sshd-config: for debian-12: config in /etc/ssh/sshd_config.d/default.conf
Denis Knauf
parent
2ff87d6f68
commit
b14582103e
|
|
@ -1,4 +1,9 @@
|
|||
has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}'
|
||||
is_virt_guest: '{{ansible_virtualization_role == "guest"}}'
|
||||
is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}'
|
||||
sys_default_users: []
|
||||
has_hwrng: '{{ansible_virtualization_role != "guest" and ansible_local.devices.hwrng }}'
|
||||
is_virt_guest: '{{ansible_virtualization_role == "guest"}}'
|
||||
is_container: '{{ansible_virtualization_role == "guest" and ansible_virtualization_type == "lxc"}}'
|
||||
sys_default_users: []
|
||||
ssh_permit_root_login: 'prohibit-password'
|
||||
ssh_ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
|
||||
ssh_macs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
|
||||
ssh_kex_algorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
||||
ssh_host_keys: [/etc/ssh/ssh_host_ed25519_key, /etc/ssh/ssh_host_rsa_key]
|
||||
|
|
|
|||
|
|
@ -1,46 +1,56 @@
|
|||
---
|
||||
# vim: set expandtab tabstop=2 shiftwidth=2:
|
||||
|
||||
- name: sshd_config
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^\s*#\s*{{item.key}}\s+'
|
||||
regexp: '^\s*{{item.key}}\s'
|
||||
line: '{{item.key}} {{item.value}}'
|
||||
with_dict:
|
||||
Port: '{{ssh_port|default(22)}}'
|
||||
PermitRootLogin: 'prohibit-password'
|
||||
StrictModes: 'yes'
|
||||
PubkeyAuthentication: 'yes'
|
||||
KerberosAuthentication: 'no'
|
||||
GSSAPIAuthentication: 'yes'
|
||||
TCPKeepAlive: 'yes'
|
||||
Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
|
||||
MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
|
||||
KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
||||
- name: sshd_config
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertbefore: '\s*#?\s*HostKey\s+'
|
||||
regexp: '^# HostKeys for protocol'
|
||||
line: '# HostKeys for protocol'
|
||||
- name: sshd_config - prefer ed25519
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^# HostKeys for protocol'
|
||||
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
||||
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
|
||||
- name: sshd_config - fallback rsa
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
||||
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
|
||||
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
|
||||
- name: 'sshd_config - absent dsa / ecdsa'
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
state: absent
|
||||
regexp: '{{item}}'
|
||||
with_list:
|
||||
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
|
||||
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'
|
||||
- when: '"debian" == ansible_facts["os_family"]|lower && 12 <= ansible_facts["os_version_id"]'
|
||||
name: 'sshd_config.d/99-default.conf'
|
||||
template:
|
||||
src: 'sshd-default.conf'
|
||||
dest: '/etc/ssh/sshd_config.d/99-default.conf'
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
- when: '"debian" != ansible_facts["os_family"]|lower || 11 >= ansible_facts["os_version_id"]'
|
||||
block:
|
||||
- name: sshd_config
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^\s*#\s*{{item.key}}\s+'
|
||||
regexp: '^\s*{{item.key}}\s'
|
||||
line: '{{item.key}} {{item.value}}'
|
||||
with_dict:
|
||||
Port: '{{ssh_port|default(22)}}'
|
||||
PermitRootLogin: 'prohibit-password'
|
||||
StrictModes: 'yes'
|
||||
PubkeyAuthentication: 'yes'
|
||||
KerberosAuthentication: 'no'
|
||||
GSSAPIAuthentication: 'yes'
|
||||
TCPKeepAlive: 'yes'
|
||||
Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com'
|
||||
MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256'
|
||||
KexAlgorithms: 'curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256'
|
||||
- name: sshd_config
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertbefore: '\s*#?\s*HostKey\s+'
|
||||
regexp: '^# HostKeys for protocol'
|
||||
line: '# HostKeys for protocol'
|
||||
- name: sshd_config - prefer ed25519
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^# HostKeys for protocol'
|
||||
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
||||
line: 'HostKey /etc/ssh/ssh_host_ed25519_key'
|
||||
- name: sshd_config - fallback rsa
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
insertafter: '^\s*HostKey\s+/etc/ssh/ssh_host_ed25519_key\s*$'
|
||||
regexp: '^\s*HostKey\s+/etc/ssh/ssh_host_rsa_key\s*$'
|
||||
line: 'HostKey /etc/ssh/ssh_host_rsa_key'
|
||||
- name: 'sshd_config - absent dsa / ecdsa'
|
||||
lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
state: absent
|
||||
regexp: '{{item}}'
|
||||
with_list:
|
||||
- '^\s*HostKey\s+/etc/ssh/ssh_host_dsa_key\s*$'
|
||||
- '^\s*HostKey\s+/etc/ssh/ssh_host_ecdsa_key\s*$'
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
{{if ssh_port is defined }}Port {{ssh_port}}{{endif}}
|
||||
PermitRootLogin {{ssh_permit_root_login}}
|
||||
StrictModes yes
|
||||
PubkeyAuthentication yes
|
||||
{{if ssh_kerberos_authentication is defined}}KerberosAuthentication {{ssh_kerberos_authentication}}{{endif}}
|
||||
{{if ssh_gssapi_authentication is defined}}GSSAPIAuthentication {{ssh_gssapi_authentication}}{{endif}}
|
||||
TCPKeepAlive yes
|
||||
Ciphers {{ssh_ciphers}}
|
||||
MACs {{ssh_macs}}
|
||||
KexAlgorithms {{ssh_kex_algorithms}}
|
||||
HostKey {%for k in ssh_host_keys%}{{k}}{%endfor%}
|
||||
Loading…
Reference in New Issue