---
- name: Initial Rocky9 Configuration

  hosts: 
#    - vm03
    - rocky9-template
  # kuber-node01
  #    - 172.20.21.193
  become: true
  roles:
    - users
    - rocky9
    - root-cert
    - linux_login_banner_rhel9
    - linux_core_dumps_rhel9
#    - linux_ctrl_alt_del_rhel9
    - linux_dnf_automatic_rhel9
    - linux_wireless_rhel9
    - openssh

  vars:
    #ansible_ssh_user: root
    #ansible_ssh_password: nmklop90
    # ansible_ssh_user: root
    # ansible_ssh_password: nmklop90
    epel_repo: true
    reboot_system: false
    hostname: "{{ inventory_hostname }}.local.mrwho.ru"
    flush_sysctl_rules: true
    sysctl_tune: true

    openssh_password_authentication: false
    openssh_permit_root_login: "no"  # Completely disable root SSH
    openssh_challenge_response_auth: false
    # Rate limiting and attack mitigation (OpenSSH 9.8+)
    openssh_enable_persourcepenalties: false
    openssh_persource_authfail_penalty: "10s"  # Aggressive penalty
    openssh_persource_maxstartups: "5:30:10"   # Very restrictive
    # Disable all port forwarding
    openssh_disable_forwarding_comprehensive: false
    openssh_x11_forwarding: false
    # Restrict to strongest cryptography only
    openssh_ciphers:
      - chacha20-poly1305@openssh.com
      - aes256-gcm@openssh.com
    openssh_kex_algorithms:
      - curve25519-sha256
    openssh_macs:
      - hmac-sha2-512-etm@openssh.com
    # Minimum RSA key size
    openssh_required_rsa_size: 2048  # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
    # Aggressive session limits
    openssh_max_auth_tries: 2        # (Exceeds PCI DSS 8.3.6 limit of 6)
    openssh_login_grace_time: "20s"
    openssh_max_sessions: 5
    # Aggressive session re-keying
    openssh_rekey_limit: "512M 30m"
    # Client timeout
    openssh_client_alive_interval: 300  # 5 minutes
    openssh_client_alive_count_max: 24  # Disconnect after 2 hours idle
    # Enhanced forensic logging
#    openssh_enable_verbose_logging: true
#    openssh_log_level: "VERBOSE"
#    openssh_log_verbose_subsystems:
#      - "kex.c:*"
#      - "key.c:*"
#      - "auth*.c:*"
#      - "packet.c:*"
    # Strict user access control
#    openssh_allow_groups:
#      - security-admins
    # Explicitly deny risky users
    openssh_deny_users:
      - root
      - admin
      - test