From 302f35b3b75b793d7a37cc30b5ca1364595d6fb8 Mon Sep 17 00:00:00 2001 From: Patrick Spek Date: Wed, 28 Jun 2023 23:38:09 +0200 Subject: Fix ssh playbook for use with satpl --- playbooks.d/ssh/share/motd | 8 -------- playbooks.d/ssh/share/motd.satpl | 8 ++++++++ playbooks.d/ssh/share/sshd_config.bpt | 33 --------------------------------- playbooks.d/ssh/share/sshd_config.satpl | 33 +++++++++++++++++++++++++++++++++ 4 files changed, 41 insertions(+), 41 deletions(-) delete mode 100644 playbooks.d/ssh/share/motd create mode 100644 playbooks.d/ssh/share/motd.satpl delete mode 100644 playbooks.d/ssh/share/sshd_config.bpt create mode 100644 playbooks.d/ssh/share/sshd_config.satpl (limited to 'playbooks.d/ssh/share') diff --git a/playbooks.d/ssh/share/motd b/playbooks.d/ssh/share/motd deleted file mode 100644 index 7fc4e34..0000000 --- a/playbooks.d/ssh/share/motd +++ /dev/null @@ -1,8 +0,0 @@ - ████████╗██╗ ██╗██╗██╗ ███╗ ██╗███████╗████████╗ - ╚══██╔══╝╚██╗ ██╔╝██║██║ ████╗ ██║██╔════╝╚══██╔══╝ - ██║ ╚████╔╝ ██║██║ ██╔██╗ ██║█████╗ ██║ - ██║ ╚██╔╝ ██║██║ ██║╚██╗██║██╔══╝ ██║ - ██║ ██║ ██║███████╗██╗██║ ╚████║███████╗ ██║ - ╚═╝ ╚═╝ ╚═╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ - -Welcome to ${fqdn}, last updated on ${time}. diff --git a/playbooks.d/ssh/share/motd.satpl b/playbooks.d/ssh/share/motd.satpl new file mode 100644 index 0000000..7fc4e34 --- /dev/null +++ b/playbooks.d/ssh/share/motd.satpl @@ -0,0 +1,8 @@ + ████████╗██╗ ██╗██╗██╗ ███╗ ██╗███████╗████████╗ + ╚══██╔══╝╚██╗ ██╔╝██║██║ ████╗ ██║██╔════╝╚══██╔══╝ + ██║ ╚████╔╝ ██║██║ ██╔██╗ ██║█████╗ ██║ + ██║ ╚██╔╝ ██║██║ ██║╚██╗██║██╔══╝ ██║ + ██║ ██║ ██║███████╗██╗██║ ╚████║███████╗ ██║ + ╚═╝ ╚═╝ ╚═╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ + +Welcome to ${fqdn}, last updated on ${time}. diff --git a/playbooks.d/ssh/share/sshd_config.bpt b/playbooks.d/ssh/share/sshd_config.bpt deleted file mode 100644 index f1976a5..0000000 --- a/playbooks.d/ssh/share/sshd_config.bpt +++ /dev/null @@ -1,33 +0,0 @@ -# Connectivity -Port 22 -AddressFamily any -ListenAddress 0.0.0.0 -ListenAddress :: - -# Fluff -PrintMotd yes - -# SFTP -Subsystem sftp {{sftp}} - -# Authentication -AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys -ChallengeResponseAuthentication no -PasswordAuthentication no -PermitRootLogin no -PubkeyAuthentication no - -# Security -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr -HostKeyAlgorithms ssh-ed25519 -KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org -MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com - -# Allow tyil -Match User tyil - PubkeyAuthentication yes - -# Allow public key authentication over VPN -Match Address 10.57.0.0/16 - PubkeyAuthentication yes - PermitRootLogin prohibit-password diff --git a/playbooks.d/ssh/share/sshd_config.satpl b/playbooks.d/ssh/share/sshd_config.satpl new file mode 100644 index 0000000..900ed34 --- /dev/null +++ b/playbooks.d/ssh/share/sshd_config.satpl @@ -0,0 +1,33 @@ +# Connectivity +Port 22 +AddressFamily any +ListenAddress 0.0.0.0 +ListenAddress :: + +# Fluff +PrintMotd yes + +# SFTP +Subsystem sftp ${sftp} + +# Authentication +AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys +ChallengeResponseAuthentication no +PasswordAuthentication no +PermitRootLogin no +PubkeyAuthentication no + +# Security +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +HostKeyAlgorithms ssh-ed25519 +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org +MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com + +# Allow tyil +Match User tyil + PubkeyAuthentication yes + +# Allow public key authentication over VPN +Match Address 10.57.0.0/16 + PubkeyAuthentication yes + PermitRootLogin prohibit-password -- cgit v1.1