2020-03-17 16:39:59 +01:00
|
|
|
# Attention, local changew will be overwritten
|
2020-08-05 16:29:34 +02:00
|
|
|
# MIT (C) L3D <l3d@c3woc.de>
|
2018-03-20 20:21:57 +01:00
|
|
|
# {{ ansible_managed }}
|
2020-03-26 14:14:59 +01:00
|
|
|
# This is the sshd server system-wide configuration file. See
|
|
|
|
# sshd_config(5) for more information.
|
|
|
|
|
2020-08-05 16:33:38 +02:00
|
|
|
{% if sshd__version_is_above_eight | default(false) | bool %}
|
2022-05-03 19:04:58 +02:00
|
|
|
# Include SSHD config snippets
|
2020-03-26 14:14:59 +01:00
|
|
|
Include /etc/ssh/sshd_config.d/*.conf
|
2020-08-05 16:29:34 +02:00
|
|
|
{% endif %}
|
2018-03-09 03:13:41 +01:00
|
|
|
|
2018-03-07 03:28:23 +01:00
|
|
|
# Networking
|
2020-08-04 15:07:02 +02:00
|
|
|
Port {{ sshd__port }}
|
2020-03-26 14:14:59 +01:00
|
|
|
AddressFamily any
|
|
|
|
#ListenAddress 0.0.0.0
|
|
|
|
#ListenAddress ::
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
TCPKeepAlive yes
|
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# SSHD Key exchange
|
|
|
|
# -> HostkeyAlgorithms
|
|
|
|
{% if not sshd__manage_key_algorithmus | bool %}#{% endif -%}
|
2020-12-17 00:39:20 +01:00
|
|
|
{{ 'HostkeyAlgorithms ' }}
|
|
|
|
{%- for algo in sshd__key_algorithmus -%}
|
2022-05-03 19:04:58 +02:00
|
|
|
{{- algo -}}
|
|
|
|
{{- "," if not loop.last -}}
|
2020-12-17 00:39:20 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# -> KexAlgorithms
|
|
|
|
{% if not sshd__manage_kex_algorithmus | bool %}#{% endif -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'KexAlgorithms ' }}
|
2020-08-04 15:07:02 +02:00
|
|
|
{%- for algo in sshd__kex_algorithmus -%}
|
2022-05-03 19:04:58 +02:00
|
|
|
{{- algo -}}
|
|
|
|
{{- "," if not loop.last -}}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
|
|
|
|
2020-03-26 14:14:59 +01:00
|
|
|
# Ciphers and keying
|
2022-05-03 19:04:58 +02:00
|
|
|
# RekeyLimit default none
|
|
|
|
# -> Ciphers
|
|
|
|
{% if not sshd__manage_ciphers | bool %}#{% endif -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'Ciphers ' }}
|
2020-08-04 15:07:02 +02:00
|
|
|
{%- for cipher in sshd__ciphers -%}
|
2022-05-03 19:04:58 +02:00
|
|
|
{{- cipher -}}
|
|
|
|
{{- "," if not loop.last -}}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
|
|
|
|
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# -> Macs
|
|
|
|
{% if not sshd__manage_macs | bool %}#{% endif -%}
|
2020-03-18 11:30:48 +01:00
|
|
|
{{ 'MACs ' }}
|
2020-08-04 15:07:02 +02:00
|
|
|
{%- for mac in sshd__macs -%}
|
2022-05-03 19:04:58 +02:00
|
|
|
{{- mac -}}
|
|
|
|
{{- "," if not loop.last -}}
|
2020-03-17 17:25:08 +01:00
|
|
|
{%- endfor %}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
2020-03-26 14:14:59 +01:00
|
|
|
# Server Authentication
|
2018-03-07 03:28:23 +01:00
|
|
|
Protocol 2
|
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# Logging
|
|
|
|
SyslogFacility AUTH
|
|
|
|
LogLevel INFO
|
2020-03-26 14:14:59 +01:00
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# SSHD Host Keys
|
2020-08-04 15:07:02 +02:00
|
|
|
{% for key in sshd__key_types %}
|
2022-05-03 19:04:58 +02:00
|
|
|
# -> {{ key }}
|
|
|
|
{% if not sshd__manage_key_types | bool %}#{% endif -%}
|
2020-03-17 18:47:15 +01:00
|
|
|
HostKey /etc/ssh/ssh_host_{{ key }}_key
|
|
|
|
{% endfor %}
|
|
|
|
|
|
|
|
|
2018-03-07 03:28:23 +01:00
|
|
|
# Client authentication
|
2020-03-26 14:14:59 +01:00
|
|
|
MaxAuthTries 6
|
|
|
|
MaxSessions 10
|
2020-08-04 15:49:36 +02:00
|
|
|
PasswordAuthentication {{ sshd__password_authentication | ternary('yes', 'no') }}
|
2018-03-07 03:28:23 +01:00
|
|
|
ChallengeResponseAuthentication no
|
|
|
|
PubkeyAuthentication yes
|
2020-03-18 11:30:48 +01:00
|
|
|
PermitRootLogin without-password
|
|
|
|
LoginGraceTime 120
|
|
|
|
StrictModes yes
|
2020-08-04 15:49:36 +02:00
|
|
|
X11Forwarding {{ sshd__xforwarding | ternary('yes', 'no') }}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
2020-03-26 14:14:59 +01:00
|
|
|
AllowTcpForwarding yes
|
|
|
|
#GatewayPorts no
|
|
|
|
#X11DisplayOffset 10
|
|
|
|
#X11UseLocalhost yes
|
|
|
|
#PermitTTY yes
|
|
|
|
|
|
|
|
PrintMotd no
|
|
|
|
PrintLastLog yes
|
|
|
|
TCPKeepAlive yes
|
|
|
|
|
|
|
|
#PermitUserEnvironment no
|
|
|
|
#Compression delayed
|
|
|
|
#ClientAliveInterval 0
|
|
|
|
#ClientAliveCountMax 3
|
|
|
|
#UseDNS no
|
|
|
|
#PidFile /var/run/sshd.pid
|
|
|
|
#MaxStartups 10:30:100
|
|
|
|
#PermitTunnel no
|
|
|
|
#ChrootDirectory none
|
|
|
|
#VersionAddendum none
|
|
|
|
|
|
|
|
# no default banner path
|
|
|
|
#Banner none
|
|
|
|
|
|
|
|
|
2018-03-07 03:28:23 +01:00
|
|
|
# If you just want the PAM account and session checks to run without
|
|
|
|
# PAM authentication, then enable this but set PasswordAuthentication
|
|
|
|
# and ChallengeResponseAuthentication to 'no'.
|
|
|
|
UsePAM yes
|
|
|
|
|
|
|
|
# User Authentication
|
2022-05-03 19:04:58 +02:00
|
|
|
{% if not sshd__restrict_users -%}#{%- endif -%}
|
|
|
|
AllowUsers {{ sshd__allowed_users|join(' ') }}
|
2020-12-15 21:24:59 +01:00
|
|
|
|
2022-05-03 19:04:58 +02:00
|
|
|
# Group Authentication
|
|
|
|
{% if not sshd__restrict_groups -%}#{%- endif -%}
|
|
|
|
AllowGroups {{ sshd__allowed_groups|join(' ') }}
|
2018-03-07 03:28:23 +01:00
|
|
|
|
|
|
|
# Allow client to pass locale environment variables
|
|
|
|
AcceptEnv LANG LC_*
|
|
|
|
|
|
|
|
# sftp (required by ansible)
|
2019-11-20 09:44:44 +01:00
|
|
|
# Subsystem sftp /usr/lib/openssh/sftp-server
|
2019-11-20 10:20:58 +01:00
|
|
|
{% if ansible_os_family == 'RedHat' %}
|
2019-11-20 10:15:12 +01:00
|
|
|
Subsystem sftp /usr/libexec/openssh/sftp-server
|
2022-08-31 12:01:10 +02:00
|
|
|
{% elif ansible_os_family == 'Archlinux' %}
|
|
|
|
Subsystem sftp /usr/lib/ssh/sftp-server
|
2019-11-20 10:15:12 +01:00
|
|
|
{% else %}
|
|
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
|
|
{% endif %}
|