2020-03-17 16:39:59 +01:00
|
|
|
# Attention, local changew will be overwritten
|
2020-03-18 11:30:48 +01:00
|
|
|
# MIT (C) L3D
|
2018-03-20 20:21:57 +01:00
|
|
|
# {{ ansible_managed }}
|
2018-03-09 03:13:41 +01:00
|
|
|
|
2018-03-07 03:28:23 +01:00
|
|
|
# Networking
|
2020-03-17 16:39:59 +01:00
|
|
|
Port {{ sshd.port }}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
TCPKeepAlive yes
|
|
|
|
|
|
|
|
# Key exchange
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'KexAlgorithms ' }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- for algo in sshd.kex_algorithmus -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ algo }}{{ "," if not loop.last }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
|
|
|
|
|
|
|
# Ciphers:
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'Ciphers ' }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- for cipher in sshd.ciphers -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ cipher }}{{ "," if not loop.last }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
|
|
|
|
|
|
|
# Macs
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'MACs ' }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- for mac in sshd.macs -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ mac }}{{ "," if not loop.last }}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
# Server authentication
|
|
|
|
Protocol 2
|
|
|
|
|
2020-03-17 18:47:15 +01:00
|
|
|
{% if sshd.manage_key_types | bool -%}
|
|
|
|
# host key types
|
|
|
|
{% for key in sshd.key_types %}
|
|
|
|
HostKey /etc/ssh/ssh_host_{{ key }}_key
|
|
|
|
{% endfor %}
|
|
|
|
{%- endif %}
|
|
|
|
|
|
|
|
|
|
|
|
# HostKeyAlgorithms
|
|
|
|
# Maybe not available in openssh 6.7
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'HostKeyAlgorithms ' }}
|
2020-03-17 18:47:15 +01:00
|
|
|
{%- for key in sshd.key_algorithmus -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ key }}{{ "," if not loop.last }}
|
2020-03-17 18:47:15 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
|
|
|
|
2018-03-07 03:28:23 +01:00
|
|
|
# Client authentication
|
2020-03-17 18:52:03 +01:00
|
|
|
PasswordAuthentication
|
|
|
|
{%- if sshd.password_authentication | bool -%}
|
|
|
|
{{ ' yes' }}
|
|
|
|
{% else -%}
|
|
|
|
{{ ' no' }}
|
|
|
|
{% endif %}
|
2018-03-07 03:28:23 +01:00
|
|
|
ChallengeResponseAuthentication no
|
|
|
|
PubkeyAuthentication yes
|
2020-03-18 11:30:48 +01:00
|
|
|
PermitRootLogin without-password
|
|
|
|
LoginGraceTime 120
|
|
|
|
StrictModes yes
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
# If you just want the PAM account and session checks to run without
|
|
|
|
# PAM authentication, then enable this but set PasswordAuthentication
|
|
|
|
# and ChallengeResponseAuthentication to 'no'.
|
|
|
|
UsePAM yes
|
|
|
|
|
|
|
|
# User Authentication
|
2020-03-18 11:30:48 +01:00
|
|
|
{% if sshd.restrict_users -%}
|
|
|
|
AllowUsers {{ sshd_allowed_users|join(' ') }}
|
2019-07-17 14:03:00 +02:00
|
|
|
{%- endif %}
|
2020-03-18 11:30:48 +01:00
|
|
|
{% if sshd.restrict_groups -%}
|
|
|
|
AllowUsers {{ sshd_allowed_groups|join(' ') }}
|
2019-07-17 14:03:00 +02:00
|
|
|
{%- endif %}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
# Allow client to pass locale environment variables
|
|
|
|
AcceptEnv LANG LC_*
|
|
|
|
|
|
|
|
PrintMotd no
|
|
|
|
|
|
|
|
# sftp (required by ansible)
|
2019-11-20 09:44:44 +01:00
|
|
|
# Subsystem sftp /usr/lib/openssh/sftp-server
|
2019-11-20 10:20:58 +01:00
|
|
|
{% if ansible_os_family == 'RedHat' %}
|
2019-11-20 10:15:12 +01:00
|
|
|
Subsystem sftp /usr/libexec/openssh/sftp-server
|
|
|
|
{% else %}
|
|
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
|
|
{% endif %}
|