ansible

ansible/roles/ssh_hardening/defaults/main.yaml

@@ -0,0 +1,60 @@
+---
+# SSH Hardening Role Default Variables
+
+# Networks allowed to access SSH (VPC and WireGuard)
+ssh_allowed_networks:
+  - 10.20.0.0/24  # WireGuard VPN
+  - 10.10.0.0/20  # Internal VPC
+
+# Whether to allow public SSH access for git operations (Forgejo)
+# Set to true on Forgejo host, false on other servers
+ssh_allow_public_git: false
+
+# Shell users that require network restrictions
+ssh_shell_users:
+  - asxpi
+  - deploy
+  - root
+
+# Git user for Forgejo (allowed from anywhere when ssh_allow_public_git is true)
+ssh_git_user: forgejo
+
+# SSH hardening settings
+ssh_max_auth_tries: 3
+ssh_max_sessions: 5
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 2
+
+# Strong cryptography settings
+ssh_ciphers:
+  - chacha20-poly1305@openssh.com
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_macs:
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_kex_algorithms:
+  - sntrup761x25519-sha512@openssh.com  # Post-quantum hybrid (OpenSSH 9.0+)
+  - curve25519-sha256
+  - curve25519-sha256@libssh.org
+  - diffie-hellman-group-exchange-sha256
+  - diffie-hellman-group16-sha512
+  - diffie-hellman-group18-sha512
+
+# Public key algorithms (includes RSA-SHA2 for existing keys)
+ssh_pubkey_accepted_algorithms:
+  - ssh-ed25519
+  - ssh-ed25519-cert-v01@openssh.com
+  - sk-ssh-ed25519@openssh.com
+  - ecdsa-sha2-nistp256
+  - ecdsa-sha2-nistp384
+  - ecdsa-sha2-nistp521
+  - rsa-sha2-512
+  - rsa-sha2-256

ansible/roles/ssh_hardening/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+- name: restart sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted
+    enabled: true

ansible/roles/ssh_hardening/tasks/main.yaml

@@ -0,0 +1,80 @@
+---
+- name: Install iptables and iptables-persistent
+  ansible.builtin.apt:
+    name:
+      - iptables
+      - iptables-persistent
+      - netfilter-persistent
+    state: present
+    update_cache: true
+
+- name: Deploy SSH hardening configuration
+  ansible.builtin.template:
+    src: 99-ssh-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/99-ssh-hardening.conf
+    mode: '0644'
+    owner: root
+    group: root
+    validate: 'sshd -t -f %s'
+  notify: restart sshd
+
+- name: Configure iptables for SSH restrictions (non-Forgejo servers)
+  block:
+    - name: Accept SSH from WireGuard network
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        source: 10.20.0.0/24
+        jump: ACCEPT
+        comment: Allow SSH from WireGuard VPN
+
+    - name: Accept SSH from VPC network
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        source: 10.10.0.0/20
+        jump: ACCEPT
+        comment: Allow SSH from internal VPC
+
+    - name: Accept established SSH connections
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        ctstate: ESTABLISHED,RELATED
+        jump: ACCEPT
+        comment: Allow established SSH connections
+
+    - name: Drop all other SSH connections
+      ansible.builtin.iptables:
+        chain: INPUT
+        protocol: tcp
+        destination_port: '22'
+        jump: DROP
+        comment: Drop SSH from untrusted networks
+
+  when: not ssh_allow_public_git
+
+- name: Save iptables rules
+  ansible.builtin.shell: |
+    iptables-save > /etc/iptables/rules.v4
+    netfilter-persistent save
+  args:
+    executable: /bin/bash
+  changed_when: true
+  when: not ssh_allow_public_git
+
+- name: Display SSH access information
+  ansible.builtin.debug:
+    msg: |
+      SSH hardening applied to {{ inventory_hostname }}:
+      - Shell users ({{ ssh_shell_users | join(', ') }}): Only from {{ ssh_allowed_networks | join(', ') }}
+      {% if ssh_allow_public_git %}
+      - Git user ({{ ssh_git_user }}): Public access allowed for Forgejo
+      - No iptables restrictions (sshd AllowUsers controls access)
+      {% else %}
+      - iptables rules: SSH blocked except from trusted networks
+      {% endif %}
+      - Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM)

ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2

@@ -0,0 +1,32 @@
+# SSH Hardening Configuration
+# Generated by Ansible on {{ ansible_date_time.iso8601 }}
+# Server: {{ inventory_hostname }}
+
+# Connection settings
+MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions {{ ssh_max_sessions }}
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+
+# Security hardening
+StrictModes yes
+X11Forwarding no
+PrintMotd no
+
+# Strong cryptography only
+Ciphers {{ ssh_ciphers | join(',') }}
+MACs {{ ssh_macs | join(',') }}
+KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
+PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}
+
+# Access control - restrict shell users to trusted networks only
+{% for user in ssh_shell_users %}
+{% for network in ssh_allowed_networks %}
+AllowUsers {{ user }}@{{ network }}
+{% endfor %}
+{% endfor %}
+
+{% if ssh_allow_public_git %}
+# Allow Forgejo git user from anywhere for git operations
+AllowUsers {{ ssh_git_user }}
+{% endif %}