32 lines
950 B
Django/Jinja
32 lines
950 B
Django/Jinja
# SSH Hardening Configuration
|
|
# Generated by Ansible on {{ ansible_date_time.iso8601 }}
|
|
# Server: {{ inventory_hostname }}
|
|
|
|
# Connection settings
|
|
MaxAuthTries {{ ssh_max_auth_tries }}
|
|
MaxSessions {{ ssh_max_sessions }}
|
|
ClientAliveInterval {{ ssh_client_alive_interval }}
|
|
ClientAliveCountMax {{ ssh_client_alive_count_max }}
|
|
|
|
# Security hardening
|
|
StrictModes yes
|
|
X11Forwarding no
|
|
PrintMotd no
|
|
|
|
# Strong cryptography only
|
|
Ciphers {{ ssh_ciphers | join(',') }}
|
|
MACs {{ ssh_macs | join(',') }}
|
|
KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
|
|
PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}
|
|
|
|
# Access control - restrict shell users to trusted networks only
|
|
{% for user in ssh_shell_users %}
|
|
{% for network in ssh_allowed_networks %}
|
|
AllowUsers {{ user }}@{{ network }}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
|
|
{% if ssh_allow_public_git %}
|
|
# Allow Forgejo git user from anywhere for git operations
|
|
AllowUsers {{ ssh_git_user }}
|
|
{% endif %}
|