From 081dc69820467675865288e73cda67001e71d871 Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:34:56 +0100 Subject: [PATCH 1/7] apt: add compat for name of security dist on bullseye --- apt/tasks/repositories.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apt/tasks/repositories.yml b/apt/tasks/repositories.yml index f65bf98..43af1ee 100644 --- a/apt/tasks/repositories.yml +++ b/apt/tasks/repositories.yml @@ -47,7 +47,7 @@ repo: "deb{{ src }} {{ apt_mirror_security }} {{ ansible_distribution_release }}{{ item[1] }} {{ item[0] }}" with_nested: - "{{ apt_repos }}" - - ['/updates'] + - "{{ ['/updates'] if ansible_distribution_major_version|int(default=99) < 11 else ['-security'] }}" when: not raspbian_has_no_security notify: - update apt cache @@ -61,7 +61,7 @@ repo: "deb{{ src }} {{ apt_mirror_security }} {{ ansible_distribution_release }}{{ item[1] }} {{ item[0] }}" with_nested: - "{{ ['main', 'contrib', 'non-free']|difference(apt_repos) }}" - - ['/updates'] + - "{{ ['/updates'] if ansible_distribution_major_version|int(default=99) < 11 else ['-security'] }}" when: not raspbian_has_no_security notify: - update apt cache -- GitLab From 49941abae8f9ee43a780940de870fbb46df4fcdb Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:38:13 +0100 Subject: [PATCH 2/7] basic-system: make sysctl file configurable --- basic-system/defaults/main.yml | 1 + basic-system/tasks/logging.yml | 1 + basic-system/tasks/network.yml | 3 +++ 3 files changed, 5 insertions(+) diff --git a/basic-system/defaults/main.yml b/basic-system/defaults/main.yml index dc51f85..262bb4a 100644 --- a/basic-system/defaults/main.yml +++ b/basic-system/defaults/main.yml @@ -7,3 +7,4 @@ etckeeper: true rsyslog_needed: false hosts_precious: false journal_persitent_with_package: true +common_sysctl_file: '/etc/sysctl.conf' diff --git a/basic-system/tasks/logging.yml b/basic-system/tasks/logging.yml index bddf2f3..608ae54 100644 --- a/basic-system/tasks/logging.yml +++ b/basic-system/tasks/logging.yml @@ -7,6 +7,7 @@ value: '1' state: present sysctl_set: true + sysctl_file: "{{ common_sysctl_file }}" tags: - security - sysctl diff --git a/basic-system/tasks/network.yml b/basic-system/tasks/network.yml index 5d8d64f..be7e8f2 100644 --- a/basic-system/tasks/network.yml +++ b/basic-system/tasks/network.yml @@ -58,6 +58,7 @@ value: '0' state: present sysctl_set: true + sysctl_file: "{{ common_sysctl_file }}" tags: - security - sysctl @@ -68,6 +69,7 @@ value: '0' state: present sysctl_set: true + sysctl_file: "{{ common_sysctl_file }}" tags: - security - sysctl @@ -78,6 +80,7 @@ value: '0' state: present sysctl_set: true + sysctl_file: "{{ common_sysctl_file }}" tags: - security - sysctl -- GitLab From 7ab78ebe57fc6681ae297a9a33a0bb7435a2146f Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:40:05 +0100 Subject: [PATCH 3/7] basic-system: adapt logrotate configuration to bullseye --- basic-system/defaults/main.yml | 2 ++ basic-system/templates/logrotate.conf.j2 | 18 ++++++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/basic-system/defaults/main.yml b/basic-system/defaults/main.yml index 262bb4a..70f0523 100644 --- a/basic-system/defaults/main.yml +++ b/basic-system/defaults/main.yml @@ -7,4 +7,6 @@ etckeeper: true rsyslog_needed: false hosts_precious: false journal_persitent_with_package: true +logrotate_period: 'daily' # 'weekly' is newer default +logrotate_backlogs: 7 # default is 7 for daily, 4 for weekly common_sysctl_file: '/etc/sysctl.conf' diff --git a/basic-system/templates/logrotate.conf.j2 b/basic-system/templates/logrotate.conf.j2 index 2be8fd5..b25502e 100644 --- a/basic-system/templates/logrotate.conf.j2 +++ b/basic-system/templates/logrotate.conf.j2 @@ -1,13 +1,19 @@ # see "man logrotate" for details -# rotate log files daily -daily -# keep 7 days worth of backlogs -rotate 7 +# global options do not affect preceding include directives + +# rotate log files {{ logrotate_period }} +{{ logrotate_period }} + +# keep {{ logrotate_backlogs }} {{ 'weeks' if logrotate_period == 'weekly' else 'days' }} worth of backlogs +rotate {{ logrotate_backlogs }} # create new (empty) log files after rotating old ones create +# use date as a suffix of the rotated file +#dateext + # uncomment this if you want your log files compressed compress delaycompress @@ -15,7 +21,7 @@ delaycompress # packages drop log rotation information into this directory include /etc/logrotate.d -{% if ansible_distribution_major_version|int < 10 %} +{% if ansible_distribution_major_version|int(default=99) < 10 %} # no packages own wtmp, or btmp -- we'll rotate them here /var/log/wtmp { missingok @@ -32,4 +38,4 @@ include /etc/logrotate.d } {% endif %} -# system-specific logs may be configured here +# system-specific logs may also be configured here. -- GitLab From b8562af24ce078b964727b0675cdcac28485467f Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:44:25 +0100 Subject: [PATCH 4/7] basic-system: safeguard journal persistence from bullseye and remove support for jessie's rsyslog --- basic-system/defaults/main.yml | 2 +- basic-system/tasks/logging.yml | 43 ++++------------------------------ 2 files changed, 5 insertions(+), 40 deletions(-) diff --git a/basic-system/defaults/main.yml b/basic-system/defaults/main.yml index 70f0523..a3ccba2 100644 --- a/basic-system/defaults/main.yml +++ b/basic-system/defaults/main.yml @@ -6,7 +6,7 @@ hosts_additionals: [] etckeeper: true rsyslog_needed: false hosts_precious: false -journal_persitent_with_package: true +journal_persistent_with_package: true logrotate_period: 'daily' # 'weekly' is newer default logrotate_backlogs: 7 # default is 7 for daily, 4 for weekly common_sysctl_file: '/etc/sysctl.conf' diff --git a/basic-system/tasks/logging.yml b/basic-system/tasks/logging.yml index 608ae54..f375326 100644 --- a/basic-system/tasks/logging.yml +++ b/basic-system/tasks/logging.yml @@ -17,11 +17,8 @@ name: systemd-journal-persistent state: present when: - - syslogserver is not defined or syslogserver.split(":")[0] != ansible_fqdn - - ansible_distribution_major_version|int >= 9 - - not rsyslog_needed - - journal_persitent_with_package - register: syslog_provider + - ansible_distribution_major_version|int(default=99) < 11 + - journal_persistent_with_package tags: - syslog - journal @@ -31,9 +28,8 @@ path: /var/log/journal state: directory when: - - (ansible_distribution_major_version|int < 9) or - (not journal_persitent_with_package) - register: syslog_provider + - ansible_distribution_major_version|int(default=99) < 11 + - not journal_persistent_with_package notify: - configure journal directory tags: @@ -47,8 +43,6 @@ purge: true dpkg_options: "force-confdef,force-confold,force-depends" when: - - not syslog_provider is skipped - - ansible_distribution_major_version|int >= 9 - syslogserver is not defined or syslogserver.split(":")[0] != ansible_fqdn tags: - syslog @@ -73,35 +67,6 @@ - syslog - service -- name: ensure rsyslog is running and enabled - service: - name: rsyslog - state: started - enabled: true - when: - - syslogserver is defined - - syslogserver|length > 0 - - ansible_distribution_major_version|int < 9 - tags: - - syslog - -- name: ensure that central logging works - template: - src: rsyslog.conf.j2 - dest: /etc/rsyslog.conf - owner: root - group: root - mode: '0644' - when: - - syslogserver is defined - - syslogserver|length > 0 - - syslogserver.split(":")[0] != ansible_fqdn - - ansible_distribution_major_version|int < 9 - notify: - - restart rsyslogd - tags: - - syslog - - name: ensure our logrotate.conf is present template: src: logrotate.conf.j2 -- GitLab From 8ca0699ede9affc2d2cfec6b29375f84e37ea833 Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:45:36 +0100 Subject: [PATCH 5/7] shell: adapt debian version safeguard for testing --- shell/tasks/shell.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shell/tasks/shell.yml b/shell/tasks/shell.yml index 6d2893c..148fb92 100644 --- a/shell/tasks/shell.yml +++ b/shell/tasks/shell.yml @@ -63,7 +63,7 @@ - ripgrep - fd-find state: present - when: debian_version == "buster" + when: ansible_distribution_major_version|int(default=99) >= 10 tags: - packages - shell -- GitLab From 351f27a1c16ce65d93d8c935634c3b213b29e46d Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:46:30 +0100 Subject: [PATCH 6/7] shell: adapt main sudoers configuration to bullseye --- shell/tasks/sudo.yml | 4 ++-- shell/{files/sudo/default => templates/sudoers.j2} | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) rename shell/{files/sudo/default => templates/sudoers.j2} (76%) diff --git a/shell/tasks/sudo.yml b/shell/tasks/sudo.yml index 9154a4c..5f65bd4 100644 --- a/shell/tasks/sudo.yml +++ b/shell/tasks/sudo.yml @@ -9,8 +9,8 @@ - sudo - name: ensure we got a sane sudo config - copy: - src: sudo/default + template: + src: sudoers.j2 dest: /etc/sudoers owner: root group: root diff --git a/shell/files/sudo/default b/shell/templates/sudoers.j2 similarity index 76% rename from shell/files/sudo/default rename to shell/templates/sudoers.j2 index 28f0f60..dedfefa 100644 --- a/shell/files/sudo/default +++ b/shell/templates/sudoers.j2 @@ -19,6 +19,12 @@ Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/b # User privilege specification root ALL=(ALL:ALL) ALL +{% if ansible_distribution_major_version|int(default=99) < 11 %} # See sudoers(5) for more information on "#include" directives: #includedir /etc/sudoers.d +{% else %} +# See sudoers(5) for more information on "@include" directives: + +@includedir /etc/sudoers.d +{% endif %} -- GitLab From f8cc0d73507c804b38afdf3325cc737d2e9f406f Mon Sep 17 00:00:00 2001 From: Lars Beckers Date: Mon, 15 Mar 2021 14:48:09 +0100 Subject: [PATCH 7/7] ssh-server: use new drop-in configuration on bullseye --- ssh-server/files/ssh_config | 53 ++++++++ ssh-server/files/ssh_config.d/gssapi.conf | 2 + ssh-server/files/ssh_config.d/sshfp.conf | 2 + ssh-server/tasks/main.yml | 71 +++++++++- .../sshd_config.d/authentication.conf.j2 | 2 + .../templates/sshd_config.d/banner.conf.j2 | 1 + .../templates/sshd_config.d/ciphers.conf.j2 | 9 ++ .../sshd_config.d/forwarding.conf.j2 | 1 + .../templates/sshd_config.d/groups.conf.j2 | 3 + ssh-server/templates/sshd_config_main.j2 | 123 ++++++++++++++++++ ...shd_config.j2 => sshd_config_old_style.j2} | 5 +- 11 files changed, 266 insertions(+), 6 deletions(-) create mode 100644 ssh-server/files/ssh_config create mode 100644 ssh-server/files/ssh_config.d/gssapi.conf create mode 100644 ssh-server/files/ssh_config.d/sshfp.conf create mode 100644 ssh-server/templates/sshd_config.d/authentication.conf.j2 create mode 100644 ssh-server/templates/sshd_config.d/banner.conf.j2 create mode 100644 ssh-server/templates/sshd_config.d/ciphers.conf.j2 create mode 100644 ssh-server/templates/sshd_config.d/forwarding.conf.j2 create mode 100644 ssh-server/templates/sshd_config.d/groups.conf.j2 create mode 100644 ssh-server/templates/sshd_config_main.j2 rename ssh-server/templates/{sshd_config.j2 => sshd_config_old_style.j2} (95%) diff --git a/ssh-server/files/ssh_config b/ssh-server/files/ssh_config new file mode 100644 index 0000000..7f43866 --- /dev/null +++ b/ssh-server/files/ssh_config @@ -0,0 +1,53 @@ + +# This is the ssh client system-wide configuration file. See +# ssh_config(5) for more information. This file provides defaults for +# users, and the values can be changed in per-user configuration files +# or on the command line. + +# Configuration data is parsed as follows: +# 1. command line options +# 2. user-specific file +# 3. system-wide file +# Any configuration value is only changed the first time it is set. +# Thus, host-specific definitions should be at the beginning of the +# configuration file, and defaults at the end. + +# Site-wide defaults for some commonly used options. For a comprehensive +# list of available options, their meanings and defaults, please see the +# ssh_config(5) man page. + +Include /etc/ssh/ssh_config.d/*.conf + +Host * +# ForwardAgent no +# ForwardX11 no +# ForwardX11Trusted yes +# PasswordAuthentication yes +# HostbasedAuthentication no +# GSSAPIAuthentication no +# GSSAPIDelegateCredentials no +# GSSAPIKeyExchange no +# GSSAPITrustDNS no +# BatchMode no +# CheckHostIP yes +# AddressFamily any +# ConnectTimeout 0 +# StrictHostKeyChecking ask +# IdentityFile ~/.ssh/id_rsa +# IdentityFile ~/.ssh/id_dsa +# IdentityFile ~/.ssh/id_ecdsa +# IdentityFile ~/.ssh/id_ed25519 +# Port 22 +# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc +# MACs hmac-md5,hmac-sha1,umac-64@openssh.com +# EscapeChar ~ +# Tunnel no +# TunnelDevice any:any +# PermitLocalCommand no +# VisualHostKey no +# ProxyCommand ssh -q -W %h:%p gateway.example.com +# RekeyLimit 1G 1h +# UserKnownHostsFile ~/.ssh/known_hosts.d/%k + SendEnv LANG LC_* + HashKnownHosts yes + GSSAPIAuthentication yes diff --git a/ssh-server/files/ssh_config.d/gssapi.conf b/ssh-server/files/ssh_config.d/gssapi.conf new file mode 100644 index 0000000..cf530e7 --- /dev/null +++ b/ssh-server/files/ssh_config.d/gssapi.conf @@ -0,0 +1,2 @@ +Host * + GSSAPIDelegateCredentials no diff --git a/ssh-server/files/ssh_config.d/sshfp.conf b/ssh-server/files/ssh_config.d/sshfp.conf new file mode 100644 index 0000000..4bc4d59 --- /dev/null +++ b/ssh-server/files/ssh_config.d/sshfp.conf @@ -0,0 +1,2 @@ +Host * + VerifyHostKeyDNS yes diff --git a/ssh-server/tasks/main.yml b/ssh-server/tasks/main.yml index 24cd1f8..ef491fd 100644 --- a/ssh-server/tasks/main.yml +++ b/ssh-server/tasks/main.yml @@ -8,21 +8,58 @@ tags: - ssh -- name: ensure sshd is configured +- name: ensure sshd is configured (old-style) template: - src: sshd_config.j2 + src: sshd_config_old_style.j2 dest: /etc/ssh/sshd_config owner: root group: root mode: '0644' backup: true validate: '/usr/sbin/sshd -t -f %s' + when: ansible_distribution_major_version|int(default=99) < 11 notify: - restart sshd tags: - ssh -- name: ensure ssh is configured +- name: ensure sshd is configured (main) + template: + src: sshd_config_main.j2 + dest: /etc/ssh/sshd_config + owner: root + group: root + mode: '0644' + backup: true + validate: '/usr/sbin/sshd -t -f %s' + when: ansible_distribution_major_version|int(default=99) > 10 + notify: + - restart sshd + tags: + - ssh + +- name: ensure sshd is configured (drop-ins) + template: + src: "sshd_config.d/{{ item }}.j2" + dest: "/etc/ssh/sshd_config.d/{{ item }}" + owner: root + group: root + mode: '0644' + backup: true + validate: '/usr/sbin/sshd -t -f %s' + when: ansible_distribution_major_version|int(default=99) > 10 + with_items: + - authentication.conf + - banner.conf + - ciphers.conf + - forwarding.conf + - groups.conf + notify: + - restart sshd + tags: + - ssh + +- name: ensure ssh is configured (old-style) template: src: ssh_config.j2 dest: /etc/ssh/ssh_config @@ -30,6 +67,34 @@ group: root mode: '0644' backup: true + when: ansible_distribution_major_version|int(default=99) < 11 + tags: + - ssh + +- name: ensure ssh is configured (main) + copy: + src: ssh_config + dest: /etc/ssh/ssh_config + owner: root + group: root + mode: '0644' + backup: true + when: ansible_distribution_major_version|int(default=99) > 10 + tags: + - ssh + +- name: ensure ssh is configured (drop-ins) + copy: + src: "ssh_config.d/{{ item }}" + dest: "/etc/ssh/ssh_config.d/{{ item }}" + owner: root + group: root + mode: '0644' + backup: true + when: ansible_distribution_major_version|int(default=99) > 10 + with_items: + - gssapi.conf + - sshfp.conf tags: - ssh diff --git a/ssh-server/templates/sshd_config.d/authentication.conf.j2 b/ssh-server/templates/sshd_config.d/authentication.conf.j2 new file mode 100644 index 0000000..48c51a5 --- /dev/null +++ b/ssh-server/templates/sshd_config.d/authentication.conf.j2 @@ -0,0 +1,2 @@ +PasswordAuthentication {{ 'yes' if ssh_password_auth else 'no' }} +GSSAPIAuthentication {{ 'yes' if ssh_gssapi else 'no' }} diff --git a/ssh-server/templates/sshd_config.d/banner.conf.j2 b/ssh-server/templates/sshd_config.d/banner.conf.j2 new file mode 100644 index 0000000..c426ec4 --- /dev/null +++ b/ssh-server/templates/sshd_config.d/banner.conf.j2 @@ -0,0 +1 @@ +Banner /etc/issue.net diff --git a/ssh-server/templates/sshd_config.d/ciphers.conf.j2 b/ssh-server/templates/sshd_config.d/ciphers.conf.j2 new file mode 100644 index 0000000..c01c088 --- /dev/null +++ b/ssh-server/templates/sshd_config.d/ciphers.conf.j2 @@ -0,0 +1,9 @@ +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_ed25519_key + +{% if ssh_strong_crypto %} +HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256 +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com +{% endif %} diff --git a/ssh-server/templates/sshd_config.d/forwarding.conf.j2 b/ssh-server/templates/sshd_config.d/forwarding.conf.j2 new file mode 100644 index 0000000..6570f3a --- /dev/null +++ b/ssh-server/templates/sshd_config.d/forwarding.conf.j2 @@ -0,0 +1 @@ +DisableForwarding {{ 'no' if ssh_allow_forwarding else 'yes' }} diff --git a/ssh-server/templates/sshd_config.d/groups.conf.j2 b/ssh-server/templates/sshd_config.d/groups.conf.j2 new file mode 100644 index 0000000..6826a36 --- /dev/null +++ b/ssh-server/templates/sshd_config.d/groups.conf.j2 @@ -0,0 +1,3 @@ +{% for group in ssh_allow_groups %} +AllowGroups {{ group }} +{% endfor %} diff --git a/ssh-server/templates/sshd_config_main.j2 b/ssh-server/templates/sshd_config_main.j2 new file mode 100644 index 0000000..573b63e --- /dev/null +++ b/ssh-server/templates/sshd_config_main.j2 @@ -0,0 +1,123 @@ +# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +Include /etc/ssh/sshd_config.d/*.conf + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server{{ ' ' ~ ssh_sftp_options if ssh_sftp_options|length > 0 else '' }} + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/ssh-server/templates/sshd_config.j2 b/ssh-server/templates/sshd_config_old_style.j2 similarity index 95% rename from ssh-server/templates/sshd_config.j2 rename to ssh-server/templates/sshd_config_old_style.j2 index da568b9..93f4ad6 100644 --- a/ssh-server/templates/sshd_config.j2 +++ b/ssh-server/templates/sshd_config_old_style.j2 @@ -15,9 +15,8 @@ MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@op # HostKeys for protocol version 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ed25519_key -{# deprecated option in buster #} -{% if ansible_distribution_major_version|int < 10 %} -#Privilege Separation is turned on for security + +{% if ansible_distribution_major_version|int(default=99) < 10 %} UsePrivilegeSeparation yes {% endif %} -- GitLab