2026-09-09 16:50:19 -04:00
|
|
|
# code: language=ansible
|
2026-09-08 16:56:50 -04:00
|
|
|
|
|
|
|
|
sshd_port: 22
|
|
|
|
|
|
2026-09-09 16:50:19 -04:00
|
|
|
sshd_user: ladmin
|
|
|
|
|
|
|
|
|
|
sshd_address_family: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('inet', 'any') }}"
|
|
|
|
|
sshd_required_family_for_online: "{{ (ipv4_only | default(false)) | ansible.builtin.ternary('ipv4', 'both') }}"
|
|
|
|
|
|
|
|
|
|
sshd_ipv4_config_lines:
|
2026-09-08 16:56:50 -04:00
|
|
|
- label: PubkeyAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'PubkeyAuthentication yes'
|
|
|
|
|
- label: HostbasedAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*HostbasedAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'HostbasedAuthentication no'
|
|
|
|
|
- label: IgnoreUserKnownHosts
|
|
|
|
|
pattern: '^\s*#*\s*IgnoreUserKnownHosts\s*(yes|no)$'
|
|
|
|
|
line: 'IgnoreUserKnownHosts no'
|
|
|
|
|
- label: PasswordAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*PasswordAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'PasswordAuthentication no'
|
|
|
|
|
- label: KbdInteractiveAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*KbdInteractiveAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'KbdInteractiveAuthentication no'
|
|
|
|
|
- label: KerberosAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*KerberosAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'KerberosAuthentication no'
|
|
|
|
|
- label: GSSAPIAuthentication
|
|
|
|
|
pattern: '^\s*#*\s*GSSAPIAuthentication\s*(yes|no)$'
|
|
|
|
|
line: 'GSSAPIAuthentication no'
|
|
|
|
|
- label: UsePAM
|
|
|
|
|
pattern: '^\s*#*\s*UsePAM\s*(yes|no)$'
|
|
|
|
|
line: 'UsePAM yes'
|
|
|
|
|
- label: PermitRootLogin
|
|
|
|
|
pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
|
2026-09-09 16:50:19 -04:00
|
|
|
line: 'PermitRootLogin no'
|
2026-09-08 16:56:50 -04:00
|
|
|
- label: AddressFamily
|
|
|
|
|
pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
|
2026-09-09 16:50:19 -04:00
|
|
|
line: "AddressFamily {{ sshd_address_family }}"
|
2026-09-08 16:56:50 -04:00
|
|
|
- label: ListenAddress (IPv4)
|
|
|
|
|
pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
|
|
|
|
|
line: "ListenAddress {{ ipv4_address }}"
|
|
|
|
|
- label: Port
|
|
|
|
|
pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
|
|
|
|
|
line: "Port {{ sshd_port }}"
|
2026-09-09 16:50:19 -04:00
|
|
|
- label: AllowGroups
|
|
|
|
|
pattern: '^\s*#*\s*AllowGroups\s*.*$'
|
|
|
|
|
line: "AllowGroups ssh"
|
|
|
|
|
|
|
|
|
|
sshd_ipv6_config_lines:
|
|
|
|
|
- label: ListenAddress (IPv6)
|
|
|
|
|
pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address }})$"
|
|
|
|
|
line: "ListenAddress {{ ipv6_address }}"
|
2026-09-08 16:56:50 -04:00
|
|
|
|
|
|
|
|
sshd_ufw_ipv4_rules:
|
|
|
|
|
- comment: SSH Clients v4
|
|
|
|
|
source: 10.96.30.0/24
|
|
|
|
|
- comment: SSH Servers v4
|
|
|
|
|
source: 10.96.10.0/24
|
|
|
|
|
- comment: SSH VPN v4
|
|
|
|
|
source: 192.168.200.0/24
|
|
|
|
|
|
|
|
|
|
sshd_ufw_ipv6_rules:
|
|
|
|
|
- comment: "SSH Clients v6"
|
|
|
|
|
source: "2600:4040:593d:8b30::/64"
|
|
|
|
|
- comment: "SSH Servers v6"
|
2026-09-09 16:50:19 -04:00
|
|
|
source: "2600:4040:593d:8b10::/64"
|
