<commit_before>"""
OpenSSH tasks
=============

This module provides tools to manage OpenSSH server and client.

"""

from fabric.api import hide
from fabric.contrib.files import append, sed

from fabtools.service import is_running, restart


def _append(filename, regex, use_sudo):
    """
    Less verbose append
    """
    with hide('stdout', 'warnings'):
        return append(filename, regex, use_sudo=use_sudo)


_PASSWORD_AUTHENTICATION = r'^(\s*#\s*)?PasswordAuthentication\s+(yes|no)'


def disable_password_auth(sshd_config='/etc/ssh/sshd_config'):
    """
    Do not allow users to use passwords to login via ssh.
    """

    # First try to change existing setting
    sed(sshd_config,
        _PASSWORD_AUTHENTICATION,
        'PasswordAuthentication no',
        use_sudo=True)

    # Then append setting if it's still missing
    _append(sshd_config,
            'PasswordAuthentication no',
            use_sudo=True)

    if is_running('ssh'):
        restart('ssh')


def enable_password_auth(sshd_config='/etc/ssh/sshd_config'):
    """
    Allow users to use passwords to login via ssh.
    """

    # First try to change existing setting
    sed(sshd_config,
        _PASSWORD_AUTHENTICATION,
        'PasswordAuthentication yes',
        use_sudo=True)

    # Then append setting if it's still missing
    _append(sshd_config,
            'PasswordAuthentication yes',
            use_sudo=True)

    if is_running('ssh'):
        restart('ssh')


_PERMIT_ROOT_LOGIN = r'^(\s*#\s*)?PermitRootLogin\s+(yes|no)'


def disable_root_login(sshd_config='/etc/ssh/sshd_config'):
    """
    Do not allow root to login via ssh.
    """

    # First try to change existing setting
    sed(sshd_config,
        _PERMIT_ROOT_LOGIN,
        'PermitRootLogin no',
        use_sudo=True)

    # Then append setting if it's still missing
    _append(sshd_config,
            'PermitRootLogin no',
            use_sudo=True)

    if is_running('ssh'):
        restart('ssh')


def enable_root_login(sshd_config='/etc/ssh/sshd_config'):
    """
    Allow root to login via ssh.
    """

    # First try to change existing setting
    sed(sshd_config,
        _PERMIT_ROOT_LOGIN,
        'PermitRootLogin yes',
        use_sudo=True)

    # Then append setting if it's still missing
    _append(sshd_config,
            'PermitRootLogin yes',
            use_sudo=True)

    if is_running('ssh'):
        restart('ssh')


def harden(allow_root_login=False, allow_password_auth=False,<commit_msg>Only restart SSH server if the config file changed<commit_after>"""
OpenSSH tasks
=============

This module provides tools to manage OpenSSH server and client.

"""

from fabric.api import hide
from fabric.contrib.files import append, sed

from fabtools.service import is_running, restart
from fabtools.files import watch


def _append(filename, regex, use_sudo):
    """
    Less verbose append
    """
    with hide('stdout', 'warnings'):
        return append(filename, regex, use_sudo=use_sudo)


_PASSWORD_AUTHENTICATION = r'^(\s*#\s*)?PasswordAuthentication\s+(yes|no)'


def disable_password_auth(sshd_config='/etc/ssh/sshd_config'):
    """
    Do not allow users to use passwords to login via ssh.
    """

    with watch(sshd_config) as config_file:

        # First try to change existing setting
        sed(sshd_config,
            _PASSWORD_AUTHENTICATION,
            'PasswordAuthentication no',
            use_sudo=True)

        # Then append setting if it's still missing
        _append(sshd_config,
                'PasswordAuthentication no',
                use_sudo=True)

    if config_file.changed and is_running('ssh'):
        restart('ssh')


def enable_password_auth(sshd_config='/etc/ssh/sshd_config'):
    """
    Allow users to use passwords to login via ssh.
    """

    with watch(sshd_config) as config_file:

        # First try to change existing setting
        sed(sshd_config,
            _PASSWORD_AUTHENTICATION,
            'PasswordAuthentication yes',
            use_sudo=True)

        # Then append setting if it's still missing
        _append(sshd_config,
                'PasswordAuthentication yes',
                use_sudo=True)

    if config_file.changed and is_running('ssh'):
        restart('ssh')


_PERMIT_ROOT_LOGIN = r'^(\s*#\s*)?PermitRootLogin\s+(yes|no)'


def disable_root_login(sshd_config='/etc/ssh/sshd_config'):
    """
    Do not allow root to login via ssh.
    """

    with watch(sshd_config) as config_file:

        # First try to change existing setting
        sed(sshd_config,
            _PERMIT_ROOT_LOGIN,
            'PermitRootLogin no',
            use_sudo=True)

        # Then append setting if it's still missing
        _append(sshd_config,
                'PermitRootLogin no',
                use_sudo=True)

    if config_file.changed and is_running('ssh'):
        restart('ssh')


def enable_root_login(sshd_config='/etc/ssh/sshd_config'):
    """
    Allow root to login via ssh.
    """

    with watch(sshd_config) as config_file:

        # First try to change existing setting
        sed(sshd_config,
            _PERMIT_ROOT_LOGIN,
            'PermitRootLogin yes',
            use_sudo=True)

        # Then append setting if it's still missing
        _append(sshd_config,
                'PermitRootLogin yes',
                use_sudo=True)

    if config_file.changed and is_running('ssh'):
        restart('ssh')


def harden(allow_root_login=False, allow_password_auth=False,
{'fraction_non_alphanumeric': 0.09927140255009108, 'fraction_numerical': 0.0, 'mean_word_length': 2.6655540720961284, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6294140', 'n_tokens_mistral': 1772, 'n_tokens_neox': 1616, 'n_words': 415}