blob: f61da5cf06fbf01c0bf6c9cdd58ed06b81cec2d8 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
# Ansible Role: ssh
This role configure the ssh functionality of a linux distro with hardening
## Role Variables
- `username` the user account to be added to the ssh allowed users.
- `ssh_port` the port number to be enabled for ssh (default: 2222)
- `ssh_private_key` pre-generated Ed25519 host private key, unique per host. Generate with:
`ssh-keygen -t ed25519 -f host_key -C '' -N ''`
- `ssh_public_key` matching pre-generated Ed25519 host public key
## Internals
- ensure that ssh packages is installed and enabled
- deploy pre-generated ssh host keys (stable across reprovision/reimage, no key regeneration on each setup)
- configure ssh defaults
- disable keyboard interactive authentication
- disable PAM authentication
- configure ssh authentication policy (hardened)
- configure custom ssh port
- disable password authentication
- require public key authentication
- disable root login
- add user (username) to allowed authentication users
- TBA: `fail2ban`
|
