WoodSmellParticle/ansible-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(security): tightened files mode for ssh configuration and enabled ipv6 on ssh, along with an increase on max sessions from 3 to 5

Browse source
This commit is contained in:
NaeiKinDus 2024-08-08 00:00:00 +00:00
parent 3acdd804df
commit b7ba39bce9
Signed by: WoodSmellParticle
GPG key ID: 8E52ADFF7CA8AE56
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
collections/ansible_collections/nullified/infrastructure/roles/security/tasks/main.yml
View file

@ -35,17 +35,17 @@
ansible.builtin.template: ansible.builtin.template:
src: ../templates/openssh-server/sshd_config.j2 src: ../templates/openssh-server/sshd_config.j2
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
mode: '0644' mode: '0600'
- name: '[ssh] ensure directories exist' - name: '[ssh] ensure directories exist'
ansible.builtin.file: ansible.builtin.file:
path: /etc/ssh/sshd_config.d path: /etc/ssh/sshd_config.d
state: directory state: directory
mode: '0755' mode: '0700'
- name: '[ssh] setup sshd_config.d' - name: '[ssh] setup sshd_config.d'
ansible.builtin.template: ansible.builtin.template:
src: ../templates/openssh-server/sshd_config.d/encryption.conf.j2 src: ../templates/openssh-server/sshd_config.d/encryption.conf.j2
dest: /etc/ssh/sshd_config.d/encryption.conf dest: /etc/ssh/sshd_config.d/encryption.conf
mode: '0644' mode: '0600'
- name: '[ssh] remove low security keys' - name: '[ssh] remove low security keys'
ansible.builtin.file: ansible.builtin.file:
path: "/etc/ssh/{{ item }}" path: "/etc/ssh/{{ item }}"

6
collections/ansible_collections/nullified/infrastructure/roles/security/templates/openssh-server/sshd_config.j2
View file

@ -1,14 +1,14 @@
AcceptEnv LANG LC_* AcceptEnv LANG LC_*
AddressFamily inet AddressFamily any
AllowAgentForwarding no AllowAgentForwarding no
ChallengeResponseAuthentication no ChallengeResponseAuthentication no
ClientAliveCountMax 2 ClientAliveCountMax 2
ClientAliveInterval 300 ClientAliveInterval 300
HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_ed25519_key
IgnoreRhosts yes IgnoreRhosts yes
LogLevel VERBOSE LogLevel INFO
MaxAuthTries 3 MaxAuthTries 3
MaxSessions 3 MaxSessions 5
PermitEmptyPasswords no PermitEmptyPasswords no
PermitRootLogin no PermitRootLogin no
PrintMotd yes PrintMotd yes