ansible

ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2

@@ -0,0 +1,32 @@
+# SSH Hardening Configuration
+# Generated by Ansible on {{ ansible_date_time.iso8601 }}
+# Server: {{ inventory_hostname }}
+
+# Connection settings
+MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions {{ ssh_max_sessions }}
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+
+# Security hardening
+StrictModes yes
+X11Forwarding no
+PrintMotd no
+
+# Strong cryptography only
+Ciphers {{ ssh_ciphers | join(',') }}
+MACs {{ ssh_macs | join(',') }}
+KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
+PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}
+
+# Access control - restrict shell users to trusted networks only
+{% for user in ssh_shell_users %}
+{% for network in ssh_allowed_networks %}
+AllowUsers {{ user }}@{{ network }}
+{% endfor %}
+{% endfor %}
+
+{% if ssh_allow_public_git %}
+# Allow Forgejo git user from anywhere for git operations
+AllowUsers {{ ssh_git_user }}
+{% endif %}