Disable also dynamic MOTD via PAM if enabled - refs dev-sec#271

Signed-off-by: Ancoron Luciferis <ancoron.luciferis@gmail.com>
divialth · Apr 15, 2020 · 07f5d23 · 07f5d23
1 parent ac9fd3a
commit 07f5d23
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/tasks/hardening.yml b/tasks/hardening.yml
@@ -41,6 +41,18 @@
   notify: restart sshd
   when: ssh_server_hardening | bool
 
+- name: disable dynamic MOTD
+  pamd:
+    name: sshd
+    type: session
+    control: optional
+    module_path: pam_motd.so
+    state: absent
+  when:
+    - ssh_server_hardening | bool
+    - ssh_pam_support | bool
+    - not (ssh_print_motd | bool)
+
 - name: create ssh_config and set permissions to root/644
   template:
     src: 'openssh.conf.j2'