mrwho/ansible-bootstrap-rocky9
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ansible-bootstrap-rocky9/roles/openssh/docs/EXAMPLES.md
mrwho e3eddc2a94 Add openssh hardening
2026-05-15 00:12:37 +03:00

1.2 KiB
Raw Permalink Blame History

Configuration Examples

Configuration Examples

Enable Post-Quantum Cryptography

Post-quantum KEX is automatically enabled on OpenSSH 9.9+. To verify:

openssh_enable_mlkem: true  # Default, auto-enables when supported

Maximum Security Hardening

- hosts: high_security_servers
  roles:
    - role: openssh_server
      vars:
        openssh_password_authentication: false
        openssh_permit_root_login: "no"
        openssh_enable_persourcepenalties: true  # Auto-enabled on 9.8+
        openssh_enable_verbose_logging: true
        openssh_disable_forwarding_comprehensive: true
        openssh_max_auth_tries: 3
        openssh_rekey_limit: "512M 30m"  # Re-key every 512MB or 30min

Enable FIDO2 Hardware Security Keys

openssh_enable_security_keys: true
openssh_pubkey_accepted_key_types:
  - sk-ssh-ed25519@openssh.com      # FIDO2 Ed25519
  - ssh-ed25519                      # Standard Ed25519
  - sk-ecdsa-sha2-nistp256@openssh.com  # FIDO2 ECDSA

Certificate Authority Configuration

openssh_enable_ca: true
openssh_trusted_user_ca_keys:
  - /etc/ssh/ca/user_ca.pub
openssh_host_certificate: /etc/ssh/ssh_host_ed25519_key-cert.pub