REFACTOR: move SSH hardening into a separated role

2026-08-09 17:30:17 +04:00
parent f5670addc6
commit 05f0c1cc5f
5 changed files with 190 additions and 0 deletions
@@ -0,0 +1,29 @@
+PubkeyAuthentication yes
+AuthorizedKeysFile	.ssh/authorized_keys
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+UsePAM no
+# Disable password authentication — keys only
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+
+
+AllowGroups sshusers
+PrintMotd no
+AcceptEnv LANG LC_*
+ClientAliveCountMax 0
+ClientAliveInterval 300
+Port 22
+
+
+# Disable root login entirely
+PermitRootLogin no
+
+# Limit authentication attempts
+MaxAuthTries 3
+MaxSessions 3
+
+# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
+KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com