---

# Enable SSH server hardening (default true)
linux_ssh_hardening_enabled: true

# Disable root login over SSH (CIS 5.1.3.1)
linux_ssh_permit_root_login: "no"

# Disable password authentication (force keys – CIS 5.1.3.2)
linux_ssh_password_auth: "no"

# Disable empty passwords (CIS 5.1.8)
linux_ssh_permit_empty_passwords: "no"

# Disable X11 forwarding (CIS 5.1.10)
linux_ssh_x11_forwarding: "no"

# Disable TCP forwarding (CIS 5.1.11)
linux_ssh_allow_tcp_forwarding: "no"

# Strong ciphers/MACs/Kex (align with crypto policies – CIS 5.1.13–5.1.15)
linux_ssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
linux_ssh_macs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
linux_ssh_kexalgorithms: "curve25519-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512"

# Banner / legal notice (CIS 5.1.7)
linux_ssh_banner: "/etc/issue.net"

# Max auth tries (anti-brute-force – CIS 5.1.5)
linux_ssh_max_auth_tries: 4
linux_ssh_max_sessions: 8
linux_ssh_max_startups: "10:30:60"
linux_ssh_login_grace_time: "60"

# Keepalive — CountMax 3 means 3 missed probes before drop (15 min total)
# Do NOT set CountMax to 0 — that drops the session on the first missed probe,
# which kills Ansible connections during long package installs or AIDE init.
linux_ssh_client_alive_interval: 300
linux_ssh_client_alive_count_max: 3

# Disable unused subsystems (e.g. sftp if not needed)
linux_ssh_subsystem: "sftp internal-sftp"

# Role disable var
linux_ssh_hardening_disabled: false