stephrobert.sshd

⭐ Star us on GitHub — it motivates us a lot!

Install sshd

Platforms Supported:

⚠️ Requirements

Ansible >= 2.11.

Ansible role dependencies

None.

⚡ Installation

Install with Ansible Galaxy

ansible-galaxy install stephrobert.sshd

Install with git

If you do not want a global installation, clone it into your roles_path.

git clone [email protected]:stephrobert/ansible-role-lynis.git  stephrobert.sshd

But I often add it as a submodule in a given playbook_dir repository.

git submodule add [email protected]:stephrobert/ansible-role-lynis.git roles/stephrobert.sshd

As the role is not managed by Ansible Galaxy, you do not have to specify the github user account.

✏️ Example Playbook

Basic usage is:

- hosts: all
  roles:
    - role: stephrobert.sshd
      vars:
        sshd_allowagentforwarding: 'no'
        sshd_allowtcpforwarding: 'no'
        sshd_allowusers: vagrant
        sshd_banner: /etc/issue.net
        sshd_casignaturealgorithms: [email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256
        sshd_ciphers: [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
        sshd_clientalivecountmax: 3
        sshd_clientaliveinterval: 300
        sshd_config_file_path: /etc/ssh/sshd_config.d/20-sshd-hardened.conf
        sshd_gssapikexalgorithms: gss-curve25519-sha256-,gss-group16-sha512-
        sshd_hostbasedacceptedalgorithms: [email protected],[email protected],[email protected],ssh-ed25519,[email protected],rsa-sha2-512,[email protected],rsa-sha2-256
        sshd_hostbasedauthentication: 'no'
        sshd_hostkeyalgorithms: [email protected],[email protected],[email protected],[email protected],[email protected],ssh-ed25519,rsa-sha2-512,rsa-sha2-256
        sshd_ignorerhosts: 'yes'
        sshd_keepalive: 'no'
        sshd_kexalgorithms: [email protected],curve25519-sha256,[email protected],gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
        sshd_logingracetime: 60
        sshd_loglevel: INFO
        sshd_macs: [email protected],[email protected],[email protected]
        sshd_maxauthtries: 3
        sshd_maxsessions: 2
        sshd_maxstartups: 10:30:60
        sshd_permitemptypasswords: 'no'
        sshd_permitrootlogin: 'no'
        sshd_permituserenvironment: 'no'
        sshd_pubkeyacceptedalgorithms: [email protected],[email protected],[email protected],ssh-ed25519,[email protected],rsa-sha2-512,[email protected],rsa-sha2-256
        sshd_x11forwarding: 'no'
        

⚙️ Role Variables

Variables are divided in three types.

The default vars section shows you which variables you may override in your ansible inventory. As a matter of fact, all variables should be defined there for explicitness, ease of documentation as well as overall role manageability.

The context variables are shown in section below hint you on how runtime context may affects role execution.

Default variables

Role default variables from defaults/main.yml.

Context variables

Those variables from vars/*.{yml,json} are loaded dynamically during task runtime using the include_vars module.

Variables loaded from vars/main.yml.

Author Information

none