mirror of
https://github.com/trailofbits/algo.git
synced 2026-08-17 21:25:50 +02:00
984831bcab
* fix: add explicit bool filters for Ansible 12 jinja2_native compatibility Ansible 12 enables jinja2_native by default, which means string values like "true"/"false" are no longer automatically coerced to booleans in when: conditions and Jinja2 if statements. Add | bool filters to all boolean variable references in tasks, templates, and handlers. Also reformats long single-line Jinja2 conditionals into multi-line for readability, fixes GCE default() calls for native mode, adds help command to the algo script, and updates test fixtures to register the bool filter. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci: add j2lint for Jinja2 template linting Add j2lint (aristanetworks/j2lint) to catch syntax errors, spacing issues, and operator formatting in Jinja2 templates. Integrated into pre-commit hooks, lint.yml CI, and smart-tests.yml. Rules S3/S5/S6/S7/V1 are ignored — they enforce conventions incompatible with Ansible's config-file-embedded templates. Also fixes int+1 → int + 1 operator spacing in server.conf.j2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: resolve all ansible-lint warnings and enforce zero-tolerance policy Fix 18 jinja[spacing] errors across 12 files by moving Jinja2 block delimiters to prevent YAML >- folding from introducing trailing spaces. Fix 27 key-order[task] warnings across 17 files by reordering task keys to canonical order (name → when → tags → environment → become → block). Promote key-order[task] and yaml[line-length] from warn_list to hard errors by removing warn_list entirely from .ansible-lint. Add zero-tolerance warning policy to CLAUDE.md explaining why warnings are unacceptable in a security tool and documenting resolution order. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
119 lines
3.3 KiB
YAML
119 lines
3.3 KiB
YAML
---
|
|
- name: Ensure that the sshd_config file has desired options
|
|
blockinfile:
|
|
dest: /etc/ssh/sshd_config
|
|
marker: "# {mark} ANSIBLE MANAGED BLOCK ssh_tunneling_role"
|
|
block: |
|
|
Match Group algo
|
|
AllowTcpForwarding local
|
|
AllowAgentForwarding no
|
|
AllowStreamLocalForwarding no
|
|
PermitTunnel no
|
|
X11Forwarding no
|
|
notify:
|
|
- restart ssh
|
|
|
|
- name: Ensure that the algo group exist
|
|
group:
|
|
name: algo
|
|
state: present
|
|
gid: 15000
|
|
|
|
- name: Ensure that the jail directory exist
|
|
file:
|
|
path: /var/jail/
|
|
state: directory
|
|
mode: '0755'
|
|
owner: root
|
|
group: "{{ root_group | default('root') }}"
|
|
|
|
- tags: update-users
|
|
block:
|
|
- name: Ensure that the SSH users exist
|
|
user:
|
|
name: "{{ item }}"
|
|
group: algo
|
|
groups: algo
|
|
home: /var/jail/{{ item }}
|
|
createhome: true
|
|
generate_ssh_key: false
|
|
shell: /bin/false
|
|
state: present
|
|
append: true
|
|
loop: "{{ users }}"
|
|
|
|
- become: false
|
|
delegate_to: localhost
|
|
block:
|
|
- name: Clean up the ssh-tunnel directory
|
|
file:
|
|
dest: "{{ ssh_tunnels_config_path }}"
|
|
state: absent
|
|
when: keys_clean_all|bool
|
|
|
|
- name: Ensure the config directories exist
|
|
file:
|
|
dest: "{{ ssh_tunnels_config_path }}"
|
|
state: directory
|
|
recurse: true
|
|
mode: "0700"
|
|
|
|
- name: Check if the private keys exist
|
|
stat:
|
|
path: "{{ ssh_tunnels_config_path }}/{{ item }}.pem"
|
|
register: privatekey
|
|
loop: "{{ users }}"
|
|
|
|
- name: Build ssh private keys
|
|
openssl_privatekey:
|
|
path: "{{ ssh_tunnels_config_path }}/{{ item.item }}.pem"
|
|
passphrase: "{{ p12_export_password }}"
|
|
cipher: auto
|
|
force: false
|
|
no_log: "{{ algo_no_log | bool }}"
|
|
when: not item.stat.exists
|
|
loop: "{{ privatekey.results }}"
|
|
register: openssl_privatekey
|
|
|
|
- name: Build ssh public keys
|
|
openssl_publickey:
|
|
path: "{{ ssh_tunnels_config_path }}/{{ item.item.item }}.pub"
|
|
privatekey_path: "{{ ssh_tunnels_config_path }}/{{ item.item.item }}.pem"
|
|
privatekey_passphrase: "{{ p12_export_password }}"
|
|
format: OpenSSH
|
|
force: true
|
|
no_log: "{{ algo_no_log | bool }}"
|
|
when: item.changed
|
|
loop: "{{ openssl_privatekey.results }}"
|
|
|
|
- name: Build the client ssh config
|
|
template:
|
|
src: ssh_config.j2
|
|
dest: "{{ ssh_tunnels_config_path }}/{{ item }}.ssh_config"
|
|
mode: '0700'
|
|
loop: "{{ users }}"
|
|
|
|
- name: The authorized keys file created
|
|
authorized_key:
|
|
user: "{{ item }}"
|
|
key: "{{ lookup('file', ssh_tunnels_config_path + '/' + item + '.pub') }}"
|
|
state: present
|
|
manage_dir: true
|
|
exclusive: true
|
|
loop: "{{ users }}"
|
|
|
|
- name: Get active users
|
|
getent:
|
|
database: group
|
|
key: algo
|
|
split: ":"
|
|
|
|
- name: Delete non-existing users
|
|
user:
|
|
name: "{{ item }}"
|
|
state: absent
|
|
remove: true
|
|
force: true
|
|
when: item not in users
|
|
loop: "{{ getent_group['algo'][2].split(',') }}"
|