openssh: cleanup playblook + role

This commit is contained in:
jeltz 2023-07-04 04:04:48 +02:00
parent e0c95b8f10
commit 0c7b5a2c68
Signed by: jeltz
GPG key ID: 800882B66C0C3326
4 changed files with 29 additions and 9 deletions

View file

@ -4,11 +4,11 @@
- pve_network
- vm_network
vars:
openssh_users_ca_public_key:
openssh__users_ca_public_key:
"ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAAB\
hBIpT7d7WeR88bs53KkNkZNOzkPJ7CQ5Ui6Wl9LXzAjjIdH+hKJieBMHrKew7+kzxGYaTqXW\
F1fQWsACG6aniy7VZpsdgTaNw7qr9frGfmo950V7IlU6w1HRc5c+3oVBWpg=="
openssh_authorized_principals:
openssh__authorized_principals:
- any
- "{{ inventory_hostname }}"
roles:

View file

@ -1,4 +1,25 @@
---
openssh_authorized_principals:
openssh__authorized_principals:
- any
# https://infosec.mozilla.org/guidelines/openssh.html
openssh__kex_algorithms:
- curve25519-sha256@libssh.org
- ecdh-sha2-nistp521
- ecdh-sha2-nistp384
- ecdh-sha2-nistp256
- diffie-hellman-group-exchange-sha256
openssh__ciphers:
- chacha20-poly1305@openssh.com
- aes256-gcm@openssh.com
- aes128-gcm@openssh.com
- aes256-ctr
- aes192-ctr
- aes128-ctr
openssh__macs:
- hmac-sha2-512-etm@openssh.com
- hmac-sha2-256-etm@openssh.com
- umac-128-etm@openssh.com
- hmac-sha2-512
- hmac-sha2-256
- umac-128@openssh.com
...

View file

@ -21,7 +21,7 @@
- name: Install Users CA public key
copy:
content: "{{ openssh_users_ca_public_key }}"
content: "{{ openssh__users_ca_public_key }}"
dest: /etc/ssh/users_ca.pub
owner: root
group: root
@ -30,7 +30,7 @@
- name: Install authorized principals file
copy:
content: "{{ openssh_authorized_principals | join('\n') }}"
content: "{{ openssh__authorized_principals | join('\n') }}"
dest: /etc/ssh/authorized_principals
owner: root
group: root

View file

@ -15,10 +15,9 @@ HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
# https://infosec.mozilla.org/guidelines/openssh.html
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
KexAlgorithms {{ openssh__kex_algorithms | join(",") }}
Ciphers {{ openssh__ciphers | join(",") }}
MACs {{ openssh__macs | join(",") }}
AuthenticationMethods publickey