60 lines
1.5 KiB
YAML
60 lines
1.5 KiB
YAML
---
|
|
# SSH Hardening Role Default Variables
|
|
|
|
# Networks allowed to access SSH (VPC and WireGuard)
|
|
ssh_allowed_networks:
|
|
- 10.20.0.0/24 # WireGuard VPN
|
|
- 10.10.0.0/20 # Internal VPC
|
|
|
|
# Whether to allow public SSH access for git operations (Forgejo)
|
|
# Set to true on Forgejo host, false on other servers
|
|
ssh_allow_public_git: false
|
|
|
|
# Shell users that require network restrictions
|
|
ssh_shell_users:
|
|
- asxpi
|
|
- deploy
|
|
- root
|
|
|
|
# Git user for Forgejo (allowed from anywhere when ssh_allow_public_git is true)
|
|
ssh_git_user: forgejo
|
|
|
|
# SSH hardening settings
|
|
ssh_max_auth_tries: 3
|
|
ssh_max_sessions: 5
|
|
ssh_client_alive_interval: 300
|
|
ssh_client_alive_count_max: 2
|
|
|
|
# Strong cryptography settings
|
|
ssh_ciphers:
|
|
- chacha20-poly1305@openssh.com
|
|
- aes256-gcm@openssh.com
|
|
- aes128-gcm@openssh.com
|
|
- aes256-ctr
|
|
- aes192-ctr
|
|
- aes128-ctr
|
|
|
|
ssh_macs:
|
|
- hmac-sha2-512-etm@openssh.com
|
|
- hmac-sha2-256-etm@openssh.com
|
|
- hmac-sha2-512
|
|
- hmac-sha2-256
|
|
|
|
ssh_kex_algorithms:
|
|
- sntrup761x25519-sha512@openssh.com # Post-quantum hybrid (OpenSSH 9.0+)
|
|
- curve25519-sha256
|
|
- curve25519-sha256@libssh.org
|
|
- diffie-hellman-group-exchange-sha256
|
|
- diffie-hellman-group16-sha512
|
|
- diffie-hellman-group18-sha512
|
|
|
|
# Public key algorithms (includes RSA-SHA2 for existing keys)
|
|
ssh_pubkey_accepted_algorithms:
|
|
- ssh-ed25519
|
|
- ssh-ed25519-cert-v01@openssh.com
|
|
- sk-ssh-ed25519@openssh.com
|
|
- ecdsa-sha2-nistp256
|
|
- ecdsa-sha2-nistp384
|
|
- ecdsa-sha2-nistp521
|
|
- rsa-sha2-512
|
|
- rsa-sha2-256
|