopen.de/web-02-common.yml | 5 + host_vars/web-03.oopen.de/web-03-common.yml | 5 + host_vars/web-04.oopen.de/web-04-common.yml | 5 + host_vars/web-05.oopen.de/web-05-common.yml | 5 + host_vars/web-06.oopen.de/web-06-common.yml | 5 + host_vars/web-07.oopen.de/web-07-common.yml | 5 + host_vars/web-08.oopen.de/web-08-common.yml | 5 + host_vars/web-09.oopen.de/web-09-common.yml | 5 + host_vars/web-nd.oopen.de/web-nd-common.yml | 5 + host_vars/web.cadus.org/web-common.yml | 5 + host_vars/web0.warenform.de/web0-common.yml | 5 + host_vars/web1.warenform.de/web1-common.yml | 5 + host_vars/web2.warenform.de/web2-common.yml | 5 + host_vars/zapata.opp.netz/zapata-common.yml | 5 + roles/common/tasks/main.yml | 9 + roles/common/tasks/sftpd.yml | 369 ++++++++++++++++++ .../ssh/sshd_config.d/90-sshd-SFTP.conf.j2 | 32 ++ .../common/templates/sftp_authorized_keys.j2 | 3 + 179 files changed, 1376 insertions(+) create mode 100644 roles/common/tasks/sftpd.yml create mode 100644 roles/common/templates/etc/ssh/sshd_config.d/90-sshd-SFTP.conf.j2 create mode 100644 roles/common/templates/sftp_authorized_keys.j2 diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 8156451..37bd69b 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -2473,6 +2473,99 @@ sshd_pasword_auth_user: sshd_pasword_auth_ip: +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + +# Set up chrooted SFTP access (group, sshd config, sftp users)? +# +chrooted_sftpd_present: false + +# Group for chrooted sftp users. GID is 'sftp_group_id_start' if still +# free, otherwise the next free GID above. +# +sftp_group_name: sftpusers +sftp_group_id_start: 200 + +# New sftp users get UID 'sftp_user_id_start' or the next free UID above +# (unless 'user_id' is given explicitly). Existing users keep their UID. +# +sftp_user_id_start: 201 + +# Allow password authentication for members of the sftp group? +# (overrides the global sshd setting for this group) +# +sftp_password_authentication: !!str "no" + +# sftp users +# +# New users (will be created): +# +# name: user name (required) +# home: home = chroot directory, owned by root (required) +# ssh_keys: list of public keys (authorized_keys) (optional, default: []) +# password: password hash (e.g. 'mkpasswd -m yescrypt') (optional, default: '!' = locked) +# update_password: always | on_create (optional, default: always) +# upload_dir: writable directory inside chroot (optional, default: upload) +# user_id: fixed UID (optional) +# +# /.ssh/authorized_keys is always created (owned by root) - it +# is empty, if no ssh_keys are given. +# +# Note: with 'update_password: always' (default) the password hash given +# here is enforced on every run - without 'password' the account +# gets locked ('!'). With 'on_create' the password is only set when +# the user is created. +# +# If the user already exists with shell access (shell other than +# nologin/false), the play fails for the host - use 'existing_user: true'. +# +# Existing users (e.g. www-data or suexec users of vhosts), only added to +# the sftp group: +# +# name: user name (required) +# existing_user: true (required) +# ssh_keys: public keys, added to the users (optional) +# ~/.ssh/authorized_keys +# password: password hash (optional, default: unchanged) +# update_password: always | on_create (optional, default: always) +# +# ~/.ssh and ~/.ssh/authorized_keys are always created (owned by the +# user), an existing authorized_keys is never truncated. Without +# 'password' the password stays untouched. +# +# UID, primary group, home and shell stay untouched, 'home' is ignored. +# The home directory (from /etc/passwd) becomes the chroot directory, so +# it and all its parents must be owned by root and not writable by +# group/others (e.g. /var/www owned by root:root, mode 0755). This is +# checked - the play fails for the host otherwise - but never changed. +# +# ATTENTION: A user in the sftp group has NO shell access anymore +# (ForceCommand internal-sftp). +# +# Note: ssh_keys are optional. Without key and without password (and with +# 'sftp_password_authentication: no') the user can't log in. +# +# Note: The password of a user with shell access (login shell other than +# nologin/false) is NEVER changed, regardless of 'password' and +# 'update_password'. +# +# example: +# +# sftp_user: +# - name: sftp-test +# home: /data/sftp/sftp-test +# ssh_keys: +# - 'ssh-ed25519 AAAA... user@host' +# +# - name: www-data +# existing_user: true +# ssh_keys: +# - 'ssh-ed25519 AAAA... user@host' +# +sftp_user: [] + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/a.mx.oopen.de/a.mx-common.yml b/host_vars/a.mx.oopen.de/a.mx-common.yml index b544a0c..d504890 100644 --- a/host_vars/a.mx.oopen.de/a.mx-common.yml +++ b/host_vars/a.mx.oopen.de/a.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/a.ns.oopen.de/a.ns-common.yml b/host_vars/a.ns.oopen.de/a.ns-common.yml index fada2b8..6ba9bfa 100644 --- a/host_vars/a.ns.oopen.de/a.ns-common.yml +++ b/host_vars/a.ns.oopen.de/a.ns-common.yml @@ -66,6 +66,11 @@ extra_user: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/ak-plan.oopen.de/ak-plan-common.yml b/host_vars/ak-plan.oopen.de/ak-plan-common.yml index 8d89f6d..87fc04f 100644 --- a/host_vars/ak-plan.oopen.de/ak-plan-common.yml +++ b/host_vars/ak-plan.oopen.de/ak-plan-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/anita.wf.netz/anita-common.yml b/host_vars/anita.wf.netz/anita-common.yml index ee395f2..7807563 100644 --- a/host_vars/anita.wf.netz/anita-common.yml +++ b/host_vars/anita.wf.netz/anita-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/at-10-neu.ak.netz/at-10-neu-common.yml b/host_vars/at-10-neu.ak.netz/at-10-neu-common.yml index 1dc65a7..70fdeb1 100644 --- a/host_vars/at-10-neu.ak.netz/at-10-neu-common.yml +++ b/host_vars/at-10-neu.ak.netz/at-10-neu-common.yml @@ -58,6 +58,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/b.mx.oopen.de/b.mx-common.yml b/host_vars/b.mx.oopen.de/b.mx-common.yml index f9c4dd5..19e5e60 100644 --- a/host_vars/b.mx.oopen.de/b.mx-common.yml +++ b/host_vars/b.mx.oopen.de/b.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/b.ns.oopen.de/b.ns-common.yml b/host_vars/b.ns.oopen.de/b.ns-common.yml index 25a9c9c..c7be943 100644 --- a/host_vars/b.ns.oopen.de/b.ns-common.yml +++ b/host_vars/b.ns.oopen.de/b.ns-common.yml @@ -60,6 +60,11 @@ extra_user: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/backup.oopen.de/backup-common.yml b/host_vars/backup.oopen.de/backup-common.yml index 7f15c26..c62c6ca 100644 --- a/host_vars/backup.oopen.de/backup-common.yml +++ b/host_vars/backup.oopen.de/backup-common.yml @@ -49,6 +49,11 @@ root_ssh_keypair: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/backup.warenform.de/backup-common.yml b/host_vars/backup.warenform.de/backup-common.yml index b56fdab..3d3f9ae 100644 --- a/host_vars/backup.warenform.de/backup-common.yml +++ b/host_vars/backup.warenform.de/backup-common.yml @@ -59,6 +59,11 @@ root_ssh_keypair: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/c.mx.oopen.de/c.mx-common.yml b/host_vars/c.mx.oopen.de/c.mx-common.yml index e3eebec..dcc4b3a 100644 --- a/host_vars/c.mx.oopen.de/c.mx-common.yml +++ b/host_vars/c.mx.oopen.de/c.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/cl-01.oopen.de/cl-01-common.yml b/host_vars/cl-01.oopen.de/cl-01-common.yml index 42ea8de..da201ff 100644 --- a/host_vars/cl-01.oopen.de/cl-01-common.yml +++ b/host_vars/cl-01.oopen.de/cl-01-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-02.oopen.de/cl-02-common.yml b/host_vars/cl-02.oopen.de/cl-02-common.yml index e72e551..c339e87 100644 --- a/host_vars/cl-02.oopen.de/cl-02-common.yml +++ b/host_vars/cl-02.oopen.de/cl-02-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-dissens.oopen.de/cl-dissens-common.yml b/host_vars/cl-dissens.oopen.de/cl-dissens-common.yml index 663a7ca..7d1bae3 100644 --- a/host_vars/cl-dissens.oopen.de/cl-dissens-common.yml +++ b/host_vars/cl-dissens.oopen.de/cl-dissens-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-flr.oopen.de/cl-flr-common.yml b/host_vars/cl-flr.oopen.de/cl-flr-common.yml index 663a7ca..7d1bae3 100644 --- a/host_vars/cl-flr.oopen.de/cl-flr-common.yml +++ b/host_vars/cl-flr.oopen.de/cl-flr-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-fm.oopen.de/cl-fm-common.yml b/host_vars/cl-fm.oopen.de/cl-fm-common.yml index 0d9b2e7..b866af5 100644 --- a/host_vars/cl-fm.oopen.de/cl-fm-common.yml +++ b/host_vars/cl-fm.oopen.de/cl-fm-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-irights.oopen.de/cl-irights-common.yml b/host_vars/cl-irights.oopen.de/cl-irights-common.yml index 31d1456..99521b8 100644 --- a/host_vars/cl-irights.oopen.de/cl-irights-common.yml +++ b/host_vars/cl-irights.oopen.de/cl-irights-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-nd-test.oopen.de/cl-nd-test-common.yml b/host_vars/cl-nd-test.oopen.de/cl-nd-test-common.yml index dc6e543..c50de0d 100644 --- a/host_vars/cl-nd-test.oopen.de/cl-nd-test-common.yml +++ b/host_vars/cl-nd-test.oopen.de/cl-nd-test-common.yml @@ -9,6 +9,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-nd.oopen.de/cl-nd-common.yml b/host_vars/cl-nd.oopen.de/cl-nd-common.yml index 2d2f852..0e7a957 100644 --- a/host_vars/cl-nd.oopen.de/cl-nd-common.yml +++ b/host_vars/cl-nd.oopen.de/cl-nd-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-ndm.oopen.de/cl-ndm-common.yml b/host_vars/cl-ndm.oopen.de/cl-ndm-common.yml index 5dd4a46..4a29bde 100644 --- a/host_vars/cl-ndm.oopen.de/cl-ndm-common.yml +++ b/host_vars/cl-ndm.oopen.de/cl-ndm-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-opp.oopen.de/cl-opp-common.yml b/host_vars/cl-opp.oopen.de/cl-opp-common.yml index d5e558c..2ba506e 100644 --- a/host_vars/cl-opp.oopen.de/cl-opp-common.yml +++ b/host_vars/cl-opp.oopen.de/cl-opp-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cl-test.oopen.de/cl-test-common.yml b/host_vars/cl-test.oopen.de/cl-test-common.yml index c92a3d6..d105f91 100644 --- a/host_vars/cl-test.oopen.de/cl-test-common.yml +++ b/host_vars/cl-test.oopen.de/cl-test-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cloud.akweb.de/cloud-common.yml b/host_vars/cloud.akweb.de/cloud-common.yml index a33a1f0..bd808e8 100644 --- a/host_vars/cloud.akweb.de/cloud-common.yml +++ b/host_vars/cloud.akweb.de/cloud-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cp-01.oopen.de/cp-01-common.yml b/host_vars/cp-01.oopen.de/cp-01-common.yml index 6366d14..865165f 100644 --- a/host_vars/cp-01.oopen.de/cp-01-common.yml +++ b/host_vars/cp-01.oopen.de/cp-01-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/cp-flr.oopen.de/cp-flr-common.yml b/host_vars/cp-flr.oopen.de/cp-flr-common.yml index 8a899b7..379f7ea 100644 --- a/host_vars/cp-flr.oopen.de/cp-flr-common.yml +++ b/host_vars/cp-flr.oopen.de/cp-flr-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/d.mx.oopen.de/d.mx-common.yml b/host_vars/d.mx.oopen.de/d.mx-common.yml index b0b4c17..9082371 100644 --- a/host_vars/d.mx.oopen.de/d.mx-common.yml +++ b/host_vars/d.mx.oopen.de/d.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/dc-opp.oopen.de/dc-opp-common.yml b/host_vars/dc-opp.oopen.de/dc-opp-common.yml index 8d89f6d..87fc04f 100644 --- a/host_vars/dc-opp.oopen.de/dc-opp-common.yml +++ b/host_vars/dc-opp.oopen.de/dc-opp-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/devel-db.wf.netz/devel-db-common.yml b/host_vars/devel-db.wf.netz/devel-db-common.yml index 9681da3..764ff52 100644 --- a/host_vars/devel-db.wf.netz/devel-db-common.yml +++ b/host_vars/devel-db.wf.netz/devel-db-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/devel-php.wf.netz/devel-php-common.yml b/host_vars/devel-php.wf.netz/devel-php-common.yml index eda97e2..13ade36 100644 --- a/host_vars/devel-php.wf.netz/devel-php-common.yml +++ b/host_vars/devel-php.wf.netz/devel-php-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/devel-repos.wf.netz/devel-repos-common.yml b/host_vars/devel-repos.wf.netz/devel-repos-common.yml index 9681da3..764ff52 100644 --- a/host_vars/devel-repos.wf.netz/devel-repos-common.yml +++ b/host_vars/devel-repos.wf.netz/devel-repos-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/devel-root.wf.netz/devel-root-common.yml b/host_vars/devel-root.wf.netz/devel-root-common.yml index 9681da3..764ff52 100644 --- a/host_vars/devel-root.wf.netz/devel-root-common.yml +++ b/host_vars/devel-root.wf.netz/devel-root-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/devel-wiki.wf.netz/devel-wiki-common.yml b/host_vars/devel-wiki.wf.netz/devel-wiki-common.yml index 9681da3..764ff52 100644 --- a/host_vars/devel-wiki.wf.netz/devel-wiki-common.yml +++ b/host_vars/devel-wiki.wf.netz/devel-wiki-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/dns0.warenform.de/dns0-common.yml b/host_vars/dns0.warenform.de/dns0-common.yml index 8d48a8e..31b87f1 100644 --- a/host_vars/dns0.warenform.de/dns0-common.yml +++ b/host_vars/dns0.warenform.de/dns0-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/dns1.warenform.de/dns1-common.yml b/host_vars/dns1.warenform.de/dns1-common.yml index 1fb4fdf..d5d63e6 100644 --- a/host_vars/dns1.warenform.de/dns1-common.yml +++ b/host_vars/dns1.warenform.de/dns1-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/e.mx.oopen.de/e.mx-common.yml b/host_vars/e.mx.oopen.de/e.mx-common.yml index 22d989d..fcd3eac 100644 --- a/host_vars/e.mx.oopen.de/e.mx-common.yml +++ b/host_vars/e.mx.oopen.de/e.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml b/host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml index 7232461..247af65 100644 --- a/host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml +++ b/host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml @@ -93,6 +93,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-blkr.blkr.netz/file-blkr-common.yml b/host_vars/file-blkr.blkr.netz/file-blkr-common.yml index 6cf25d1..9145083 100644 --- a/host_vars/file-blkr.blkr.netz/file-blkr-common.yml +++ b/host_vars/file-blkr.blkr.netz/file-blkr-common.yml @@ -90,6 +90,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-256 - ssh-rsa +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-dissens.dissens.netz/file-dissens-common.yml b/host_vars/file-dissens.dissens.netz/file-dissens-common.yml index 0ac9898..8b42bd0 100644 --- a/host_vars/file-dissens.dissens.netz/file-dissens-common.yml +++ b/host_vars/file-dissens.dissens.netz/file-dissens-common.yml @@ -68,6 +68,11 @@ network_interfaces: # vars used by roles/common/tasks/sshd.yml # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-ebs.ebs.netz/file-ebs-common.yml b/host_vars/file-ebs.ebs.netz/file-ebs-common.yml index 6ba3181..4edd3e4 100644 --- a/host_vars/file-ebs.ebs.netz/file-ebs-common.yml +++ b/host_vars/file-ebs.ebs.netz/file-ebs-common.yml @@ -92,6 +92,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-fhxb.fhxb.netz/file-fhxb-common.yml b/host_vars/file-fhxb.fhxb.netz/file-fhxb-common.yml index 50531c1..dac3933 100644 --- a/host_vars/file-fhxb.fhxb.netz/file-fhxb-common.yml +++ b/host_vars/file-fhxb.fhxb.netz/file-fhxb-common.yml @@ -69,6 +69,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-fm.fm.netz/file-fm-common.yml b/host_vars/file-fm.fm.netz/file-fm-common.yml index 7330be4..a0fbe50 100644 --- a/host_vars/file-fm.fm.netz/file-fm-common.yml +++ b/host_vars/file-fm.fm.netz/file-fm-common.yml @@ -68,6 +68,11 @@ network_interfaces: # vars used by roles/common/tasks/sshd.yml # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-kb.anw-kb.netz/file-kb-common.yml b/host_vars/file-kb.anw-kb.netz/file-kb-common.yml index 66e08fb..cd80cde 100644 --- a/host_vars/file-kb.anw-kb.netz/file-kb-common.yml +++ b/host_vars/file-kb.anw-kb.netz/file-kb-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-km-alt.anw-km.netz/file-km-alt-common.yml b/host_vars/file-km-alt.anw-km.netz/file-km-alt-common.yml index e2e06ea..3defb2b 100644 --- a/host_vars/file-km-alt.anw-km.netz/file-km-alt-common.yml +++ b/host_vars/file-km-alt.anw-km.netz/file-km-alt-common.yml @@ -89,6 +89,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/file-km.anw-km.netz/file-km-common.yml b/host_vars/file-km.anw-km.netz/file-km-common.yml index 8caf434..a8211f4 100644 --- a/host_vars/file-km.anw-km.netz/file-km-common.yml +++ b/host_vars/file-km.anw-km.netz/file-km-common.yml @@ -80,6 +80,11 @@ network_interfaces: # vars used by roles/common/tasks/sshd.yml # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml b/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml index 61f2b1f..d6321cc 100644 --- a/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml +++ b/host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/g.mx.oopen.de/g.mx-common.yml b/host_vars/g.mx.oopen.de/g.mx-common.yml index c44a37b..aac25d5 100644 --- a/host_vars/g.mx.oopen.de/g.mx-common.yml +++ b/host_vars/g.mx.oopen.de/g.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml b/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml index 837fb6a..81c6c7a 100644 --- a/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml +++ b/host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml @@ -270,6 +270,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml b/host_vars/ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml index 2c7d450..385b598 100644 --- a/host_vars/ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml +++ b/host_vars/ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml @@ -94,6 +94,11 @@ sudo_users: sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml b/host_vars/ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml index b1757b9..ab44c18 100644 --- a/host_vars/ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml +++ b/host_vars/ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml @@ -94,6 +94,11 @@ sudo_users: sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/ga-al-relay.ga.netz/ga-al-relay-common.yml b/host_vars/ga-al-relay.ga.netz/ga-al-relay-common.yml index 2fed804..68d498a 100644 --- a/host_vars/ga-al-relay.ga.netz/ga-al-relay-common.yml +++ b/host_vars/ga-al-relay.ga.netz/ga-al-relay-common.yml @@ -74,6 +74,11 @@ sudo_users: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-gh-gw.oopen.de/ga-gh-gw-common.yml b/host_vars/ga-gh-gw.oopen.de/ga-gh-gw-common.yml index 4a4e3df..0aa5c93 100644 --- a/host_vars/ga-gh-gw.oopen.de/ga-gh-gw-common.yml +++ b/host_vars/ga-gh-gw.oopen.de/ga-gh-gw-common.yml @@ -146,6 +146,11 @@ cron_user_special_time_entries: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-nh-gw.oopen.de/ga-nh-gw-common.yml b/host_vars/ga-nh-gw.oopen.de/ga-nh-gw-common.yml index d7de351..e3dde76 100644 --- a/host_vars/ga-nh-gw.oopen.de/ga-nh-gw-common.yml +++ b/host_vars/ga-nh-gw.oopen.de/ga-nh-gw-common.yml @@ -150,6 +150,11 @@ cron_user_special_time_entries: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-st-gw-ersatz.ga.netz/ga-st-gw-ersatz-common.yml b/host_vars/ga-st-gw-ersatz.ga.netz/ga-st-gw-ersatz-common.yml index 118310c..575ecb4 100644 --- a/host_vars/ga-st-gw-ersatz.ga.netz/ga-st-gw-ersatz-common.yml +++ b/host_vars/ga-st-gw-ersatz.ga.netz/ga-st-gw-ersatz-common.yml @@ -24,6 +24,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-st-gw.ga.netz/ga-st-gw-common.yml b/host_vars/ga-st-gw.ga.netz/ga-st-gw-common.yml index 70129b0..b62c3e8 100644 --- a/host_vars/ga-st-gw.ga.netz/ga-st-gw-common.yml +++ b/host_vars/ga-st-gw.ga.netz/ga-st-gw-common.yml @@ -320,6 +320,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml b/host_vars/ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml index d7e65ef..02814c8 100644 --- a/host_vars/ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml +++ b/host_vars/ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml @@ -94,6 +94,11 @@ sudo_users: sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml b/host_vars/ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml index 9138b56..baf08c9 100644 --- a/host_vars/ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml +++ b/host_vars/ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml @@ -166,6 +166,11 @@ sudo_users: sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml b/host_vars/ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml index b8e453d..3e13501 100644 --- a/host_vars/ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml +++ b/host_vars/ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml @@ -121,6 +121,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-st-mail.ga.netz/ga-st-mail-common.yml b/host_vars/ga-st-mail.ga.netz/ga-st-mail-common.yml index e64cf16..b198b2d 100644 --- a/host_vars/ga-st-mail.ga.netz/ga-st-mail-common.yml +++ b/host_vars/ga-st-mail.ga.netz/ga-st-mail-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/ga-st-services.ga.netz/ga-st-services-common.yml b/host_vars/ga-st-services.ga.netz/ga-st-services-common.yml index 9d7de31..4cc055a 100644 --- a/host_vars/ga-st-services.ga.netz/ga-st-services-common.yml +++ b/host_vars/ga-st-services.ga.netz/ga-st-services-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/git.oopen.de/git-common.yml b/host_vars/git.oopen.de/git-common.yml index a79f66a..1a26601 100644 --- a/host_vars/git.oopen.de/git-common.yml +++ b/host_vars/git.oopen.de/git-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/git.warenform.de/git-common.yml b/host_vars/git.warenform.de/git-common.yml index 29dcf47..56ef069 100644 --- a/host_vars/git.warenform.de/git-common.yml +++ b/host_vars/git.warenform.de/git-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-123.oopen.de/gw-123-common.yml b/host_vars/gw-123.oopen.de/gw-123-common.yml index c869328..b39b663 100644 --- a/host_vars/gw-123.oopen.de/gw-123-common.yml +++ b/host_vars/gw-123.oopen.de/gw-123-common.yml @@ -36,6 +36,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-ah.oopen.de/gw-ah-common.yml b/host_vars/gw-ah.oopen.de/gw-ah-common.yml index 2a9dacb..a626c05 100644 --- a/host_vars/gw-ah.oopen.de/gw-ah-common.yml +++ b/host_vars/gw-ah.oopen.de/gw-ah-common.yml @@ -31,6 +31,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-ak.oopen.de/gw-ak-common.yml b/host_vars/gw-ak.oopen.de/gw-ak-common.yml index 401db02..2fcc628 100644 --- a/host_vars/gw-ak.oopen.de/gw-ak-common.yml +++ b/host_vars/gw-ak.oopen.de/gw-ak-common.yml @@ -81,6 +81,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-akb.oopen.de/gw-akb-common.yml b/host_vars/gw-akb.oopen.de/gw-akb-common.yml index 90f3a54..6366298 100644 --- a/host_vars/gw-akb.oopen.de/gw-akb-common.yml +++ b/host_vars/gw-akb.oopen.de/gw-akb-common.yml @@ -36,6 +36,11 @@ copy_additional_plain_files_sysctl: # - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-b3.oopen.de/gw-b3-common.yml b/host_vars/gw-b3.oopen.de/gw-b3-common.yml index 0f163fa..12786da 100644 --- a/host_vars/gw-b3.oopen.de/gw-b3-common.yml +++ b/host_vars/gw-b3.oopen.de/gw-b3-common.yml @@ -36,6 +36,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-blkr.oopen.de/gw-blkr-common.yml b/host_vars/gw-blkr.oopen.de/gw-blkr-common.yml index 9f0ef88..411b765 100644 --- a/host_vars/gw-blkr.oopen.de/gw-blkr-common.yml +++ b/host_vars/gw-blkr.oopen.de/gw-blkr-common.yml @@ -146,6 +146,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-campus.oopen.de/gw-campus-common.yml b/host_vars/gw-campus.oopen.de/gw-campus-common.yml index 9f9cba0..103f6e0 100644 --- a/host_vars/gw-campus.oopen.de/gw-campus-common.yml +++ b/host_vars/gw-campus.oopen.de/gw-campus-common.yml @@ -183,6 +183,11 @@ cron_user_special_time_entries: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-ckubu.local.netz/gw-ckubu-common.yml b/host_vars/gw-ckubu.local.netz/gw-ckubu-common.yml index 3eda47a..43a5481 100644 --- a/host_vars/gw-ckubu.local.netz/gw-ckubu-common.yml +++ b/host_vars/gw-ckubu.local.netz/gw-ckubu-common.yml @@ -27,6 +27,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-256-cert-v01@openssh.com - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-d11.oopen.de/gw-d11-common.yml b/host_vars/gw-d11.oopen.de/gw-d11-common.yml index c82fef5..b49971b 100644 --- a/host_vars/gw-d11.oopen.de/gw-d11-common.yml +++ b/host_vars/gw-d11.oopen.de/gw-d11-common.yml @@ -36,6 +36,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-dissens.oopen.de/gw-dissens-common.yml b/host_vars/gw-dissens.oopen.de/gw-dissens-common.yml index dea19a5..aa37654 100644 --- a/host_vars/gw-dissens.oopen.de/gw-dissens-common.yml +++ b/host_vars/gw-dissens.oopen.de/gw-dissens-common.yml @@ -77,6 +77,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-ebs.oopen.de/gw-ebs-common.yml b/host_vars/gw-ebs.oopen.de/gw-ebs-common.yml index 88991d6..985af44 100644 --- a/host_vars/gw-ebs.oopen.de/gw-ebs-common.yml +++ b/host_vars/gw-ebs.oopen.de/gw-ebs-common.yml @@ -77,6 +77,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-elster.oopen.de/gw-elster-common.yml b/host_vars/gw-elster.oopen.de/gw-elster-common.yml index 68d8d83..0e3aee2 100644 --- a/host_vars/gw-elster.oopen.de/gw-elster-common.yml +++ b/host_vars/gw-elster.oopen.de/gw-elster-common.yml @@ -147,6 +147,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml b/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml index a66456e..97be208 100644 --- a/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml +++ b/host_vars/gw-fhxb.oopen.de/gw-fhxb-common.yml @@ -85,6 +85,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-flr.oopen.de/gw-flr-common.yml b/host_vars/gw-flr.oopen.de/gw-flr-common.yml index 1fa4e0e..194d85b 100644 --- a/host_vars/gw-flr.oopen.de/gw-flr-common.yml +++ b/host_vars/gw-flr.oopen.de/gw-flr-common.yml @@ -145,6 +145,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-fm.oopen.de/gw-fm-common.yml b/host_vars/gw-fm.oopen.de/gw-fm-common.yml index 047143f..edfae2b 100644 --- a/host_vars/gw-fm.oopen.de/gw-fm-common.yml +++ b/host_vars/gw-fm.oopen.de/gw-fm-common.yml @@ -98,6 +98,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-irights.oopen.de/gw-irights-common.yml b/host_vars/gw-irights.oopen.de/gw-irights-common.yml index f0c6b89..3f24325 100644 --- a/host_vars/gw-irights.oopen.de/gw-irights-common.yml +++ b/host_vars/gw-irights.oopen.de/gw-irights-common.yml @@ -142,6 +142,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-kb.oopen.de/gw-kb-common.yml b/host_vars/gw-kb.oopen.de/gw-kb-common.yml index 4d07d97..bb6c82d 100644 --- a/host_vars/gw-kb.oopen.de/gw-kb-common.yml +++ b/host_vars/gw-kb.oopen.de/gw-kb-common.yml @@ -133,6 +133,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-km.oopen.de/gw-km-common.yml b/host_vars/gw-km.oopen.de/gw-km-common.yml index c7a9050..50e5c3b 100644 --- a/host_vars/gw-km.oopen.de/gw-km-common.yml +++ b/host_vars/gw-km.oopen.de/gw-km-common.yml @@ -132,6 +132,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-mbr.oopen.de/gw-mbr-common.yml b/host_vars/gw-mbr.oopen.de/gw-mbr-common.yml index 0dfbdb1..0e8ad7f 100644 --- a/host_vars/gw-mbr.oopen.de/gw-mbr-common.yml +++ b/host_vars/gw-mbr.oopen.de/gw-mbr-common.yml @@ -98,6 +98,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-opp.oopen.de/gw-opp-common.yml b/host_vars/gw-opp.oopen.de/gw-opp-common.yml index 4203568..2838cab 100644 --- a/host_vars/gw-opp.oopen.de/gw-opp-common.yml +++ b/host_vars/gw-opp.oopen.de/gw-opp-common.yml @@ -81,6 +81,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-replacement.local.netz/gw-replacement-common.yml b/host_vars/gw-replacement.local.netz/gw-replacement-common.yml index 609cab3..732774f 100644 --- a/host_vars/gw-replacement.local.netz/gw-replacement-common.yml +++ b/host_vars/gw-replacement.local.netz/gw-replacement-common.yml @@ -36,6 +36,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/gw-spr.oopen.de/gw-spr-common.yml b/host_vars/gw-spr.oopen.de/gw-spr-common.yml index 2025ac6..e94fee1 100644 --- a/host_vars/gw-spr.oopen.de/gw-spr-common.yml +++ b/host_vars/gw-spr.oopen.de/gw-spr-common.yml @@ -36,6 +36,11 @@ sshd_hostkeyalgorithms: - rsa-sha2-512-cert-v01@openssh.com +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/h.mx.oopen.de/h.mx-common.yml b/host_vars/h.mx.oopen.de/h.mx-common.yml index c80f2cb..b4ddb56 100644 --- a/host_vars/h.mx.oopen.de/h.mx-common.yml +++ b/host_vars/h.mx.oopen.de/h.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/iam-nd.oopen.de/iam-nd-common.yml b/host_vars/iam-nd.oopen.de/iam-nd-common.yml index 600c655..0b79206 100644 --- a/host_vars/iam-nd.oopen.de/iam-nd-common.yml +++ b/host_vars/iam-nd.oopen.de/iam-nd-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml b/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml index 61f6025..e6dd94a 100644 --- a/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml +++ b/host_vars/initiativenserver.oopen.de/initiativenserver-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml index b12d5b8..648de74 100644 --- a/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml +++ b/host_vars/keycloak-nd.oopen.de/keycloak-nd-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/lists.mx.warenform.de/lists.mx-common.yml b/host_vars/lists.mx.warenform.de/lists.mx-common.yml index a550da9..88da1bb 100644 --- a/host_vars/lists.mx.warenform.de/lists.mx-common.yml +++ b/host_vars/lists.mx.warenform.de/lists.mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml b/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml index 0b32e61..a300fe7 100644 --- a/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml +++ b/host_vars/lxc-host-kb.anw-kb.netz/lxc-host-kb-common.yml @@ -28,6 +28,11 @@ sshd_pubkey_authentication: !!str "yes" sshd_password_authentication: !!str "yes" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mail.cadus.org/mail-common.yml b/host_vars/mail.cadus.org/mail-common.yml index 0aab29a..7e8fc68 100644 --- a/host_vars/mail.cadus.org/mail-common.yml +++ b/host_vars/mail.cadus.org/mail-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mail.faire-mobilitaet.de/mail-common.yml b/host_vars/mail.faire-mobilitaet.de/mail-common.yml index d6e8b6e..d5c3094 100644 --- a/host_vars/mail.faire-mobilitaet.de/mail-common.yml +++ b/host_vars/mail.faire-mobilitaet.de/mail-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/matomo-01.oopen.de/matomo-01-common.yml b/host_vars/matomo-01.oopen.de/matomo-01-common.yml index c63bc4d..198d2e7 100644 --- a/host_vars/matomo-01.oopen.de/matomo-01-common.yml +++ b/host_vars/matomo-01.oopen.de/matomo-01-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/meet.akweb.de/meet-common.yml b/host_vars/meet.akweb.de/meet-common.yml index 9f3e71d..1061789 100644 --- a/host_vars/meet.akweb.de/meet-common.yml +++ b/host_vars/meet.akweb.de/meet-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/meet.oopen.de/meet-common.yml b/host_vars/meet.oopen.de/meet-common.yml index c60ae1b..007551c 100644 --- a/host_vars/meet.oopen.de/meet-common.yml +++ b/host_vars/meet.oopen.de/meet-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mm-irights.oopen.de/mm-irights-common.yml b/host_vars/mm-irights.oopen.de/mm-irights-common.yml index 633ef47..f823c88 100644 --- a/host_vars/mm-irights.oopen.de/mm-irights-common.yml +++ b/host_vars/mm-irights.oopen.de/mm-irights-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml b/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml index 96a41c6..fb5c3eb 100644 --- a/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml +++ b/host_vars/mm-nd-test.oopen.de/mm-nd-test-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mm-nd.oopen.de/mm-nd-common.yml b/host_vars/mm-nd.oopen.de/mm-nd-common.yml index 96a41c6..fb5c3eb 100644 --- a/host_vars/mm-nd.oopen.de/mm-nd-common.yml +++ b/host_vars/mm-nd.oopen.de/mm-nd-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mm-rav.oopen.de/mm-rav-common.yml b/host_vars/mm-rav.oopen.de/mm-rav-common.yml index af33869..bf761da 100644 --- a/host_vars/mm-rav.oopen.de/mm-rav-common.yml +++ b/host_vars/mm-rav.oopen.de/mm-rav-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mm.oopen.de/mm-common.yml b/host_vars/mm.oopen.de/mm-common.yml index 0168711..d198eed 100644 --- a/host_vars/mm.oopen.de/mm-common.yml +++ b/host_vars/mm.oopen.de/mm-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/munin.oopen.de/munin-common.yml b/host_vars/munin.oopen.de/munin-common.yml index 738429b..d2203d8 100644 --- a/host_vars/munin.oopen.de/munin-common.yml +++ b/host_vars/munin.oopen.de/munin-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/mx.warenform.de/mx-common.yml b/host_vars/mx.warenform.de/mx-common.yml index 645a9dc..8d0921a 100644 --- a/host_vars/mx.warenform.de/mx-common.yml +++ b/host_vars/mx.warenform.de/mx-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml b/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml index 469f957..c63ed77 100644 --- a/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml +++ b/host_vars/nd-archiv.warenform.de/nd-archiv-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/nd-live.warenform.de/nd-live-common.yml b/host_vars/nd-live.warenform.de/nd-live-common.yml index 469f957..c63ed77 100644 --- a/host_vars/nd-live.warenform.de/nd-live-common.yml +++ b/host_vars/nd-live.warenform.de/nd-live-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/nd.warenform.de/nd-common.yml b/host_vars/nd.warenform.de/nd-common.yml index 469f957..c63ed77 100644 --- a/host_vars/nd.warenform.de/nd-common.yml +++ b/host_vars/nd.warenform.de/nd-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o12.oopen.de/o12-common.yml b/host_vars/o12.oopen.de/o12-common.yml index f307c1d..6168b4f 100644 --- a/host_vars/o12.oopen.de/o12-common.yml +++ b/host_vars/o12.oopen.de/o12-common.yml @@ -140,6 +140,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml index 4f8057e..f052816 100644 --- a/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml +++ b/host_vars/o13-cryptpad.oopen.de/o13-cryptpad-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-mail.oopen.de/o13-mail-common.yml b/host_vars/o13-mail.oopen.de/o13-mail-common.yml index 4422ead..d4ccafb 100644 --- a/host_vars/o13-mail.oopen.de/o13-mail-common.yml +++ b/host_vars/o13-mail.oopen.de/o13-mail-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml b/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml index 4f8057e..f052816 100644 --- a/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml +++ b/host_vars/o13-mumble.oopen.de/o13-mumble-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-pad.oopen.de/o13-pad-common.yml b/host_vars/o13-pad.oopen.de/o13-pad-common.yml index 4f8057e..f052816 100644 --- a/host_vars/o13-pad.oopen.de/o13-pad-common.yml +++ b/host_vars/o13-pad.oopen.de/o13-pad-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml b/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml index 7ddcc02..735dbe7 100644 --- a/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml +++ b/host_vars/o13-staging-board.oopen.de/o13-staging-board-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13-web.oopen.de/o13-web-common.yml b/host_vars/o13-web.oopen.de/o13-web-common.yml index 4f8057e..f052816 100644 --- a/host_vars/o13-web.oopen.de/o13-web-common.yml +++ b/host_vars/o13-web.oopen.de/o13-web-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o13.oopen.de/o13-common.yml b/host_vars/o13.oopen.de/o13-common.yml index 019d0f5..2a4672b 100644 --- a/host_vars/o13.oopen.de/o13-common.yml +++ b/host_vars/o13.oopen.de/o13-common.yml @@ -42,6 +42,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o17.oopen.de/o17-common.yml b/host_vars/o17.oopen.de/o17-common.yml index 99fb5e2..b09a929 100644 --- a/host_vars/o17.oopen.de/o17-common.yml +++ b/host_vars/o17.oopen.de/o17-common.yml @@ -140,6 +140,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o18.oopen.de/o18-common.yml b/host_vars/o18.oopen.de/o18-common.yml index 360328b..9820649 100644 --- a/host_vars/o18.oopen.de/o18-common.yml +++ b/host_vars/o18.oopen.de/o18-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o19.oopen.de/o19-common.yml b/host_vars/o19.oopen.de/o19-common.yml index 81886bf..14fe71a 100644 --- a/host_vars/o19.oopen.de/o19-common.yml +++ b/host_vars/o19.oopen.de/o19-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o20.oopen.de/o20-common.yml b/host_vars/o20.oopen.de/o20-common.yml index 005df94..f0c2a3e 100644 --- a/host_vars/o20.oopen.de/o20-common.yml +++ b/host_vars/o20.oopen.de/o20-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o21.oopen.de/o21-common.yml b/host_vars/o21.oopen.de/o21-common.yml index b6984ce..57b0da1 100644 --- a/host_vars/o21.oopen.de/o21-common.yml +++ b/host_vars/o21.oopen.de/o21-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o22.oopen.de/o22-common.yml b/host_vars/o22.oopen.de/o22-common.yml index 84fe731..d3a6599 100644 --- a/host_vars/o22.oopen.de/o22-common.yml +++ b/host_vars/o22.oopen.de/o22-common.yml @@ -140,6 +140,11 @@ copy_additional_plain_files_sysctl: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o23.oopen.de/o23-common.yml b/host_vars/o23.oopen.de/o23-common.yml index 377ec83..74d3fdf 100644 --- a/host_vars/o23.oopen.de/o23-common.yml +++ b/host_vars/o23.oopen.de/o23-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o24.oopen.de/o24-common.yml b/host_vars/o24.oopen.de/o24-common.yml index 357db86..1b59c13 100644 --- a/host_vars/o24.oopen.de/o24-common.yml +++ b/host_vars/o24.oopen.de/o24-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o25.oopen.de/o25-common.yml b/host_vars/o25.oopen.de/o25-common.yml index abd0642..b886669 100644 --- a/host_vars/o25.oopen.de/o25-common.yml +++ b/host_vars/o25.oopen.de/o25-common.yml @@ -253,6 +253,11 @@ network_interfaces: create_sftp_group: true +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o26.oopen.de/o26-common.yml b/host_vars/o26.oopen.de/o26-common.yml index 08ed184..e181da9 100644 --- a/host_vars/o26.oopen.de/o26-common.yml +++ b/host_vars/o26.oopen.de/o26-common.yml @@ -276,6 +276,11 @@ root_ssh_keypair: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o27.oopen.de/o27-common.yml b/host_vars/o27.oopen.de/o27-common.yml index 60a258c..494fd28 100644 --- a/host_vars/o27.oopen.de/o27-common.yml +++ b/host_vars/o27.oopen.de/o27-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o28.oopen.de/o28-common.yml b/host_vars/o28.oopen.de/o28-common.yml index c30992f..ce79905 100644 --- a/host_vars/o28.oopen.de/o28-common.yml +++ b/host_vars/o28.oopen.de/o28-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o29.oopen.de/o29-common.yml b/host_vars/o29.oopen.de/o29-common.yml index b05c830..eafe6ab 100644 --- a/host_vars/o29.oopen.de/o29-common.yml +++ b/host_vars/o29.oopen.de/o29-common.yml @@ -141,6 +141,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o30.oopen.de/o30-common.yml b/host_vars/o30.oopen.de/o30-common.yml index ed25441..762bac4 100644 --- a/host_vars/o30.oopen.de/o30-common.yml +++ b/host_vars/o30.oopen.de/o30-common.yml @@ -130,6 +130,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o31.oopen.de/o31-common.yml b/host_vars/o31.oopen.de/o31-common.yml index 4f11384..411b5f8 100644 --- a/host_vars/o31.oopen.de/o31-common.yml +++ b/host_vars/o31.oopen.de/o31-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o32.oopen.de/o32-common.yml b/host_vars/o32.oopen.de/o32-common.yml index 7bc6ac2..c3be37e 100644 --- a/host_vars/o32.oopen.de/o32-common.yml +++ b/host_vars/o32.oopen.de/o32-common.yml @@ -142,6 +142,11 @@ sshd_login_grace_time: 0 sshd_permit_root_login: !!str "no" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o34.oopen.de/o34-common.yml b/host_vars/o34.oopen.de/o34-common.yml index be50780..6307e73 100644 --- a/host_vars/o34.oopen.de/o34-common.yml +++ b/host_vars/o34.oopen.de/o34-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o35.oopen.de/o35-common.yml b/host_vars/o35.oopen.de/o35-common.yml index 83fd917..0dcfbe6 100644 --- a/host_vars/o35.oopen.de/o35-common.yml +++ b/host_vars/o35.oopen.de/o35-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o36.oopen.de/o36-common.yml b/host_vars/o36.oopen.de/o36-common.yml index 90d6a66..173240f 100644 --- a/host_vars/o36.oopen.de/o36-common.yml +++ b/host_vars/o36.oopen.de/o36-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o38.oopen.de/o38-common.yml b/host_vars/o38.oopen.de/o38-common.yml index 4b31e99..a1cb3d6 100644 --- a/host_vars/o38.oopen.de/o38-common.yml +++ b/host_vars/o38.oopen.de/o38-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o39.oopen.de/o39-common.yml b/host_vars/o39.oopen.de/o39-common.yml index e129455..52dfa11 100644 --- a/host_vars/o39.oopen.de/o39-common.yml +++ b/host_vars/o39.oopen.de/o39-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o40.oopen.de/o40-common.yml b/host_vars/o40.oopen.de/o40-common.yml index 92c2754..c90b9cd 100644 --- a/host_vars/o40.oopen.de/o40-common.yml +++ b/host_vars/o40.oopen.de/o40-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o41.oopen.de/o41-common.yml b/host_vars/o41.oopen.de/o41-common.yml index 036720e..8325c4c 100644 --- a/host_vars/o41.oopen.de/o41-common.yml +++ b/host_vars/o41.oopen.de/o41-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o42.oopen.de/o42-common.yml b/host_vars/o42.oopen.de/o42-common.yml index 4581ad3..a9511f0 100644 --- a/host_vars/o42.oopen.de/o42-common.yml +++ b/host_vars/o42.oopen.de/o42-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o43.oopen.de/o43-common.yml b/host_vars/o43.oopen.de/o43-common.yml index 35b0473..e06247d 100644 --- a/host_vars/o43.oopen.de/o43-common.yml +++ b/host_vars/o43.oopen.de/o43-common.yml @@ -230,6 +230,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o44.oopen.de/o44-common.yml b/host_vars/o44.oopen.de/o44-common.yml index 08544a0..60b60c3 100644 --- a/host_vars/o44.oopen.de/o44-common.yml +++ b/host_vars/o44.oopen.de/o44-common.yml @@ -138,6 +138,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/o45.oopen.de/o45-common.yml b/host_vars/o45.oopen.de/o45-common.yml index fe11f58..bd2a804 100644 --- a/host_vars/o45.oopen.de/o45-common.yml +++ b/host_vars/o45.oopen.de/o45-common.yml @@ -139,6 +139,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-common.yml b/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-common.yml index 84de24d..b059471 100644 --- a/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-common.yml +++ b/host_vars/oolm-shop-dev.oopen.de/oolm-shop-dev-common.yml @@ -29,6 +29,11 @@ sshd_pubkey_accepted_algorithms: - +ssh-rsa +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/oolm-shop.oopen.de/oolm-shop-common.yml b/host_vars/oolm-shop.oopen.de/oolm-shop-common.yml index a39dadd..a9d63a0 100644 --- a/host_vars/oolm-shop.oopen.de/oolm-shop-common.yml +++ b/host_vars/oolm-shop.oopen.de/oolm-shop-common.yml @@ -33,6 +33,11 @@ sshd_pubkey_accepted_algorithms: sshd_pasword_auth_ip: - 34.107.7.34 +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/oolm-web.oopen.de/oolm-web-common.yml b/host_vars/oolm-web.oopen.de/oolm-web-common.yml index 61f6025..e6dd94a 100644 --- a/host_vars/oolm-web.oopen.de/oolm-web-common.yml +++ b/host_vars/oolm-web.oopen.de/oolm-web-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/piwik.warenform.de/piwik-common.yml b/host_vars/piwik.warenform.de/piwik-common.yml index 5618695..58021d7 100644 --- a/host_vars/piwik.warenform.de/piwik-common.yml +++ b/host_vars/piwik.warenform.de/piwik-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml b/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml index fa3b5af..b90322f 100644 --- a/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml +++ b/host_vars/prometheus-nd.oopen.de/prometheus-nd-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/psono-ndm.oopen.de/psono-ndm-common.yml b/host_vars/psono-ndm.oopen.de/psono-ndm-common.yml index 6531ca1..7df45ed 100644 --- a/host_vars/psono-ndm.oopen.de/psono-ndm-common.yml +++ b/host_vars/psono-ndm.oopen.de/psono-ndm-common.yml @@ -21,6 +21,11 @@ sshd_permit_root_login: !!str "prohibit-password" +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by apt.yml # --- diff --git a/host_vars/rage.so36.net/rage-common.yml b/host_vars/rage.so36.net/rage-common.yml index 35db0b8..0ed6b45 100644 --- a/host_vars/rage.so36.net/rage-common.yml +++ b/host_vars/rage.so36.net/rage-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server18.warenform.de/server18-common.yml b/host_vars/server18.warenform.de/server18-common.yml index e6cd68d..7ae9a80 100644 --- a/host_vars/server18.warenform.de/server18-common.yml +++ b/host_vars/server18.warenform.de/server18-common.yml @@ -136,6 +136,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server22.warenform.de/server22-common.yml b/host_vars/server22.warenform.de/server22-common.yml index 8e34522..ab2a4db 100644 --- a/host_vars/server22.warenform.de/server22-common.yml +++ b/host_vars/server22.warenform.de/server22-common.yml @@ -123,6 +123,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server23.warenform.de/server23-common.yml b/host_vars/server23.warenform.de/server23-common.yml index bc28799..c375baa 100644 --- a/host_vars/server23.warenform.de/server23-common.yml +++ b/host_vars/server23.warenform.de/server23-common.yml @@ -123,6 +123,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server24.warenform.de/server24-common.yml b/host_vars/server24.warenform.de/server24-common.yml index c4ddde4..b7bb410 100644 --- a/host_vars/server24.warenform.de/server24-common.yml +++ b/host_vars/server24.warenform.de/server24-common.yml @@ -130,6 +130,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server25.warenform.de/server25-common.yml b/host_vars/server25.warenform.de/server25-common.yml index 97b634c..d3f3e7b 100644 --- a/host_vars/server25.warenform.de/server25-common.yml +++ b/host_vars/server25.warenform.de/server25-common.yml @@ -131,6 +131,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server26.warenform.de/server26-common.yml b/host_vars/server26.warenform.de/server26-common.yml index bc306a1..be0998b 100644 --- a/host_vars/server26.warenform.de/server26-common.yml +++ b/host_vars/server26.warenform.de/server26-common.yml @@ -143,6 +143,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/server27.warenform.de/server27-common.yml b/host_vars/server27.warenform.de/server27-common.yml index fa855d6..361475c 100644 --- a/host_vars/server27.warenform.de/server27-common.yml +++ b/host_vars/server27.warenform.de/server27-common.yml @@ -150,6 +150,11 @@ copy_additional_plain_files_sysctl: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/sftp-nd.oopen.de/sftp-nd-common.yml b/host_vars/sftp-nd.oopen.de/sftp-nd-common.yml index 2f5dc69..7924ae3 100644 --- a/host_vars/sftp-nd.oopen.de/sftp-nd-common.yml +++ b/host_vars/sftp-nd.oopen.de/sftp-nd-common.yml @@ -21,6 +21,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/stolpersteine.oopen.de/stolpersteine-common.yml b/host_vars/stolpersteine.oopen.de/stolpersteine-common.yml index 48c9b2b..e3c9dbe 100644 --- a/host_vars/stolpersteine.oopen.de/stolpersteine-common.yml +++ b/host_vars/stolpersteine.oopen.de/stolpersteine-common.yml @@ -111,6 +111,11 @@ resolved_fallback_nameserver: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/sudoers.yml # --- diff --git a/host_vars/test.mariadb.oopen.de/test.mariadb-common.yml b/host_vars/test.mariadb.oopen.de/test.mariadb-common.yml index 4223991..780cf78 100644 --- a/host_vars/test.mariadb.oopen.de/test.mariadb-common.yml +++ b/host_vars/test.mariadb.oopen.de/test.mariadb-common.yml @@ -38,6 +38,11 @@ cron_env_entries: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/test.mx.oopen.de/test.mx-common.yml b/host_vars/test.mx.oopen.de/test.mx-common.yml index cbcea43..e5228a0 100644 --- a/host_vars/test.mx.oopen.de/test.mx-common.yml +++ b/host_vars/test.mx.oopen.de/test.mx-common.yml @@ -50,6 +50,11 @@ cron_env_entries: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/users.yml # --- diff --git a/host_vars/verdi-django.warenform.de/verdi-django-common.yml b/host_vars/verdi-django.warenform.de/verdi-django-common.yml index fd931b2..acb48f9 100644 --- a/host_vars/verdi-django.warenform.de/verdi-django-common.yml +++ b/host_vars/verdi-django.warenform.de/verdi-django-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml b/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml index 10432fe..1178805 100644 --- a/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml +++ b/host_vars/vvn-shop.warenform.de/vvn-shop-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/vvn-www.warenform.de/vvn-www-common.yml b/host_vars/vvn-www.warenform.de/vvn-www-common.yml index 8022610..fc8551f 100644 --- a/host_vars/vvn-www.warenform.de/vvn-www-common.yml +++ b/host_vars/vvn-www.warenform.de/vvn-www-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-01.oopen.de/web-01-common.yml b/host_vars/web-01.oopen.de/web-01-common.yml index 9036caa..8d5a69a 100644 --- a/host_vars/web-01.oopen.de/web-01-common.yml +++ b/host_vars/web-01.oopen.de/web-01-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-02.oopen.de/web-02-common.yml b/host_vars/web-02.oopen.de/web-02-common.yml index 9036caa..8d5a69a 100644 --- a/host_vars/web-02.oopen.de/web-02-common.yml +++ b/host_vars/web-02.oopen.de/web-02-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-03.oopen.de/web-03-common.yml b/host_vars/web-03.oopen.de/web-03-common.yml index 9036caa..8d5a69a 100644 --- a/host_vars/web-03.oopen.de/web-03-common.yml +++ b/host_vars/web-03.oopen.de/web-03-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-04.oopen.de/web-04-common.yml b/host_vars/web-04.oopen.de/web-04-common.yml index 9036caa..8d5a69a 100644 --- a/host_vars/web-04.oopen.de/web-04-common.yml +++ b/host_vars/web-04.oopen.de/web-04-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-05.oopen.de/web-05-common.yml b/host_vars/web-05.oopen.de/web-05-common.yml index 6a00efa..19cfcdb 100644 --- a/host_vars/web-05.oopen.de/web-05-common.yml +++ b/host_vars/web-05.oopen.de/web-05-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-06.oopen.de/web-06-common.yml b/host_vars/web-06.oopen.de/web-06-common.yml index 6a00efa..19cfcdb 100644 --- a/host_vars/web-06.oopen.de/web-06-common.yml +++ b/host_vars/web-06.oopen.de/web-06-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-07.oopen.de/web-07-common.yml b/host_vars/web-07.oopen.de/web-07-common.yml index 6a00efa..19cfcdb 100644 --- a/host_vars/web-07.oopen.de/web-07-common.yml +++ b/host_vars/web-07.oopen.de/web-07-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-08.oopen.de/web-08-common.yml b/host_vars/web-08.oopen.de/web-08-common.yml index 6a00efa..19cfcdb 100644 --- a/host_vars/web-08.oopen.de/web-08-common.yml +++ b/host_vars/web-08.oopen.de/web-08-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-09.oopen.de/web-09-common.yml b/host_vars/web-09.oopen.de/web-09-common.yml index 9af2b54..6a6d760 100644 --- a/host_vars/web-09.oopen.de/web-09-common.yml +++ b/host_vars/web-09.oopen.de/web-09-common.yml @@ -22,6 +22,11 @@ # sshd_login_grace_time: 0 +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web-nd.oopen.de/web-nd-common.yml b/host_vars/web-nd.oopen.de/web-nd-common.yml index 4e18d25..e0cd896 100644 --- a/host_vars/web-nd.oopen.de/web-nd-common.yml +++ b/host_vars/web-nd.oopen.de/web-nd-common.yml @@ -25,6 +25,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web.cadus.org/web-common.yml b/host_vars/web.cadus.org/web-common.yml index cdb04aa..cbbebc5 100644 --- a/host_vars/web.cadus.org/web-common.yml +++ b/host_vars/web.cadus.org/web-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web0.warenform.de/web0-common.yml b/host_vars/web0.warenform.de/web0-common.yml index 4baa463..0d28b29 100644 --- a/host_vars/web0.warenform.de/web0-common.yml +++ b/host_vars/web0.warenform.de/web0-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web1.warenform.de/web1-common.yml b/host_vars/web1.warenform.de/web1-common.yml index e1b176e..de5b58d 100644 --- a/host_vars/web1.warenform.de/web1-common.yml +++ b/host_vars/web1.warenform.de/web1-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/web2.warenform.de/web2-common.yml b/host_vars/web2.warenform.de/web2-common.yml index 96d152b..a856d55 100644 --- a/host_vars/web2.warenform.de/web2-common.yml +++ b/host_vars/web2.warenform.de/web2-common.yml @@ -20,6 +20,11 @@ # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/host_vars/zapata.opp.netz/zapata-common.yml b/host_vars/zapata.opp.netz/zapata-common.yml index 404eb60..4802f4f 100644 --- a/host_vars/zapata.opp.netz/zapata-common.yml +++ b/host_vars/zapata.opp.netz/zapata-common.yml @@ -69,6 +69,11 @@ network_interfaces: # --- +# --- +# vars used by roles/common/tasks/sftpd.yml +# --- + + # --- # vars used by roles/common/tasks/apt.yml # --- diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 2ed579c..debee12 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -180,6 +180,15 @@ ansible.builtin.import_tasks: sshd.yml tags: sshd +# tags supported inside sftpd.yml +# +# sftpd +- name: (main.yml) Import sftpd.yml tasks + ansible.builtin.import_tasks: sftpd.yml + when: + - chrooted_sftpd_present is defined and chrooted_sftpd_present | bool + tags: sftpd + # tags supported inside sudoers.yml: # # sudoers-remove diff --git a/roles/common/tasks/sftpd.yml b/roles/common/tasks/sftpd.yml new file mode 100644 index 0000000..665d7b4 --- /dev/null +++ b/roles/common/tasks/sftpd.yml @@ -0,0 +1,369 @@ +--- +# --- +# Chrooted SFTP access +# +# Controlled by 'chrooted_sftpd_present' (default: false). +# +# - group '{{ sftp_group_name }}' (GID 200 or next free GID above) +# - sshd config '/etc/ssh/sshd_config.d/90-sshd-SFTP.conf' +# - sftp users from list 'sftp_user' (UID 201 or next free UID above) +# +# Chroot requirements (enforced by sshd): +# The home directory (= ChrootDirectory) and all its parents must be +# owned by root and not writable by group/others. Therefore the users +# home is owned by root and the user gets a writable subdirectory +# (default: 'upload'). +# +# authorized_keys is placed at /.ssh/authorized_keys and is +# owned by root, so sftp users can read but not change their keys. +# --- + +# --- +# Group +# --- + +- name: (sftpd.yml) Get group database + ansible.builtin.getent: + database: group + tags: + - sftpd + +- name: "(sftpd.yml) Determine GID for sftp group: {{ sftp_group_name }}" + ansible.builtin.set_fact: + common_fact_sftp_gid: >- + {%- if sftp_group_name in ansible_facts.getent_group -%} + {{ ansible_facts.getent_group[sftp_group_name][1] }} + {%- else -%} + {%- set used = ansible_facts.getent_group.values() | map(attribute=1) | map('int') | list -%} + {%- set ns = namespace(gid=sftp_group_id_start | int) -%} + {%- for _ in range(1000) if ns.gid in used -%} + {%- set ns.gid = ns.gid + 1 -%} + {%- endfor -%} + {{ ns.gid }} + {%- endif -%} + tags: + - sftpd + +- name: "(sftpd.yml) Ensure sftp group exists: {{ sftp_group_name }}" + ansible.builtin.group: + name: "{{ sftp_group_name }}" + gid: "{{ common_fact_sftp_gid }}" + state: present + tags: + - sftpd + +# --- +# sshd configuration +# --- + +- name: (sftpd.yml) Ensure directory '/etc/ssh/sshd_config.d' exists + ansible.builtin.file: + path: /etc/ssh/sshd_config.d + state: directory + owner: root + group: root + mode: "0755" + tags: + - sftpd + +- name: (sftpd.yml) Create/Update '/etc/ssh/sshd_config.d/90-sshd-SFTP.conf' + ansible.builtin.template: + src: etc/ssh/sshd_config.d/90-sshd-SFTP.conf.j2 + dest: /etc/ssh/sshd_config.d/90-sshd-SFTP.conf + owner: root + group: root + mode: "0644" + register: common_sftpd_config + notify: "Restart ssh" + tags: + - sftpd + +# The drop-in file can't be validated on its own (no HostKey etc.), so +# test the complete configuration. A failure stops the play for this host +# before the 'Restart ssh' handler runs. +- name: (sftpd.yml) Validate complete sshd configuration # noqa: no-handler + ansible.builtin.command: + cmd: /usr/sbin/sshd -t + changed_when: false + when: common_sftpd_config is changed + tags: + - sftpd + +# Restart sshd right now (if notified) - otherwise a failure in one of the +# following tasks would leave the changed config unapplied, and a later run +# wouldn't notify the handler again (file already up to date). +- name: (sftpd.yml) Apply changed sshd configuration now + ansible.builtin.meta: flush_handlers + tags: + - sftpd + +# --- +# SFTP users +# +# new users - entries without 'existing_user: true'. User, chroot +# (home) directory, upload directory and authorized_keys +# are created/managed. +# existing users - entries with 'existing_user: true' (e.g. www-data or +# suexec users of vhosts). Only added to the sftp group; +# UID, primary group, home and shell stay untouched, +# 'home' is ignored. Their home (from passwd) becomes the +# chroot directory, so it must meet sshd's chroot +# requirements - this is checked, but NOT changed. +# --- + +- name: (sftpd.yml) Get passwd database + ansible.builtin.getent: + database: passwd + tags: + - sftpd + +- name: (sftpd.yml) Split sftp_user into new and existing users + ansible.builtin.set_fact: + common_fact_sftp_new_users: "{{ sftp_user | rejectattr('existing_user', 'defined') | list + + (sftp_user | selectattr('existing_user', 'defined') | rejectattr('existing_user') | list) }}" + common_fact_sftp_existing_users: "{{ sftp_user | selectattr('existing_user', 'defined') | selectattr('existing_user') | list }}" + tags: + - sftpd + +# Users which already exist and have a login shell (anything but +# nologin/false). Their password is never changed. +- name: (sftpd.yml) Determine sftp users with shell access + ansible.builtin.set_fact: + common_fact_sftp_shell_users: >- + {%- set ns = namespace(result=[]) -%} + {%- for u in sftp_user if u.name in ansible_facts.getent_passwd + and (ansible_facts.getent_passwd[u.name][5] | basename) not in ['nologin', 'false'] -%} + {%- set ns.result = ns.result + [u.name] -%} + {%- endfor -%} + {{ ns.result }} + tags: + - sftpd + +# Existing users keep their UID. New users without explicit 'user_id' +# get the next free UID starting at 'sftp_user_id_start'. +- name: (sftpd.yml) Determine UIDs for new sftp users + ansible.builtin.set_fact: + common_fact_sftp_uids: >- + {%- set ns = namespace(uid=sftp_user_id_start | int, result={}, + used=(ansible_facts.getent_passwd.values() | map(attribute=1) | map('int') | list) + + (common_fact_sftp_new_users | selectattr('user_id', 'defined') | map(attribute='user_id') | map('int') | list)) -%} + {%- for u in common_fact_sftp_new_users -%} + {%- if u.user_id is defined -%} + {%- set ns.result = ns.result | combine({u.name: u.user_id | int}) -%} + {%- elif u.name in ansible_facts.getent_passwd -%} + {%- set ns.result = ns.result | combine({u.name: ansible_facts.getent_passwd[u.name][1] | int}) -%} + {%- else -%} + {%- for _ in range(1000) if ns.uid in ns.used -%} + {%- set ns.uid = ns.uid + 1 -%} + {%- endfor -%} + {%- set ns.result = ns.result | combine({u.name: ns.uid}) -%} + {%- set ns.used = ns.used + [ns.uid] -%} + {%- endif -%} + {%- endfor -%} + {{ ns.result }} + tags: + - sftpd + +# --- new users + +# A 'new' user would get shell nologin, primary group sftp and a root +# owned home - don't do that to an account with shell access. +- name: (sftpd.yml) Fail if a new sftp user already exists with shell access + ansible.builtin.fail: + msg: >- + User '{{ item.name }}' already exists with shell access + ({{ ansible_facts.getent_passwd[item.name][5] }}). + Use 'existing_user: true' for this user. + when: item.name in common_fact_sftp_shell_users + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +- name: (sftpd.yml) Ensure new sftp users exist + ansible.builtin.user: + name: "{{ item.name }}" + uid: "{{ common_fact_sftp_uids[item.name] }}" + group: "{{ sftp_group_name }}" + home: "{{ item.home }}" + create_home: false + shell: /usr/sbin/nologin + # no password given: account locked ('!'), login only with ssh key + password: "{{ item.password | default('!') }}" + # never change the password of a user with shell access + update_password: "{{ 'on_create' if item.name in common_fact_sftp_shell_users + else item.update_password | default('always') }}" + state: present + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +- name: (sftpd.yml) Ensure chroot (home) directories of new users exist - owned by root + ansible.builtin.file: + path: "{{ item.home }}" + state: directory + owner: root + group: root + mode: "0755" + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}: {{ item.home }}" + tags: + - sftpd + +- name: (sftpd.yml) Ensure writable directory inside chroot of new users exists + ansible.builtin.file: + path: "{{ item.home }}/{{ item.upload_dir | default('upload') }}" + state: directory + owner: "{{ item.name }}" + group: "{{ sftp_group_name }}" + mode: "0750" + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}: {{ item.home }}/{{ item.upload_dir | default('upload') }}" + tags: + - sftpd + +- name: (sftpd.yml) Ensure directory '/.ssh' of new users exists - owned by root + ansible.builtin.file: + path: "{{ item.home }}/.ssh" + state: directory + owner: root + group: root + mode: "0755" + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +# Always created - empty, if no ssh_keys are given. +- name: (sftpd.yml) Set authorized_keys of new users - owned by root + ansible.builtin.template: + src: sftp_authorized_keys.j2 + dest: "{{ item.home }}/.ssh/authorized_keys" + owner: root + group: root + mode: "0644" + loop: "{{ common_fact_sftp_new_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +# --- existing users + +- name: (sftpd.yml) Ensure existing users really exist + ansible.builtin.assert: + that: + - item.name in ansible_facts.getent_passwd + fail_msg: "User '{{ item.name }}' is marked as 'existing_user' but does not exist." + quiet: true + loop: "{{ common_fact_sftp_existing_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +# sshd: the chroot directory and all its parents must be owned by root +# and must not be writable by group or others. +- name: (sftpd.yml) Check chroot requirements of existing users' home directories # noqa: risky-shell-pipe + ansible.builtin.shell: + cmd: | + d={{ ansible_facts.getent_passwd[item.name][4] | quote }} + rc=0 + while : ; do + if ! out=$(stat -c '%u %U:%G %A %n' "$d" 2>&1) ; then + echo "MISSING $d" ; rc=1 + else + set -- $out + case "$3" in + ?????w*|????????w*) echo "BAD (writable by group/others) $out" ; rc=1 ;; + *) if [ "$1" != "0" ] ; then echo "BAD (not owned by root) $out" ; rc=1 ; else echo "OK $out" ; fi ;; + esac + fi + [ "$d" = "/" ] && break + d=$(dirname "$d") + done + exit $rc + loop: "{{ common_fact_sftp_existing_users }}" + loop_control: + label: "{{ item.name }}: {{ ansible_facts.getent_passwd[item.name][4] }}" + register: common_sftpd_existing_home_check + changed_when: false + failed_when: false + tags: + - sftpd + +- name: (sftpd.yml) Fail if home of an existing user is not usable as chroot directory + ansible.builtin.fail: + msg: >- + Home '{{ ansible_facts.getent_passwd[item.item.name][4] }}' of user '{{ item.item.name }}' + can't be used as chroot directory - it and all its parents must exist, be owned by root + and must not be writable by group/others: {{ item.stdout_lines | reject('match', '^OK ') | join(' | ') }} + when: item.rc != 0 + loop: "{{ common_sftpd_existing_home_check.results }}" + loop_control: + label: "{{ item.item.name }}" + tags: + - sftpd + +- name: "(sftpd.yml) Add existing users to sftp group: {{ sftp_group_name }}" + ansible.builtin.user: + name: "{{ item.name }}" + groups: "{{ sftp_group_name }}" + append: true + # password only if given - and never for users with shell access + # (user exists, so 'on_create' means: don't touch) + password: "{{ item.password | default(omit) }}" + update_password: "{{ 'on_create' if item.name in common_fact_sftp_shell_users + else item.update_password | default('always') }}" + loop: "{{ common_fact_sftp_existing_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +# '~/.ssh' and '~/.ssh/authorized_keys' are always created (owned by the +# user). An existing authorized_keys file is never truncated. +- name: (sftpd.yml) Ensure directory '~/.ssh' of existing users exists + ansible.builtin.file: + path: "{{ ansible_facts.getent_passwd[item.name][4] }}/.ssh" + state: directory + owner: "{{ item.name }}" + group: "{{ ansible_facts.getent_passwd[item.name][2] }}" + mode: "0700" + loop: "{{ common_fact_sftp_existing_users }}" + loop_control: + label: "{{ item.name }}: {{ ansible_facts.getent_passwd[item.name][4] }}/.ssh" + tags: + - sftpd + +- name: (sftpd.yml) Ensure file '~/.ssh/authorized_keys' of existing users exists + ansible.builtin.file: + path: "{{ ansible_facts.getent_passwd[item.name][4] }}/.ssh/authorized_keys" + state: touch + owner: "{{ item.name }}" + group: "{{ ansible_facts.getent_passwd[item.name][2] }}" + mode: "0600" + access_time: preserve + modification_time: preserve + loop: "{{ common_fact_sftp_existing_users }}" + loop_control: + label: "{{ item.name }}" + tags: + - sftpd + +- name: (sftpd.yml) Add ssh keys of existing users (if given) + ansible.posix.authorized_key: + user: "{{ item.0.name }}" + key: "{{ item.1 }}" + state: present + loop: "{{ common_fact_sftp_existing_users | subelements('ssh_keys', skip_missing=true) }}" + loop_control: + label: "{{ item.0.name }}" + tags: + - sftpd diff --git a/roles/common/templates/etc/ssh/sshd_config.d/90-sshd-SFTP.conf.j2 b/roles/common/templates/etc/ssh/sshd_config.d/90-sshd-SFTP.conf.j2 new file mode 100644 index 0000000..5fc40a2 --- /dev/null +++ b/roles/common/templates/etc/ssh/sshd_config.d/90-sshd-SFTP.conf.j2 @@ -0,0 +1,32 @@ +# {{ ansible_managed }} + +#--------------------- +# Chrooted SFTP Access +#--------------------- + +Match Group {{ sftp_group_name }} + # %h wird durch das Home-Verzeichnis des jeweiligen Users ersetzt + # -> automatisch gültig für jeden neuen User dieser Gruppe, + # unabhängig vom Wert von USER + ChrootDirectory %h + + # Erzwingt IMMER internal-sftp, egal was der Client anfordert. + # Überschreibt damit auch die globale "Subsystem sftp"-Zeile + # und verhindert jeglichen Shell-Zugriff. + ForceCommand internal-sftp + + # Kein Missbrauch der SSH-Verbindung als Tunnel/Proxy möglich + AllowTcpForwarding no + X11Forwarding no + PermitTunnel no + + # Passwort-Login für diese Gruppe explizit gesetzt (unabhängig von + # der globalen Einstellung) - Variable 'sftp_password_authentication' + PasswordAuthentication {{ sftp_password_authentication }} + KbdInteractiveAuthentication no + +# WICHTIG: setzt den Match-Scope zurück auf global, +# damit nachfolgende Direktiven (aus dieser Datei, weiteren +# sshd_config.d-Dateien oder der Haupt-sshd_config) nicht +# ungewollt auch nur für {{ sftp_group_name }} gelten +Match all diff --git a/roles/common/templates/sftp_authorized_keys.j2 b/roles/common/templates/sftp_authorized_keys.j2 new file mode 100644 index 0000000..0c3014d --- /dev/null +++ b/roles/common/templates/sftp_authorized_keys.j2 @@ -0,0 +1,3 @@ +{% for key in item.ssh_keys | default([]) %} +{{ key }} +{% endfor %}