46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
---
|
||
|
||
# Enable SSH server hardening (default true)
|
||
linux_ssh_hardening_enabled: true
|
||
|
||
# Disable root login over SSH (CIS 5.1.3.1)
|
||
linux_ssh_permit_root_login: "no"
|
||
|
||
# Disable password authentication (force keys – CIS 5.1.3.2)
|
||
linux_ssh_password_auth: "no"
|
||
|
||
# Disable empty passwords (CIS 5.1.8)
|
||
linux_ssh_permit_empty_passwords: "no"
|
||
|
||
# Disable X11 forwarding (CIS 5.1.10)
|
||
linux_ssh_x11_forwarding: "no"
|
||
|
||
# Disable TCP forwarding (CIS 5.1.11)
|
||
linux_ssh_allow_tcp_forwarding: "no"
|
||
|
||
# Strong ciphers/MACs/Kex (align with crypto policies – CIS 5.1.13–5.1.15)
|
||
linux_ssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr"
|
||
linux_ssh_macs: "hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256"
|
||
linux_ssh_kexalgorithms: "curve25519-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512"
|
||
|
||
# Banner / legal notice (CIS 5.1.7)
|
||
linux_ssh_banner: "/etc/issue.net"
|
||
|
||
# Max auth tries (anti-brute-force – CIS 5.1.5)
|
||
linux_ssh_max_auth_tries: 4
|
||
linux_ssh_max_sessions: 8
|
||
linux_ssh_max_startups: "10:30:60"
|
||
linux_ssh_login_grace_time: "60"
|
||
|
||
# Keepalive — CountMax 3 means 3 missed probes before drop (15 min total)
|
||
# Do NOT set CountMax to 0 — that drops the session on the first missed probe,
|
||
# which kills Ansible connections during long package installs or AIDE init.
|
||
linux_ssh_client_alive_interval: 300
|
||
linux_ssh_client_alive_count_max: 3
|
||
|
||
# Disable unused subsystems (e.g. sftp if not needed)
|
||
linux_ssh_subsystem: "sftp internal-sftp"
|
||
|
||
# Role disable var
|
||
linux_ssh_hardening_disabled: false
|