81 lines
2.5 KiB
YAML
81 lines
2.5 KiB
YAML
---
|
|
#
|
|
# Maximum Security SSH Configuration
|
|
#
|
|
# Implements the highest security posture suitable for:
|
|
# - Critical infrastructure
|
|
# - High-value targets
|
|
# - Defense against sophisticated attacks
|
|
#
|
|
# Features:
|
|
# - All password authentication disabled
|
|
# - Root login completely disabled
|
|
# - All forwarding disabled
|
|
# - Per-source rate limiting (9.8+)
|
|
# - Aggressive session re-keying
|
|
# - Enhanced forensic logging
|
|
#
|
|
|
|
- name: Maximum security hardening
|
|
hosts: high_security_servers
|
|
become: true
|
|
|
|
roles:
|
|
- role: welshwandering.openssh_server
|
|
vars:
|
|
# Authentication hardening
|
|
openssh_password_authentication: false
|
|
openssh_permit_root_login: "no" # Completely disable root SSH
|
|
openssh_challenge_response_auth: false
|
|
|
|
# Rate limiting and attack mitigation (OpenSSH 9.8+)
|
|
openssh_enable_persourcepenalties: true
|
|
openssh_persource_authfail_penalty: "10s" # Aggressive penalty
|
|
openssh_persource_maxstartups: "5:30:10" # Very restrictive
|
|
|
|
# Disable all forwarding (prevent lateral movement)
|
|
openssh_disable_forwarding_comprehensive: true
|
|
openssh_x11_forwarding: false
|
|
|
|
# Restrict to strongest cryptography only
|
|
openssh_ciphers:
|
|
- chacha20-poly1305@openssh.com
|
|
- aes256-gcm@openssh.com
|
|
openssh_kex_algorithms:
|
|
- curve25519-sha256
|
|
openssh_macs:
|
|
- hmac-sha2-512-etm@openssh.com
|
|
|
|
# Minimum RSA key size
|
|
openssh_required_rsa_size: 4096 # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
|
|
|
|
# Aggressive session limits
|
|
openssh_max_auth_tries: 2 # (Exceeds PCI DSS 8.3.6 limit of 6)
|
|
openssh_login_grace_time: "20s"
|
|
openssh_max_sessions: 5
|
|
|
|
# Aggressive session re-keying
|
|
openssh_rekey_limit: "512M 30m"
|
|
|
|
# Client timeout
|
|
openssh_client_alive_interval: 180 # 3 minutes (Exceeds PCI DSS 8.2.8 / FedRAMP AC-12 15-min requirement)
|
|
openssh_client_alive_count_max: 1 # Disconnect after 6 minutes idle
|
|
|
|
# Enhanced forensic logging
|
|
openssh_enable_verbose_logging: true
|
|
openssh_log_level: "VERBOSE"
|
|
openssh_log_verbose_subsystems:
|
|
- "kex.c:*"
|
|
- "key.c:*"
|
|
- "auth*.c:*"
|
|
- "packet.c:*"
|
|
|
|
# Strict user access control
|
|
openssh_allow_groups:
|
|
- security-admins
|
|
# Explicitly deny risky users
|
|
openssh_deny_users:
|
|
- root
|
|
- admin
|
|
- test
|