libretic/ansible-sshd
6
0
Fork 0
mirror of https://github.com/willshersystems/ansible-sshd synced 2024-12-01 07:00:17 +01:00
Code Issues Projects Releases Packages Wiki Activity

update Ubuntu 14 defaults for modern security recomendations

Browse source
This commit is contained in:
David Panofsky 2017-09-13 14:30:48 -04:00
parent 74044c1349
commit 604c35bdce
1 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
vars/Ubuntu_14.yml
View file

@ -8,15 +8,13 @@ sshd_defaults:
Port: 22
Protocol: 2
HostKey:
- /etc/ssh/ssh_host_rsa_key
- /etc/ssh/ssh_host_dsa_key
- /etc/ssh/ssh_host_ecdsa_key
- /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation: yes
- /etc/ssh/ssh_host_rsa_key
UsePrivilegeSeparation: sandbox
KeyRegenerationInterval: 3600
ServerKeyBits: 1024
SyslogFacility: AUTH
LogLevel: INFO
LogLevel: VERBOSE
LoginGraceTime: 120
PermitRootLogin: without-password
StrictModes: yes
@ -27,12 +25,16 @@ sshd_defaults:
HostbasedAuthentication: no
PermitEmptyPasswords: no
ChallengeResponseAuthentication: no
X11Forwarding: yes
X11Forwarding: no
X11DisplayOffset: 10
PrintMotd: no
PrintMotd: yes
PrintLastLog: yes
TCPKeepAlive: yes
AcceptEnv: LANG LC_*
Subsystem: "sftp {{ sshd_sftp_server }}"
Subsystem: "sftp {{ sshd_sftp_server }} -f AUTHPRIV -l INFO"
UsePAM: yes
KexAlgorithms: curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers: chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
AuthenticationMethods: publickey
sshd_os_supported: yes