ansible

ansible/roles/ssh_hardening/defaults/main.yaml

@@ -0,0 +1,60 @@
+---
+# SSH Hardening Role Default Variables
+
+# Networks allowed to access SSH (VPC and WireGuard)
+ssh_allowed_networks:
+  - 10.20.0.0/24  # WireGuard VPN
+  - 10.10.0.0/20  # Internal VPC
+
+# Whether to allow public SSH access for git operations (Forgejo)
+# Set to true on Forgejo host, false on other servers
+ssh_allow_public_git: false
+
+# Shell users that require network restrictions
+ssh_shell_users:
+  - asxpi
+  - deploy
+  - root
+
+# Git user for Forgejo (allowed from anywhere when ssh_allow_public_git is true)
+ssh_git_user: forgejo
+
+# SSH hardening settings
+ssh_max_auth_tries: 3
+ssh_max_sessions: 5
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 2
+
+# Strong cryptography settings
+ssh_ciphers:
+  - chacha20-poly1305@openssh.com
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_macs:
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+
+ssh_kex_algorithms:
+  - sntrup761x25519-sha512@openssh.com  # Post-quantum hybrid (OpenSSH 9.0+)
+  - curve25519-sha256
+  - curve25519-sha256@libssh.org
+  - diffie-hellman-group-exchange-sha256
+  - diffie-hellman-group16-sha512
+  - diffie-hellman-group18-sha512
+
+# Public key algorithms (includes RSA-SHA2 for existing keys)
+ssh_pubkey_accepted_algorithms:
+  - ssh-ed25519
+  - ssh-ed25519-cert-v01@openssh.com
+  - sk-ssh-ed25519@openssh.com
+  - ecdsa-sha2-nistp256
+  - ecdsa-sha2-nistp384
+  - ecdsa-sha2-nistp521
+  - rsa-sha2-512
+  - rsa-sha2-256