From f6c583ddfc42b375f0a4c625107a7f0dd6255dca Mon Sep 17 00:00:00 2001 From: Sergei Poljanski Date: Sun, 9 Nov 2025 11:58:19 +0200 Subject: [PATCH] ssh managment --- ansible/roles/ssh_hardening/tasks/main.yaml | 1 + .../roles/ssh_hardening/templates/99-ssh-hardening.conf.j2 | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/ansible/roles/ssh_hardening/tasks/main.yaml b/ansible/roles/ssh_hardening/tasks/main.yaml index 87681f6..2caa134 100644 --- a/ansible/roles/ssh_hardening/tasks/main.yaml +++ b/ansible/roles/ssh_hardening/tasks/main.yaml @@ -101,3 +101,4 @@ - iptables rules: SSH blocked except from trusted networks {% endif %} - Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM) + - Authorized keys files: .ssh/authorized_keys (manual), .ssh/authorized_keys.forgejo (git-managed) diff --git a/ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2 b/ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2 index 43e0ee8..e8c1a87 100644 --- a/ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2 +++ b/ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2 @@ -13,6 +13,11 @@ StrictModes yes X11Forwarding no PrintMotd no +# Multiple authorized_keys files +# - .ssh/authorized_keys: Manual/emergency keys +# - .ssh/authorized_keys.forgejo: Git-managed keys (deployed via Forgejo Actions) +AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.forgejo + # Strong cryptography only Ciphers {{ ssh_ciphers | join(',') }} MACs {{ ssh_macs | join(',') }}