infra/ansible-role-ssh
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

move more options to variables

Browse source
This commit is contained in:
nd 2019-07-02 23:28:00 +02:00
parent d99d26db45
commit 65bd5e2ce1
No known key found for this signature in database
GPG key ID: 21B5CD4DEE3670E9
2 changed files with 14 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

10
defaults/main.yml
View file

@ -3,5 +3,15 @@ rootpath: ''
ssh: ssh:
config_override: config_override:
Port: 22
AuthorizedKeysFile: ".ssh/authorized_keys" AuthorizedKeysFile: ".ssh/authorized_keys"
PermitRootLogin: "yes"
UseDNS: "no"
UsePam: "yes"
MaxAuthTries: 10
UsePrivilegeSeparation: sandbox
AuthenticationMethods: publickey
KexAlgorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
user: {} user: {}

37
templates/ssh_sshd_config.j2
View file

@ -1,12 +1,6 @@
# {{ ansible_managed }} # {{ ansible_managed }}
# See the sshd_config(5) manpage for details # See the sshd_config(5) manpage for details
# What ports, IPs and protocols we listen for
Port 22
# Use these options to restrict which interfaces/protocols sshd will bind to
#ListenAddress ::
#ListenAddress 0.0.0.0
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
@ -17,34 +11,11 @@ HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ecdsa_key
KexAlgorithms curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
# KeyRegenerationInternal is halved from the default as a precaution (optional). 1800 seconds is 30 minutes.
KeyRegenerationInterval 1800
# Password based logins are disabled - only public key based logins are allowed.
AuthenticationMethods publickey
# LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in. # LogLevel VERBOSE logs user's key fingerprint on login. Needed to have a clear audit track of which key was using to log in.
LogLevel VERBOSE LogLevel VERBOSE
PermitRootLogin yes # We need sftp and logging
UseDNS no Subsystem sftp internal-sftp -f AUTH -l INFO
# Use kernel sandbox mechanisms where possible in unprivilegied processes
# Systrace on OpenBSD, Seccomp on Linux, seatbelt on MacOSX/Darwin, rlimit elsewhere.
UsePrivilegeSeparation sandbox
# We need sftp
Subsystem sftp internal-sftp
UsePam yes # needed to create home dirs with an ldap login
MaxAuthTries 10
{% for i in ssh.config_override|d({}) %} {% for i in ssh.config_override|d({}) %}
{{ i }} {{ ssh.config_override[i] }} {{ i }} {{ ssh.config_override[i] }}
@ -54,7 +25,7 @@ MaxAuthTries 10
{% for i in ssh.user %} {% for i in ssh.user %}
Match User {{ i }} Match User {{ i }}
{% for j in ssh.user[i]|d({}) %} {% for j in ssh.user[i]|d({}) %}
{{ j }} {{ ssh.user[i][j] }} {{ j }} {{ ssh.user[i][j] }}
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}