libretic/ansible-sshd
6
0
Fork 0
mirror of https://github.com/willshersystems/ansible-sshd synced 2024-11-23 03:20:19 +01:00
Code Issues Projects Releases Packages Wiki Activity
ansible-sshd/vars/RedHat_8.yml

36 lines
1.1 KiB
YAML
Raw Normal View History

vars: add config for RedHat/CentOS 8 besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.
2019-10-14 14:48:03 +02:00
---
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices
2020-11-04 21:29:48 +01:00
sshd_packages:
vars: add config for RedHat/CentOS 8 besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.
2019-10-14 14:48:03 +02:00
- openssh
- openssh-server
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices
2020-11-04 21:29:48 +01:00
sshd_sftp_server: /usr/libexec/openssh/sftp-server
vars: add config for RedHat/CentOS 8 besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.
2019-10-14 14:48:03 +02:00
__sshd_defaults:
HostKey:
- /etc/ssh/ssh_host_rsa_key
- /etc/ssh/ssh_host_ecdsa_key
- /etc/ssh/ssh_host_ed25519_key
SyslogFacility: AUTHPRIV
AuthorizedKeysFile: .ssh/authorized_keys
PasswordAuthentication: yes
Update RHEL8 defaults to match reality
2020-11-20 23:10:00 +01:00
PermitRootLogin: yes
vars: add config for RedHat/CentOS 8 besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.
2019-10-14 14:48:03 +02:00
ChallengeResponseAuthentication: no
GSSAPIAuthentication: yes
GSSAPICleanupCredentials: no
Reformat yaml files to avoid wrong indentation, trailing spaces and long lines
2020-09-14 17:48:04 +02:00
# Note that UsePAM: no is not supported under RHEL/CentOS. See
# https://github.com/willshersystems/ansible-sshd/pull/51#issuecomment-287333218
vars: add config for RedHat/CentOS 8 besides dropping the deprecated Sandbox option, set `GSSAPICleanupCredentials no` since that's what I have on a fresh installation of CentOS 8.
2019-10-14 14:48:03 +02:00
UsePAM: yes
X11Forwarding: yes
PrintMotd: no
AcceptEnv:
- LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
- LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
- LC_IDENTIFICATION LC_ALL LANGUAGE
- XMODIFIERS
Subsystem: "sftp {{ sshd_sftp_server }}"
__sshd_os_supported: yes
Add support for sysconfig on Fedora/RHEL This is useful for opting out from system-wide cryto policy for SSH or configuring advanced use case (strong RNG seed). Fixes: #141
2020-10-06 21:11:35 +02:00
__sshd_sysconfig_supports_use_strong_rng: true
__sshd_sysconfig_supports_crypto_policy: true
Fix variable precedence for sshd_hostkey_* variables This worked fine with the new include_role: invocation, but not with the old roles: invocation.
2021-06-02 11:17:39 +02:00
__sshd_hostkey_group: ssh_keys
__sshd_hostkey_mode: "0640"
Filter out Ed25519 keys from default in FIPS mode Signed-off-by: Jakub Jelen <jjelen@redhat.com>
2021-11-09 15:17:08 +01:00
__sshd_hostkeys_nofips:
- /etc/ssh/ssh_host_ed25519_key
Reference in a new issue Copy permalink