ansible-sshd/vars/RedHat_7.yml

---
sshd_packages:
  - openssh
  - openssh-server
sshd_sftp_server: /usr/libexec/openssh/sftp-server
__sshd_defaults:
  HostKey:
    - /etc/ssh/ssh_host_rsa_key
    - /etc/ssh/ssh_host_ecdsa_key
    - /etc/ssh/ssh_host_ed25519_key
  SyslogFacility: AUTHPRIV
  AuthorizedKeysFile: .ssh/authorized_keys
  PasswordAuthentication: yes
  ChallengeResponseAuthentication: no
  GSSAPIAuthentication: yes
  GSSAPICleanupCredentials: no
  # Note that UsePAM: no is not supported under RHEL/CentOS. See
  # https://github.com/willshersystems/ansible-sshd/pull/51#issuecomment-287333218
  UsePAM: yes
  X11Forwarding: yes
  UsePrivilegeSeparation: sandbox
  AcceptEnv:
    - LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
    - LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
    - LC_IDENTIFICATION LC_ALL LANGUAGE
    - XMODIFIERS
  Subsystem: "sftp {{ sshd_sftp_server }}"
__sshd_os_supported: yes
__sshd_sysconfig_supports_use_strong_rng: true
sshd_hostkey_group: ssh_keys
sshd_hostkey_mode: "0640"
Add EL 7 2014-12-22 19:49:17 +01:00			`---`
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices 2020-11-04 21:29:48 +01:00			`sshd_packages:`
Add EL 7 2014-12-22 19:49:17 +01:00			`- openssh`
			`- openssh-server`
Remove set_facts tasks not to polute global namespace The usage of set_facts inside of roles is not recommended if it is used for internal variables used only inside of the role. It is recommended to use variables with smaller scope to avoid inter-dependencies between different invocations of the same role as demonstrated in the tests_alternative_file.yml later in the patch series ttps://github.com/oasis-roles/meta_standards#ansible-best-practices 2020-11-04 21:29:48 +01:00			`sshd_sftp_server: /usr/libexec/openssh/sftp-server`
Renames variables for all supported platforms 2018-09-03 00:23:58 +02:00			`__sshd_defaults:`
Add EL 7 2014-12-22 19:49:17 +01:00			`HostKey:`
			`- /etc/ssh/ssh_host_rsa_key`
			`- /etc/ssh/ssh_host_ecdsa_key`
Add ed25519 support for EL7 ed25519 support was added in RH7.1 2015-08-25 18:58:17 +02:00			`- /etc/ssh/ssh_host_ed25519_key`
Add EL 7 2014-12-22 19:49:17 +01:00			`SyslogFacility: AUTHPRIV`
			`AuthorizedKeysFile: .ssh/authorized_keys`
			`PasswordAuthentication: yes`
			`ChallengeResponseAuthentication: no`
			`GSSAPIAuthentication: yes`
Fix default configuration for RHEL7 2020-09-17 17:40:44 +02:00			`GSSAPICleanupCredentials: no`
Reformat yaml files to avoid wrong indentation, trailing spaces and long lines 2020-09-14 17:48:04 +02:00			`# Note that UsePAM: no is not supported under RHEL/CentOS. See`
			`# https://github.com/willshersystems/ansible-sshd/pull/51#issuecomment-287333218`
Add EL 7 2014-12-22 19:49:17 +01:00			`UsePAM: yes`
			`X11Forwarding: yes`
Merge from develop changes 2015-01-04 13:51:40 +01:00			`UsePrivilegeSeparation: sandbox`
Add EL 7 2014-12-22 19:49:17 +01:00			`AcceptEnv:`
fix type in AcceptEnv for RedHat7 2015-06-25 22:22:39 +02:00			`- LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES`
Add EL 7 2014-12-22 19:49:17 +01:00			`- LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT`
			`- LC_IDENTIFICATION LC_ALL LANGUAGE`
			`- XMODIFIERS`
More distro supported, better docs 2014-12-22 21:18:35 +01:00			`Subsystem: "sftp {{ sshd_sftp_server }}"`
Renames variables for all supported platforms 2018-09-03 00:23:58 +02:00			`__sshd_os_supported: yes`
Add support for sysconfig on Fedora/RHEL This is useful for opting out from system-wide cryto policy for SSH or configuring advanced use case (strong RNG seed). Fixes: #141 2020-10-06 21:11:35 +02:00			`__sshd_sysconfig_supports_use_strong_rng: true`
Implement hostkey checks This is useful during provisioning, when the keys were not generated by sshd-keygen service or similar principles depending on operating system. This is also helpful when running this role in containers, where is no service running either. The keys are generally readable only by root, but in RHEL and Fedora, they are readable also by group ssh_keys, which is used for hostbased authentication. This should fix #111 2020-10-23 21:10:00 +02:00			`sshd_hostkey_group: ssh_keys`
			`sshd_hostkey_mode: "0640"`