From eeb42959849d712bbffb3bfe24b982b88bc00720 Mon Sep 17 00:00:00 2001 From: shockrah Date: Sun, 28 Apr 2024 23:12:08 -0700 Subject: [PATCH] Hardening ssh configs a little bit --- infra/static-vultr/ansible/files/ssh.conf | 86 +++++++++++++++++++ .../static-vultr/ansible/playbooks/harden.yml | 2 + infra/static-vultr/ansible/tasks/ssh.yml | 6 ++ 3 files changed, 94 insertions(+) create mode 100644 infra/static-vultr/ansible/files/ssh.conf create mode 100644 infra/static-vultr/ansible/tasks/ssh.yml diff --git a/infra/static-vultr/ansible/files/ssh.conf b/infra/static-vultr/ansible/files/ssh.conf new file mode 100644 index 0000000..a147f29 --- /dev/null +++ b/infra/static-vultr/ansible/files/ssh.conf @@ -0,0 +1,86 @@ +PermitRootLogin yes + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +SyslogFacility AUTH +LogLevel INFO + +# Authentication: + +LoginGraceTime 1m +PermitRootLogin prohibit-password +StrictModes yes +MaxAuthTries 6 +MaxSessions 3 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +KbdInteractiveAuthentication no + +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes + +PrintMotd no + +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/infra/static-vultr/ansible/playbooks/harden.yml b/infra/static-vultr/ansible/playbooks/harden.yml index 9f61a5d..c019362 100644 --- a/infra/static-vultr/ansible/playbooks/harden.yml +++ b/infra/static-vultr/ansible/playbooks/harden.yml @@ -4,4 +4,6 @@ tasks: - name: Setup UFW import_tasks: ../tasks/ufw-setup.yml + - name: Harden ssh configuration + import_tasks: ../tasks/ssh.yml diff --git a/infra/static-vultr/ansible/tasks/ssh.yml b/infra/static-vultr/ansible/tasks/ssh.yml new file mode 100644 index 0000000..6802530 --- /dev/null +++ b/infra/static-vultr/ansible/tasks/ssh.yml @@ -0,0 +1,6 @@ +- name: Harden the SSH configuration + copy: + src: ../files/ssh.conf + dest: /etc/sshd_config + mode: 644 +