31 lines
796 B
YAML
31 lines
796 B
YAML
---
|
|
#
|
|
# Basic SSH Hardening
|
|
#
|
|
# This playbook applies basic SSH hardening suitable for most environments.
|
|
# - Disables password authentication (key-based only)
|
|
# - Restricts root login to key-based auth
|
|
# - Enables modern cryptography
|
|
# - Sets reasonable login limits
|
|
#
|
|
|
|
- name: Basic SSH hardening
|
|
hosts: all
|
|
become: true
|
|
|
|
roles:
|
|
- role: welshwandering.openssh_server
|
|
vars:
|
|
# Disable password authentication (key-based only)
|
|
openssh_password_authentication: false
|
|
|
|
# Allow root login with keys only (no passwords)
|
|
openssh_permit_root_login: 'no'
|
|
|
|
# Login attempt limits
|
|
openssh_max_auth_tries: 3
|
|
openssh_login_grace_time: "30s"
|
|
|
|
# Enable verbose logging for security monitoring
|
|
openssh_log_level: "VERBOSE"
|