From fb7cad99b08d76ffb942075b95fb31ee76492383 Mon Sep 17 00:00:00 2001
From: Patrick Spek
Date: Tue, 4 Apr 2023 00:52:57 +0200
Subject: Update ssh playbook
---
playbooks.d/ssh/playbook.bash | 6 +-----
playbooks.d/ssh/share/notify.sh | 8 --------
playbooks.d/ssh/share/sshd_config | 33 ---------------------------------
playbooks.d/ssh/share/sshd_config.bpt | 33 +++++++++++++++++++++++++++++++++
4 files changed, 34 insertions(+), 46 deletions(-)
delete mode 100644 playbooks.d/ssh/share/notify.sh
delete mode 100644 playbooks.d/ssh/share/sshd_config
create mode 100644 playbooks.d/ssh/share/sshd_config.bpt
(limited to 'playbooks.d')
diff --git a/playbooks.d/ssh/playbook.bash b/playbooks.d/ssh/playbook.bash
index 0d70699..066d099 100644
--- a/playbooks.d/ssh/playbook.bash
+++ b/playbooks.d/ssh/playbook.bash
@@ -13,7 +13,7 @@ playbook_add() {
playbook_sync() {
info "$BASHTARD_PLAYBOOK" "Templating sshd_config"
- file_template "sshd_config" \
+ file_template "sshd_config.bpt" \
"sftp=$(config "ssh.sftp")" \
> /etc/ssh/sshd_config
@@ -31,10 +31,6 @@ playbook_sync() {
"time=$(date -u "+%FT%T")" \
> /etc/motd
- info "$BASHTARD_PLAYBOOK" "Installing notification script"
- file_template "notify.sh" \
- > /etc/ssh/notify.sh
-
[[ $BASHTARD_COMMAND == "add" ]] && return
svc reload "sshd"
diff --git a/playbooks.d/ssh/share/notify.sh b/playbooks.d/ssh/share/notify.sh
deleted file mode 100644
index 00e0b9f..0000000
--- a/playbooks.d/ssh/share/notify.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-if [ "$PAM_TYPE" != "open_session" ]
-then
- exit 0
-fi
-
-ntfy send "$PAM_USER@$(hostname -f)" "Login Succesful"
diff --git a/playbooks.d/ssh/share/sshd_config b/playbooks.d/ssh/share/sshd_config
deleted file mode 100644
index 900ed34..0000000
--- a/playbooks.d/ssh/share/sshd_config
+++ /dev/null
@@ -1,33 +0,0 @@
-# Connectivity
-Port 22
-AddressFamily any
-ListenAddress 0.0.0.0
-ListenAddress ::
-
-# Fluff
-PrintMotd yes
-
-# SFTP
-Subsystem sftp ${sftp}
-
-# Authentication
-AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys
-ChallengeResponseAuthentication no
-PasswordAuthentication no
-PermitRootLogin no
-PubkeyAuthentication no
-
-# Security
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
-HostKeyAlgorithms ssh-ed25519
-KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
-MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
-
-# Allow tyil
-Match User tyil
- PubkeyAuthentication yes
-
-# Allow public key authentication over VPN
-Match Address 10.57.0.0/16
- PubkeyAuthentication yes
- PermitRootLogin prohibit-password
diff --git a/playbooks.d/ssh/share/sshd_config.bpt b/playbooks.d/ssh/share/sshd_config.bpt
new file mode 100644
index 0000000..f1976a5
--- /dev/null
+++ b/playbooks.d/ssh/share/sshd_config.bpt
@@ -0,0 +1,33 @@
+# Connectivity
+Port 22
+AddressFamily any
+ListenAddress 0.0.0.0
+ListenAddress ::
+
+# Fluff
+PrintMotd yes
+
+# SFTP
+Subsystem sftp {{sftp}}
+
+# Authentication
+AuthorizedKeysFile /etc/ssh/authorized_keys .ssh/authorized_keys
+ChallengeResponseAuthentication no
+PasswordAuthentication no
+PermitRootLogin no
+PubkeyAuthentication no
+
+# Security
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+HostKeyAlgorithms ssh-ed25519
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
+MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
+
+# Allow tyil
+Match User tyil
+ PubkeyAuthentication yes
+
+# Allow public key authentication over VPN
+Match Address 10.57.0.0/16
+ PubkeyAuthentication yes
+ PermitRootLogin prohibit-password
--
cgit v1.1