This role provides secure ssh-client and ssh-server configurations. It is intended to be compliant with the DevSec SSH Baseline.
ansible-galaxy install arillso.sshdNone
true if IPv6 is needed
ssh_ipv6_enable: '{{ network_ipv6_enable | default(false) }}' # sshd + sshtrue if sshd should be started and enabled
ssh_server_enabled: true # sshdtrue if DNS resolutions are needed, look up the remote host name, defaults to false from 6.8, see: http://www.openssh.com/txt/release-6.8
ssh_use_dns: false # sshdtrue or value if compression is needed
ssh_compression: false # sshdFor which components (client and server) to generate the configuration for. Can be useful when running against a client without an SSH server.
ssh_client_hardening: true # ssh
ssh_server_hardening: true # sshdIf true, password login is allowed
ssh_client_password_login: false # ssh
ssh_server_password_login: false # sshdports on which ssh-server should listen
ssh_server_ports: ['22'] # sshdport to which ssh-client should connect
ssh_client_port: '22' # sshone or more ip addresses, to which ssh-server should listen to. Default is empty, but should be configured for security reasons!
ssh_listen_to: ['0.0.0.0'] # sshdHost keys to look for when starting sshd.
ssh_host_key_files: [] # sshdSpecifies the maximum number of authentication attempts permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
ssh_max_auth_retries: 2ssh_client_alive_interval: 300 # sshdssh_client_alive_count: 3 # sshdAllow SSH Tunnels
ssh_permit_tunnel: falseHosts with custom options. # ssh
ssh_remote_hosts: []ssh_remote_hosts:
- names: ['example.com', 'example2.com']
options: ['Port 2222', 'ForwardAgent yes']
- names: ['example3.com']
options: ['StrictHostKeyChecking no']Set this to "without-password" or "yes" to allow root to login
ssh_allow_root_with_key: 'no' # sshdfalse to disable TCP Forwarding. Set to true to allow TCP Forwarding.
ssh_allow_tcp_forwarding: false # sshdfalse to disable binding forwarded ports to non-loopback addresses. Set to true to force binding on wildcard address.
Set to 'clientspecified' to allow the client to specify which address to bind to.
ssh_gateway_ports: false # sshdfalse to disable Agent Forwarding. Set to true to allow Agent Forwarding.
ssh_allow_agent_forwarding: false # sshdtrue if SSH has PAM support
ssh_pam_support: truefalse to disable pam authentication.
ssh_use_pam: false # sshdfalse to disable google 2fa authentication
ssh_google_auth: false # sshdfalse to disable pam device 2FA input
ssh_pam_device: false # sshdtrue if SSH support GSSAPI
ssh_gssapi_support: falsetrue if SSH support Kerberos
ssh_kerberos_support: trueif specified, login is disallowed for user names that match one of the patterns.
ssh_deny_users: '' # sshdif specified, login is allowed only for user names that match one of the patterns.
ssh_allow_users: '' # sshdif specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
ssh_deny_groups: '' # sshdif specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
ssh_allow_groups: '' # sshdchange default file that contains the public keys that can be used for user authentication.
ssh_authorized_keys_file: '' # sshdspecifies the file containing trusted certificate authorities public keys used to sign user certificates.
ssh_trusted_user_ca_keys_file: '' # sshdset the trusted certificate authorities public keys used to sign user certificates.
ssh_trusted_user_ca_keys: [] # sshdssh_trusted_user_ca_keys:
- 'ssh-rsa ... comment1'
- 'ssh-rsa ... comment2'specifies the file containing principals that are allowed. Only used if ssh_trusted_user_ca_keys_file is set.
ssh_authorized_principals_file: '' # sshdssh_authorized_principals_file: '/etc/ssh/auth_principals/%u'%h is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user. After expansion, the path is taken to be an absolute path or one relative to the user's home directory.
list of hashes containing file paths and authorized principals. Only used if ssh_authorized_principals_file is set.
ssh_authorized_principals: [] # sshdssh_authorized_principals:
- {
path: '/etc/ssh/auth_principals/root',
principals: ['root'],
owner: '{{ ssh_owner }}',
group: '{{ ssh_group }}',
directoryowner: '{{ ssh_owner }}',
directorygroup: '{{ ssh_group}}',
}
- {
path: '/etc/ssh/auth_principals/myuser',
principals: ['masteradmin', 'webserver'],
}false to disable printing of the MOTD
ssh_print_motd: false # sshdfalse to disable display of last login information
ssh_print_last_log: false # sshdfalse to disable serving /etc/ssh/banner.txt before authentication is allowed
ssh_banner: false # sshdfalse to disable distribution version leakage during initial protocol handshake
ssh_print_debian_banner: false # sshd (Debian OS family only)true to enable sftp configuration
ssh_sftp_enabled: '{{ sftp_enabled |
6D47
default(false) }}'false to disable sftp chroot
ssh_sftp_chroot: '{{ sftp_chroot | default(true) }}'change default sftp chroot location
ssh_sftp_chroot_dir: "{{ sftp_chroot_dir | default('/home/%u') }}"enable experimental client roaming
ssh_client_roaming: falselist of hashes (containing user and rules) to generate Match User blocks for.
ssh_server_match_user: false # sshdlist of hashes (containing group and rules) to generate Match Group blocks for.
ssh_server_match_group: false # sshdlist of hashes (containing addresses/subnets and rules) to generate Match Address blocks for.
ssh_server_match_address: false # sshdssh_server_permit_environment_vars: falsemaximum number of concurrent unauthenticated connections to the SSH daemon
ssh_max_startups: '10:30:100' # sshdssh_ps53: 'yes'ssh_ps59: 'sandbox'ssh_macs: []ssh_ciphers: []ssh_kex: []ssh_macs_53_default:
- hmac-ripemd160
- hmac-sha1ssh_macs_59_default:
- hmac-sha2-512
- hmac-sha2-256
- hmac-ripemd160ssh_macs_66_default:
- hmac-sha2-512-etm@openssh.com
- hmac-sha2-256-etm@openssh.com
- umac-128-etm@openssh.com
- hmac-sha2-512
- hmac-sha2-256ssh_macs_76_default:
- hmac-sha2-512-etm@openssh.com
- hmac-sha2-256-etm@openssh.com
- umac-128-etm@openssh.com
- hmac-sha2-512
- hmac-sha2-256ssh_ciphers_53_default:
- aes256-ctr
- aes192-ctr
- aes128-ctrssh_ciphers_66_default:
- chacha20-poly1305@openssh.com
- aes256-gcm@openssh.com
- aes128-gcm@openssh.com
- aes256-ctr
- aes192-ctr
- aes128-ctrssh_kex_59_default:
- diffie-hellman-group-exchange-sha256ssh_kex_66_default:
- curve25519-sha256@libssh.org
- diffie-hellman-group-exchange-sha256directory where to store ssh_password policy
ssh_custom_selinux_dir: '/etc/selinux/local-policies'
sshd_moduli_file: '/etc/ssh/moduli'
sshd_moduli_minimum: 2048disable ChallengeResponseAuthentication
ssh_challengeresponseauthentication: falsea list of public keys that are never accepted by the ssh server
ssh_server_revoked_keys: []Set to false to turn the role into a no-op. Useful when using the Ansible role dependency mechanism.
ssh_hardening_enabled: trueCustom options for SSH client configuration file
ssh_custom_options: []Custom options for SSH daemon configuration file
sshd_custom_options: []None
- hosts: all
roles:
- arillso.sshdThis project is under the MIT License. See the LICENSE file for the full license text.
(c) 2019, Arilso