1
0
Fork 0
mirror of https://github.com/roles-ansible/ansible_collection_users.git synced 2024-08-16 10:29:50 +02:00
ansible_collection_users/roles/sshd/templates/sshd_config.j2

137 lines
3.4 KiB
Text
Raw Normal View History

2024-02-15 02:51:39 +01:00
# Attention, local changew will be overwritten
# MIT (C) L3D <l3d@c3woc.de>
# {{ ansible_managed }}
# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.
2024-02-15 20:02:08 +01:00
{% if _sshd_version | default(7.0) | float > 8.0 | bool %}
2024-02-15 02:51:39 +01:00
# Include SSHD config snippets
2024-02-15 03:37:33 +01:00
# Support fot this starts with sshd 8.0
2024-02-15 02:51:39 +01:00
Include /etc/ssh/sshd_config.d/*.conf
{% endif %}
# Networking
2024-02-15 03:37:33 +01:00
Port {{ l3d_users__sshd_port }}
2024-02-15 02:51:39 +01:00
AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
TCPKeepAlive yes
# SSHD Key exchange
2024-02-15 03:37:33 +01:00
{% if l3d_users__sshd_manage_key_algorithmus | bool %}
2024-02-15 02:51:39 +01:00
# -> HostkeyAlgorithms
2024-02-15 03:37:33 +01:00
HostkeyAlgorithms {{ l3d_users__sshd_key_algorithmus | join(',') }}
{% else %}
# No HostkeyAlgorithms defined
{% endif %}
2024-02-15 02:51:39 +01:00
2024-02-15 03:37:33 +01:00
{% if l3d_users__sshd_manage_kex_algorithmus | bool %}
2024-02-15 02:51:39 +01:00
# -> KexAlgorithms
2024-02-15 03:37:33 +01:00
KexAlgorithms {{ l3d_users__sshd_kex_algorithmus | join(',') }}
{% else %}
# No KexAlgorithms defined
{% endif %}
2024-02-15 02:51:39 +01:00
# Ciphers and keying
2024-02-15 03:37:33 +01:00
{% if l3d_users__sshd_manage_ciphers | bool %}
2024-02-15 02:51:39 +01:00
# -> Ciphers
2024-02-15 03:37:33 +01:00
Ciphers {{ l3d_users__sshd_ciphers | join(',') }}
{% else %}
# No Ciphers defined
{% endif %}
2024-02-15 02:51:39 +01:00
2024-02-15 03:37:33 +01:00
{% if l3d_users__sshd_manage_macs | bool %}
2024-02-15 02:51:39 +01:00
# -> Macs
2024-02-15 03:37:33 +01:00
MACs {{ l3d_users__sshd_macs | join(',') }}
{% else %}
# No MACs defined
{% endif %}
2024-02-15 02:51:39 +01:00
# Server Authentication
Protocol 2
# Logging
SyslogFacility AUTH
LogLevel INFO
# SSHD Host Keys
2024-02-15 03:37:33 +01:00
{% if l3d_users__sshd_manage_server_key_types | bool %}
{% for key in l3d_users__sshd_server_key_types %}
2024-02-15 02:51:39 +01:00
# -> {{ key }}
HostKey /etc/ssh/ssh_host_{{ key }}_key
2024-02-15 03:37:33 +01:00
{% endfor %}
{% endif %}
2024-02-15 02:51:39 +01:00
# Client authentication
MaxAuthTries 6
MaxSessions 10
2024-02-15 03:37:33 +01:00
PasswordAuthentication {{ l3d_users__sshd_password_authentication | ternary('yes', 'no') }}
2024-02-15 02:51:39 +01:00
ChallengeResponseAuthentication no
PubkeyAuthentication yes
2024-02-15 03:37:33 +01:00
PermitRootLogin {{ l3d_users__sshd_permitrootlogin | ternary('without-password', 'no') }}
2024-02-15 02:51:39 +01:00
LoginGraceTime 120
StrictModes yes
2024-02-15 03:37:33 +01:00
X11Forwarding {{ l3d_users__sshd_xforwarding | ternary('yes', 'no') }}
2024-02-15 02:51:39 +01:00
AllowTcpForwarding yes
#GatewayPorts no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
PrintLastLog yes
TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
# no default banner path
#Banner none
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes
2024-02-15 03:37:33 +01:00
{% set _sshd_accounts = [] %}
{% for user in _l3d_users__merged_users %}
{% if user.name is defined and user.state | default('present') == 'present' %}
{% set _ = _sshd_accounts.append(user.name) %}
{% endif %}
{% endfor %}
2024-02-15 02:51:39 +01:00
# User Authentication
2024-02-15 03:37:33 +01:00
{% if l3d_users__create_ansible | bool and l3d_users__ansible_user_state == 'present' %}
AllowUsers ansible {{ _sshd_accounts | join(' ') }}
2024-02-15 02:51:39 +01:00
# Group Authentication
2024-02-15 03:37:33 +01:00
AllowGroups ansible {{ _sshd_accounts | join(' ') }}
{% else %}
AllowUsers {{ _sshd_accounts | join(' ') }}
# Group Authentication
AllowGroups {{ _sshd_accounts | join(' ') }}
{% endif %}
2024-02-15 02:51:39 +01:00
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*
# sftp (required by ansible)
# Subsystem sftp /usr/lib/openssh/sftp-server
{% if ansible_os_family == 'RedHat' %}
Subsystem sftp /usr/libexec/openssh/sftp-server
{% else %}
Subsystem sftp /usr/lib/openssh/sftp-server
{% endif %}