mrwho
3735c11b9f
- Enable sysctl_tune to apply kernel parameter tuning - Add flush_sysctl_rules to ensure rules are applied after changes
77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
---
|
|
- name: Initial Rocky9 Configuration
|
|
|
|
hosts:
|
|
# - vm03
|
|
- rocky9-template
|
|
# kuber-node01
|
|
# - 172.20.21.193
|
|
become: true
|
|
roles:
|
|
- users
|
|
- rocky9
|
|
- root-cert
|
|
- linux_login_banner_rhel9
|
|
- linux_core_dumps_rhel9
|
|
# - linux_ctrl_alt_del_rhel9
|
|
- linux_dnf_automatic_rhel9
|
|
- linux_wireless_rhel9
|
|
- openssh
|
|
|
|
vars:
|
|
#ansible_ssh_user: root
|
|
#ansible_ssh_password: nmklop90
|
|
# ansible_ssh_user: root
|
|
# ansible_ssh_password: nmklop90
|
|
epel_repo: true
|
|
reboot_system: false
|
|
hostname: "{{ inventory_hostname }}.local.mrwho.ru"
|
|
flush_sysctl_rules: true
|
|
sysctl_tune: true
|
|
|
|
openssh_password_authentication: false
|
|
openssh_permit_root_login: "no" # Completely disable root SSH
|
|
openssh_challenge_response_auth: false
|
|
# Rate limiting and attack mitigation (OpenSSH 9.8+)
|
|
openssh_enable_persourcepenalties: false
|
|
openssh_persource_authfail_penalty: "10s" # Aggressive penalty
|
|
openssh_persource_maxstartups: "5:30:10" # Very restrictive
|
|
# Disable all port forwarding
|
|
openssh_disable_forwarding_comprehensive: false
|
|
openssh_x11_forwarding: false
|
|
# Restrict to strongest cryptography only
|
|
openssh_ciphers:
|
|
- chacha20-poly1305@openssh.com
|
|
- aes256-gcm@openssh.com
|
|
openssh_kex_algorithms:
|
|
- curve25519-sha256
|
|
openssh_macs:
|
|
- hmac-sha2-512-etm@openssh.com
|
|
# Minimum RSA key size
|
|
openssh_required_rsa_size: 2048 # Maximum strength (Exceeds NIST/CNSA 3072-bit requirement)
|
|
# Aggressive session limits
|
|
openssh_max_auth_tries: 2 # (Exceeds PCI DSS 8.3.6 limit of 6)
|
|
openssh_login_grace_time: "20s"
|
|
openssh_max_sessions: 5
|
|
# Aggressive session re-keying
|
|
openssh_rekey_limit: "512M 30m"
|
|
# Client timeout
|
|
openssh_client_alive_interval: 300 # 5 minutes
|
|
openssh_client_alive_count_max: 24 # Disconnect after 2 hours idle
|
|
# Enhanced forensic logging
|
|
# openssh_enable_verbose_logging: true
|
|
# openssh_log_level: "VERBOSE"
|
|
# openssh_log_verbose_subsystems:
|
|
# - "kex.c:*"
|
|
# - "key.c:*"
|
|
# - "auth*.c:*"
|
|
# - "packet.c:*"
|
|
# Strict user access control
|
|
# openssh_allow_groups:
|
|
# - security-admins
|
|
# Explicitly deny risky users
|
|
openssh_deny_users:
|
|
- root
|
|
- admin
|
|
- test
|