58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
|
#code: language=ansible
|
||
|
|
|
||
|
|
sshd_port: 22
|
||
|
|
|
||
|
|
sshd_config_lines:
|
||
|
|
- label: PubkeyAuthentication
|
||
|
|
pattern: '^\s*#*\s*PubkeyAuthentication\s*(yes|no)$'
|
||
|
|
line: 'PubkeyAuthentication yes'
|
||
|
|
- label: HostbasedAuthentication
|
||
|
|
pattern: '^\s*#*\s*HostbasedAuthentication\s*(yes|no)$'
|
||
|
|
line: 'HostbasedAuthentication no'
|
||
|
|
- label: IgnoreUserKnownHosts
|
||
|
|
pattern: '^\s*#*\s*IgnoreUserKnownHosts\s*(yes|no)$'
|
||
|
|
line: 'IgnoreUserKnownHosts no'
|
||
|
|
- label: PasswordAuthentication
|
||
|
|
pattern: '^\s*#*\s*PasswordAuthentication\s*(yes|no)$'
|
||
|
|
line: 'PasswordAuthentication no'
|
||
|
|
- label: KbdInteractiveAuthentication
|
||
|
|
pattern: '^\s*#*\s*KbdInteractiveAuthentication\s*(yes|no)$'
|
||
|
|
line: 'KbdInteractiveAuthentication no'
|
||
|
|
- label: KerberosAuthentication
|
||
|
|
pattern: '^\s*#*\s*KerberosAuthentication\s*(yes|no)$'
|
||
|
|
line: 'KerberosAuthentication no'
|
||
|
|
- label: GSSAPIAuthentication
|
||
|
|
pattern: '^\s*#*\s*GSSAPIAuthentication\s*(yes|no)$'
|
||
|
|
line: 'GSSAPIAuthentication no'
|
||
|
|
- label: UsePAM
|
||
|
|
pattern: '^\s*#*\s*UsePAM\s*(yes|no)$'
|
||
|
|
line: 'UsePAM yes'
|
||
|
|
- label: PermitRootLogin
|
||
|
|
pattern: '^\s*#*\s*PermitRootLogin\s*(yes|no|prohibit-password)$'
|
||
|
|
line: 'PermitRootLogin prohibit-password'
|
||
|
|
- label: AddressFamily
|
||
|
|
pattern: '^\s*#*\s*AddressFamily\s*(inet|inet6|any)$'
|
||
|
|
line: 'AddressFamily any'
|
||
|
|
- label: ListenAddress (IPv4)
|
||
|
|
pattern: "^\\s*#*\\s*ListenAddress\\s*(0\\.0\\.0\\.0|{{ ipv4_address | replace('.', '\\.') }})$"
|
||
|
|
line: "ListenAddress {{ ipv4_address }}"
|
||
|
|
- label: ListenAddress (IPv6)
|
||
|
|
pattern: "^\\s*#*\\s*ListenAddress\\s*(::|{{ ipv6_address}})$"
|
||
|
|
line: "ListenAddress {{ ipv6_address }}"
|
||
|
|
- label: Port
|
||
|
|
pattern: '^\s*#*\s*Port\s*[0-9]{1,5}$'
|
||
|
|
line: "Port {{ sshd_port }}"
|
||
|
|
|
||
|
|
sshd_ufw_ipv4_rules:
|
||
|
|
- comment: SSH Clients v4
|
||
|
|
source: 10.96.30.0/24
|
||
|
|
- comment: SSH Servers v4
|
||
|
|
source: 10.96.10.0/24
|
||
|
|
- comment: SSH VPN v4
|
||
|
|
source: 192.168.200.0/24
|
||
|
|
|
||
|
|
sshd_ufw_ipv6_rules:
|
||
|
|
- comment: "SSH Clients v6"
|
||
|
|
source: "2600:4040:593d:8b30::/64"
|
||
|
|
- comment: "SSH Servers v6"
|
||
|
|
source: "2600:4040:593d:8b10::/64"
|