diff options
Diffstat (limited to 'playbooks.d/ssh/share/sshd_config.satpl')
| -rw-r--r-- | playbooks.d/ssh/share/sshd_config.satpl | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/playbooks.d/ssh/share/sshd_config.satpl b/playbooks.d/ssh/share/sshd_config.satpl new file mode 100644 index 0000000..8a9f2db --- /dev/null +++ b/playbooks.d/ssh/share/sshd_config.satpl @@ -0,0 +1,33 @@ +# Connectivity +Port 22 +AddressFamily any +ListenAddress 0.0.0.0 +ListenAddress :: + +# Fluff +PrintMotd yes + +# SFTP +Subsystem sftp ${sftp} + +# Authentication +AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys +ChallengeResponseAuthentication no +PasswordAuthentication no +PermitRootLogin no +PubkeyAuthentication no + +# Security +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +HostKeyAlgorithms ssh-ed25519 +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org +MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com + +# Allow tyil +Match User tyil + PubkeyAuthentication yes + +# Allow public key authentication over VPN +Match Address 10.57.0.0/16,10.58.0.0/16,fd68:1057:1992:3381::/64,fd68:1058:1992:3381::/64 + PubkeyAuthentication yes + PermitRootLogin prohibit-password |