48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
---
|
|
# revert-ssh.yml
|
|
#
|
|
# Reverts the SSH IP-range restriction applied by restrict-ssh.yml.
|
|
# Removes the range-limited SSH rule and re-opens SSH from anywhere so
|
|
# you don't lose access. Optionally disables UFW entirely.
|
|
#
|
|
# Uses the community.general.ufw module.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i inventory.ini revert-ssh.yml
|
|
#
|
|
# To also disable UFW completely:
|
|
# ansible-playbook -i inventory.ini revert-ssh.yml -e "disable_ufw=true"
|
|
#
|
|
# Override the range or port to match what restrict-ssh.yml used:
|
|
# ansible-playbook -i inventory.ini revert-ssh.yml -e "ssh_allowed_range=10.0.0.0/24 ssh_port=2222"
|
|
|
|
- name: Revert SSH IP-range restriction
|
|
hosts: ubuntu_servers
|
|
become: true
|
|
|
|
vars:
|
|
ssh_allowed_range: "192.168.1.0/24"
|
|
ssh_port: 22
|
|
disable_ufw: false
|
|
|
|
tasks:
|
|
- name: Remove the range-restricted SSH rule
|
|
community.general.ufw:
|
|
rule: allow
|
|
from_ip: "{{ ssh_allowed_range }}"
|
|
to_port: "{{ ssh_port }}"
|
|
proto: tcp
|
|
delete: true
|
|
|
|
- name: Re-open SSH from anywhere
|
|
community.general.ufw:
|
|
rule: allow
|
|
to_port: "{{ ssh_port }}"
|
|
proto: tcp
|
|
when: not disable_ufw | bool
|
|
|
|
- name: Disable UFW entirely (optional)
|
|
community.general.ufw:
|
|
state: disabled
|
|
when: disable_ufw | bool
|