FEATURE: sshd config added, task to push it added

roles/0_basic_postinstall/files/hardended_sshd.conf

@@ -0,0 +1,23 @@
+# Disable root login entirely
+PermitRootLogin no
+
+# Disable password authentication — keys only
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+UsePAM no
+
+# Limit authentication attempts
+MaxAuthTries 3
+MaxSessions 2
+
+# Allow only your specific user
+AllowUsers deploy
+
+# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
+KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+
+# Connection timeout
+ClientAliveInterval 300
+ClientAliveCountMax 2

roles/0_basic_postinstall/tasks/harden_ssh.yaml

@@ -0,0 +1,15 @@
+---
+
+- name: Configure ssh-server daemon
+  copy:
+    src: ../files/hardened_sshd.conf
+    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
+    mode: u=rw,g=r,o=r
+  notify: restart sshd
+
+
+#- name: Configure ssh client
+#  copy:
+#    src: /home/max/ansible_files/ssh_config
+#    dest: /etc/ssh/ssh_config
+#    mode: u=rw,g=r,o=r