49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
---
|
|
#
|
|
# FedRAMP Moderate & High Baseline SSH Configuration
|
|
#
|
|
# Implements NIST SP 800-53 Rev 5 controls for FedRAMP Moderate and High:
|
|
# - AC-17 (Remote Access)
|
|
# - IA-2 (Identification and Authentication)
|
|
# - SC-8 (Transmission Confidentiality and Integrity)
|
|
# - SC-13 (Cryptographic Protection)
|
|
# - AU-2 (Audit Events)
|
|
# - FIPS 140-2 compatible algorithms
|
|
#
|
|
# Baselines: Moderate (325 controls) and High (421 controls)
|
|
#
|
|
|
|
- name: FedRAMP Moderate & High baseline SSH
|
|
hosts: fedramp_systems
|
|
become: true
|
|
|
|
roles:
|
|
- role: welshwandering.openssh_server
|
|
vars:
|
|
# AC-17: Remote Access Control
|
|
# IA-2: Identification and Authentication (Multi-factor)
|
|
openssh_password_authentication: false
|
|
openssh_permit_root_login: "no"
|
|
|
|
# SC-13: Cryptographic Protection (FIPS 140-2 compatible)
|
|
# Defaults use: AES, ChaCha20, Curve25519, DH Group 16+
|
|
# Note: Full FIPS 140-2 requires OS-level FIPS mode
|
|
|
|
# Enhanced RSA key size (NSA/CISA requirement)
|
|
openssh_required_rsa_size: 3072
|
|
|
|
# AU-2: Audit Events - Comprehensive logging
|
|
openssh_enable_verbose_logging: true
|
|
openssh_log_level: "VERBOSE"
|
|
|
|
# Session controls
|
|
openssh_max_auth_tries: 3
|
|
openssh_login_grace_time: "60s"
|
|
|
|
# Session re-keying (CCCS ITSP.40.062 also requires this)
|
|
openssh_rekey_limit: "512M 30m" # Re-key every 512MB or 30 minutes
|
|
|
|
# Client timeout for idle sessions (AC-12)
|
|
openssh_client_alive_interval: 300
|
|
openssh_client_alive_count_max: 0 # Disconnect immediately on timeout
|