add python3-firewall

inventory/prod/hosts.yml

@@ -29,8 +29,8 @@ all:
           ansible_host: git.local.mrwho.ru
         vm03:
           ansible_host: 150.251.147.212
-          ansible_ssh_user: root
-          ansible_ssh_password: OdUdPx7yKa4Ga1i              
+#          ansible_ssh_user: root
+#          ansible_ssh_password: OdUdPx7yKa4Ga1i              
 
 #        rocky9-template:
 #          ansible_host: 172.20.21.106

playbooks/rocky9.yml

@@ -29,7 +29,7 @@
     openssh_permit_root_login: "no"  # Completely disable root SSH
     openssh_challenge_response_auth: false
     # Rate limiting and attack mitigation (OpenSSH 9.8+)
-    openssh_enable_persourcepenalties: true
+    openssh_enable_persourcepenalties: false
     openssh_persource_authfail_penalty: "10s"  # Aggressive penalty
     openssh_persource_maxstartups: "5:30:10"   # Very restrictive
     # Disable all port forwarding
@@ -44,7 +44,7 @@
     openssh_macs:
       - hmac-sha2-512-etm@openssh.com
     # Minimum RSA key size
-    openssh_required_rsa_size: 4096  # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
+    openssh_required_rsa_size: 2048  # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
     # Aggressive session limits
     openssh_max_auth_tries: 2        # (Exceeds PCI DSS 8.3.6 limit of 6)
     openssh_login_grace_time: "20s"

roles/rocky9/tasks/install_packages.yml

@@ -70,6 +70,7 @@
       - qemu-guest-agent
       - cloud-utils-growpart
       - iptraf-ng
+      - python3-firewall
 #      - speedtest-cli
 #      - deltarpm
 #      - screen