46 lines
1.5 KiB
Django/Jinja
46 lines
1.5 KiB
Django/Jinja
# Managed by Ansible — Morphit SSH hardening per OPERATIONS.md §37.1.
|
|
# This drop-in is loaded AFTER the main sshd_config and overrides
|
|
# anything it conflicts with.
|
|
|
|
# Protocol + auth posture
|
|
Protocol 2
|
|
PermitRootLogin no
|
|
PasswordAuthentication no
|
|
ChallengeResponseAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
UsePAM yes
|
|
PubkeyAuthentication yes
|
|
AuthenticationMethods publickey
|
|
|
|
# Crypto — strong algorithms only
|
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
|
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
|
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
|
|
HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
|
|
|
|
# Session limits
|
|
LoginGraceTime 30
|
|
MaxAuthTries 3
|
|
MaxSessions 4
|
|
ClientAliveInterval 300
|
|
ClientAliveCountMax 2
|
|
TCPKeepAlive no
|
|
|
|
# Misc
|
|
X11Forwarding no
|
|
AllowAgentForwarding no
|
|
AllowTcpForwarding no
|
|
PermitTunnel no
|
|
PermitUserEnvironment no
|
|
PrintMotd no
|
|
Banner none
|
|
StrictModes yes
|
|
IgnoreRhosts yes
|
|
HostbasedAuthentication no
|
|
|
|
# Restrict to the ansible-managed user(s) — operator sets this
|
|
# explicitly to prevent surprises. ansible_user is undefined on a
|
|
# LOCAL install (no SSH session), so it's default-guarded to a
|
|
# placeholder here — this line is commented out anyway, a hint for
|
|
# the operator to uncomment + set to their real login user.
|
|
# AllowUsers {{ ansible_user | default('your-login-user') }}
|