'sshd__permit_root_login' not taking effect
Routhinator opened this issue · comments
Starting out with Ansible and Debops for the first time.
So far the scripts are great as are the docs, and I can add vars to the group_vars/all
directory to set my defaults. However this one isn't being picked up, taking effect, or something. I'm not sure why.
sshd.yml:
---
sshd__permit_root_login: 'no'
I'd just like to completely disable root login now that I have a user created to manage my hosts.
Welcome to the project!
I presume that you added this in the ansible/inventory/group_vars/all/sshd.yml
file, relative to the DebOps project directory? What happens when you run command:
debops service/sshd
Can you show me the output of this command? Also, the contents of the generated /etc/ssh/sshd_config
configuration file?
Thanks for the welcome!
Yes your presumption is correct.
Interesting; running that command does seem to have gotten the playbook to pick up the var:
TASK [debops.sshd : Setup /etc/ssh/sshd_config] ********************************
changed: [devops-fra1-01]
changed: [docker-fra1-01]
And now I have the appropriate line in /etc/ssh/sshdd_config
:
# Authentication:
PermitRootLogin no
Maybe I should step back a bit here. Based on my reading of the docs, sshd is part of the common.yml playbook, and thus should be run/configured when running debops bootstrap
- no?
No, The DebOps configuration works like this:
-
debops bootstrap
- this is an optional step, only useful when you deploy an environment for the first time, or you configure a host in environment where you don't have control over deployment, like a VPS host. An alternative for this step is usage ofcloud-init
, setting up your own DHCP/PXE/preseeding environment, or LXC/OpenVZ template scripts. The bootstrap role runs only a minimal set of tasks that prepare the host for management using Ansible. -
debops common
- this command runs thecommon.yml
playbook, with common roles likesshd
, user configuration,ferm
, etc. The common playbook defines a "base environment" of a host, and many roles assume that the environment defined by this playbook exists on the host. -
debops
- if you run this command, the script will run thesite.yml
playbook which includes thecommon.yml
playbook and all other playbooks for various services. Which services will be executed depends on what inventory groups a given host is included in.
So it looks like you have only executed debops bootstrap
? Try running debops common
next time, it should configure the environment.
Got it. My bad.