ansible-sshd/vars/Gentoo.yml

---
__sshd_packages:
  - net-misc/openssh
__sshd_sftp_server: /usr/lib64/misc/sftp-server
__sshd_defaults:
  Subsystem: "sftp {{ __sshd_sftp_server }}"
  # Replace tcp keepalive with unspoofable keepalive
  TCPKeepAlive: false
  ClientAliveInterval: 300
  ClientAliveCountMax: 2
  # Secure cipher and algorithm settings
  HostKey:
    - /etc/ssh/ssh_host_ed25519_key
    - /etc/ssh/ssh_host_rsa_key
  HostKeyAlgorithms: "ssh-ed25519,ssh-rsa,ssh-ed25519-cert-v01@openssh.com"
  KexAlgorithms: "curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256"
  Ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
  MACs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com"
  AuthorizedKeysFile: .ssh/authorized_keys
  # Security settings
  PasswordAuthentication: false
  ChallengeResponseAuthentication: false
  PermitRootLogin: false
  # Login settings
  UsePAM: true
  PrintMotd: false
  PrintLastLog: true
  # Disable most forwarding types for more security
  AllowAgentForwarding: false
  AllowTcpForwarding: false
  AllowStreamLocalForwarding: false
__sshd_os_supported: true
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`---`
Fixes un-overrideable public api variables 2022-08-17 13:53:56 +02:00			`__sshd_packages:`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`- net-misc/openssh`
Fixes un-overrideable public api variables 2022-08-17 13:53:56 +02:00			`__sshd_sftp_server: /usr/lib64/misc/sftp-server`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`__sshd_defaults:`
Fixes un-overrideable public api variables 2022-08-17 13:53:56 +02:00			`Subsystem: "sftp {{ __sshd_sftp_server }}"`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`# Replace tcp keepalive with unspoofable keepalive`
ansible-lint - align with current Ansible recommendations Use `true/false` instead of `yes/no` Ensure use of FQCN for builtin modules Use correct spacing in Jinja expressions All tasks and plays must have a `name`, and the `name` string must begin with an uppercase letter Use `ansible.posix.mount` instead of `ansible.builtin.mount` Use `set -o pipefail` with `shell` module where supported by the platform shell Signed-off-by: Rich Megginson <rmeggins@redhat.com> 2023-04-10 22:19:29 +02:00			`TCPKeepAlive: false`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`ClientAliveInterval: 300`
			`ClientAliveCountMax: 2`
gentoo: Remove bogus default values 2020-11-05 00:15:22 +01:00			`# Secure cipher and algorithm settings`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`HostKey:`
			`- /etc/ssh/ssh_host_ed25519_key`
			`- /etc/ssh/ssh_host_rsa_key`
			`HostKeyAlgorithms: "ssh-ed25519,ssh-rsa,ssh-ed25519-cert-v01@openssh.com"`
			`KexAlgorithms: "curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256"`
			`Ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"`
			`MACs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com"`
			`AuthorizedKeysFile: .ssh/authorized_keys`
			`# Security settings`
ansible-lint - align with current Ansible recommendations Use `true/false` instead of `yes/no` Ensure use of FQCN for builtin modules Use correct spacing in Jinja expressions All tasks and plays must have a `name`, and the `name` string must begin with an uppercase letter Use `ansible.posix.mount` instead of `ansible.builtin.mount` Use `set -o pipefail` with `shell` module where supported by the platform shell Signed-off-by: Rich Megginson <rmeggins@redhat.com> 2023-04-10 22:19:29 +02:00			`PasswordAuthentication: false`
			`ChallengeResponseAuthentication: false`
			`PermitRootLogin: false`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`# Login settings`
ansible-lint - align with current Ansible recommendations Use `true/false` instead of `yes/no` Ensure use of FQCN for builtin modules Use correct spacing in Jinja expressions All tasks and plays must have a `name`, and the `name` string must begin with an uppercase letter Use `ansible.posix.mount` instead of `ansible.builtin.mount` Use `set -o pipefail` with `shell` module where supported by the platform shell Signed-off-by: Rich Megginson <rmeggins@redhat.com> 2023-04-10 22:19:29 +02:00			`UsePAM: true`
			`PrintMotd: false`
			`PrintLastLog: true`
Add Gentoo support (with secure defaults) 2020-01-19 17:36:50 +01:00			`# Disable most forwarding types for more security`
ansible-lint - align with current Ansible recommendations Use `true/false` instead of `yes/no` Ensure use of FQCN for builtin modules Use correct spacing in Jinja expressions All tasks and plays must have a `name`, and the `name` string must begin with an uppercase letter Use `ansible.posix.mount` instead of `ansible.builtin.mount` Use `set -o pipefail` with `shell` module where supported by the platform shell Signed-off-by: Rich Megginson <rmeggins@redhat.com> 2023-04-10 22:19:29 +02:00			`AllowAgentForwarding: false`
			`AllowTcpForwarding: false`
			`AllowStreamLocalForwarding: false`
			`__sshd_os_supported: true`