max/vmn-ansible
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX: hardened_sshd config improved

Browse Source
This commit is contained in:
Maxim Vershinin
2026-07-06 15:45:22 +00:00
parent 1a02e37ce8
commit a798d42b42
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/0_basic_postinstall/files/hardened_sshd.conf
+18 -12
View File
@@ -1,23 +1,29 @@
# Disable root login entirely PubkeyAuthentication yes
PermitRootLogin no AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication no
KbdInteractiveAuthentication no
UsePAM no
# Disable password authentication — keys only # Disable password authentication — keys only
PasswordAuthentication no PasswordAuthentication no
ChallengeResponseAuthentication no ChallengeResponseAuthentication no
UsePAM no
AllowGroups sshusers
PrintMotd no
AcceptEnv LANG LC_*
ClientAliveCountMax 0
ClientAliveInterval 300
Port 22
# Disable root login entirely
PermitRootLogin no
# Limit authentication attempts # Limit authentication attempts
MaxAuthTries 3 MaxAuthTries 3
MaxSessions 2 MaxSessions 3
# Allow only your specific user
AllowUsers deploy
# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup) # Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
# Connection timeout
ClientAliveInterval 300
ClientAliveCountMax 2