From fb7cad99b08d76ffb942075b95fb31ee76492383 Mon Sep 17 00:00:00 2001 From: Patrick Spek Date: Tue, 4 Apr 2023 00:52:57 +0200 Subject: Update ssh playbook --- playbooks.d/ssh/playbook.bash | 6 +----- playbooks.d/ssh/share/notify.sh | 8 -------- playbooks.d/ssh/share/sshd_config | 33 --------------------------------- playbooks.d/ssh/share/sshd_config.bpt | 33 +++++++++++++++++++++++++++++++++ 4 files changed, 34 insertions(+), 46 deletions(-) delete mode 100644 playbooks.d/ssh/share/notify.sh delete mode 100644 playbooks.d/ssh/share/sshd_config create mode 100644 playbooks.d/ssh/share/sshd_config.bpt (limited to 'playbooks.d') diff --git a/playbooks.d/ssh/playbook.bash b/playbooks.d/ssh/playbook.bash index 0d70699..066d099 100644 --- a/playbooks.d/ssh/playbook.bash +++ b/playbooks.d/ssh/playbook.bash @@ -13,7 +13,7 @@ playbook_add() { playbook_sync() { info "$BASHTARD_PLAYBOOK" "Templating sshd_config" - file_template "sshd_config" \ + file_template "sshd_config.bpt" \ "sftp=$(config "ssh.sftp")" \ > /etc/ssh/sshd_config @@ -31,10 +31,6 @@ playbook_sync() { "time=$(date -u "+%FT%T")" \ > /etc/motd - info "$BASHTARD_PLAYBOOK" "Installing notification script" - file_template "notify.sh" \ - > /etc/ssh/notify.sh - [[ $BASHTARD_COMMAND == "add" ]] && return svc reload "sshd" diff --git a/playbooks.d/ssh/share/notify.sh b/playbooks.d/ssh/share/notify.sh deleted file mode 100644 index 00e0b9f..0000000 --- a/playbooks.d/ssh/share/notify.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh - -if [ "$PAM_TYPE" != "open_session" ] -then - exit 0 -fi - -ntfy send "$PAM_USER@$(hostname -f)" "Login Succesful" diff --git a/playbooks.d/ssh/share/sshd_config b/playbooks.d/ssh/share/sshd_config deleted file mode 100644 index 900ed34..0000000 --- a/playbooks.d/ssh/share/sshd_config +++ /dev/null @@ -1,33 +0,0 @@ -# Connectivity -Port 22 -AddressFamily any -ListenAddress 0.0.0.0 -ListenAddress :: - -# Fluff -PrintMotd yes - -# SFTP -Subsystem sftp ${sftp} - -# Authentication -AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys -ChallengeResponseAuthentication no -PasswordAuthentication no -PermitRootLogin no -PubkeyAuthentication no - -# Security -Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr -HostKeyAlgorithms ssh-ed25519 -KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org -MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com - -# Allow tyil -Match User tyil - PubkeyAuthentication yes - -# Allow public key authentication over VPN -Match Address 10.57.0.0/16 - PubkeyAuthentication yes - PermitRootLogin prohibit-password diff --git a/playbooks.d/ssh/share/sshd_config.bpt b/playbooks.d/ssh/share/sshd_config.bpt new file mode 100644 index 0000000..f1976a5 --- /dev/null +++ b/playbooks.d/ssh/share/sshd_config.bpt @@ -0,0 +1,33 @@ +# Connectivity +Port 22 +AddressFamily any +ListenAddress 0.0.0.0 +ListenAddress :: + +# Fluff +PrintMotd yes + +# SFTP +Subsystem sftp {{sftp}} + +# Authentication +AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys +ChallengeResponseAuthentication no +PasswordAuthentication no +PermitRootLogin no +PubkeyAuthentication no + +# Security +Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr +HostKeyAlgorithms ssh-ed25519 +KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org +MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com + +# Allow tyil +Match User tyil + PubkeyAuthentication yes + +# Allow public key authentication over VPN +Match Address 10.57.0.0/16 + PubkeyAuthentication yes + PermitRootLogin prohibit-password -- cgit v1.1