34 lines
1.3 KiB
Django/Jinja
34 lines
1.3 KiB
Django/Jinja
# SSH Hardening Configuration
|
|
# Generated by Ansible on {{ ansible_date_time.iso8601 }}
|
|
# Server: {{ inventory_hostname }}
|
|
|
|
# Connection settings
|
|
MaxAuthTries {{ ssh_max_auth_tries }}
|
|
MaxSessions {{ ssh_max_sessions }}
|
|
ClientAliveInterval {{ ssh_client_alive_interval }}
|
|
ClientAliveCountMax {{ ssh_client_alive_count_max }}
|
|
|
|
# Security hardening
|
|
StrictModes yes
|
|
X11Forwarding no
|
|
PrintMotd no
|
|
|
|
# Multiple authorized_keys files
|
|
# - .ssh/authorized_keys: Manual/emergency keys
|
|
# - .ssh/authorized_keys.forgejo: Git-managed keys (deployed via Forgejo Actions)
|
|
AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.forgejo
|
|
|
|
# Strong cryptography only
|
|
Ciphers {{ ssh_ciphers | join(',') }}
|
|
MACs {{ ssh_macs | join(',') }}
|
|
KexAlgorithms {{ ssh_kex_algorithms | join(',') }}
|
|
PubkeyAcceptedAlgorithms {{ ssh_pubkey_accepted_algorithms | join(',') }}
|
|
|
|
# Access control - restrict shell users to trusted networks only
|
|
{% if ssh_shell_users | length > 0 and ssh_allowed_networks | length > 0 %}
|
|
AllowUsers {% for user in ssh_shell_users %}{% for network in ssh_allowed_networks %}{{ user }}@{{ network }} {% endfor %}{% endfor %}{% if ssh_allow_public_git %}{{ ssh_git_user }}{% endif %}
|
|
|
|
{% elif ssh_allow_public_git %}
|
|
# Allow Forgejo git user from anywhere for git operations
|
|
AllowUsers {{ ssh_git_user }}
|
|
{% endif %}
|