No OneTemporary
Actions

Size

2 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/roles/core/sshd/files/sshd_config b/roles/core/sshd/files/sshd_config
	index bebc16e..89f2a2f 100644
	--- a/roles/core/sshd/files/sshd_config
	+++ b/roles/core/sshd/files/sshd_config
	@@ -1,48 +1,55 @@
	# -------------------------------------------------------------
	# OpenSSH configuration
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	# Project: Nasqueron
	# Created: 2017-02-28
	# License: Trivial work, not eligible to copyright
	# Source file: roles/core/sshd/files/sshd_config
	# -------------------------------------------------------------
	#
	# <auto-generated>
	# This file is managed by our rOPS SaltStack repository.
	#
	# Changes to this file may cause incorrect behavior
	# and will be lost if the state is redeployed.
	# </auto-generated>

	{% if should_listen_to_private_address -%}
	ListenAddress {{ listen_private_address }}
	ListenAddress localhost
	{%- endif %}

	+# Terrapin mitigation
	+# Those ciphers are fine if BOTH SSH client and server are patched.
	+# A up-to-date OpenSSH server isn't enough if the client don't support
	+# strict key exchange. As such, we still disable them.
	+Ciphers -chacha20-poly1305@openssh.com
	+MACs -*etm@openssh.com
	+
	# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
	# but this is overridden so installations will only check .ssh/authorized_keys
	AuthorizedKeysFile .ssh/authorized_keys

	{% if grains['os_family'] == 'RedHat' -%}
	# Don't use host DSA key (CentOS by default uses it, see T1352)
	HostKey /etc/ssh/ssh_host_rsa_key
	HostKey /etc/ssh/ssh_host_ecdsa_key
	HostKey /etc/ssh/ssh_host_ed25519_key
	{%- endif %}

	# Nasqueron servers authentication should only occur through SSH keys
	# but PAM can offer extra capabilities if needed like OTP.
	PasswordAuthentication no
	ChallengeResponseAuthentication no
	UsePAM yes

	# Once the core role has been applied to a server, ops users have been created
	# and sudo configured. We can so forbid direct root login.
	PermitRootLogin no

	# Misc options
	PrintMotd {{ "yes" if print_motd else "no" }}
	AcceptEnv LANG LC_*

	# SFTP
	Subsystem sftp {{ sftp }}

File Metadata

Mime Type: text/x-diff
Expires: Sun, Nov 24, 21:28 (10 h, 44 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2258944
Default Alt Text: (2 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions