asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ssh managment

Browse source
This commit is contained in:
Sergei Poljanski 2025-11-09 11:58:19 +02:00
commit f6c583ddfc
2 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ansible/roles/ssh_hardening/tasks/main.yaml
View file

@ -101,3 +101,4 @@
- iptables rules: SSH blocked except from trusted networks - iptables rules: SSH blocked except from trusted networks
{% endif %} {% endif %}
- Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM) - Strong cryptography enforced (RSA-SHA2, Ed25519, ChaCha20, AES-GCM)
- Authorized keys files: .ssh/authorized_keys (manual), .ssh/authorized_keys.forgejo (git-managed)

5
ansible/roles/ssh_hardening/templates/99-ssh-hardening.conf.j2
View file

@ -13,6 +13,11 @@ StrictModes yes
X11Forwarding no X11Forwarding no
PrintMotd no PrintMotd no
# Multiple authorized_keys files
# - .ssh/authorized_keys: Manual/emergency keys
# - .ssh/authorized_keys.forgejo: Git-managed keys (deployed via Forgejo Actions)
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.forgejo
# Strong cryptography only # Strong cryptography only
Ciphers {{ ssh_ciphers | join(',') }} Ciphers {{ ssh_ciphers | join(',') }}
MACs {{ ssh_macs | join(',') }} MACs {{ ssh_macs | join(',') }}