add 9
This commit is contained in:
parent
dc8d1a0ef8
commit
0b878ece70
@ -0,0 +1,6 @@
|
||||
passwd: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-passwd"}
|
||||
group: {if "with-files-domain":sss files|files sss} systemd {exclude if "with-custom-group"}
|
||||
netgroup: sss files {exclude if "with-custom-netgroup"}
|
||||
automount: sss files {exclude if "with-custom-automount"}
|
||||
services: sss files {exclude if "with-custom-services"}
|
||||
sudoers: files sss {include if "with-sudo"}
|
40
files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth
Normal file
40
files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth
Normal file
@ -0,0 +1,40 @@
|
||||
{imply "with-smartcard" if "with-smartcard-required"}
|
||||
auth required pam_env.so
|
||||
auth required pam_faildelay.so delay=2000000
|
||||
auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900 {include if "with-faillock"}
|
||||
auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"}
|
||||
auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"}
|
||||
auth sufficient pam_fprintd.so {include if "with-fingerprint"}
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"}
|
||||
auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"}
|
||||
auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok} try_first_pass
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth sufficient pam_sss.so forward_pass
|
||||
auth required pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900 {include if "with-faillock"}
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
password requisite pam_pwquality.so try_first_pass local_users_only minlen=14 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 retry=3
|
||||
password requisite pam_pwhistory.so use_authok remember=5
|
||||
password sufficient pam_unix.so sha512 shadow {if not "without-nullok":nullok} try_first_pass use_authtok
|
||||
password sufficient pam_sss.so use_authtok
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so umask=0077 {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session required pam_unix.so
|
||||
session optional pam_sss.so
|
1
files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf
Symbolic link
1
files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-9-nsswitch.conf
|
1
files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth
Symbolic link
1
files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-9-system-auth
|
@ -22,6 +22,43 @@
|
||||
validate: /usr/sbin/sshd -t -f %s
|
||||
backup: true
|
||||
notify: restart_sshd
|
||||
|
||||
- name: Ensure sshd_config.d dir exists
|
||||
ansible.builtin.file:
|
||||
state: directory
|
||||
path: "/etc/ssh/sshd_config.d"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0700'
|
||||
notify: restart_sshd
|
||||
|
||||
- name: Default Modular Configuration
|
||||
when:
|
||||
- (ansible_facts['distribution'] == 'Fedora') or
|
||||
(ansible_facts['distribution'] in el_distro_name and ansible_facts['distribution_major_version']|int >= 9)
|
||||
block:
|
||||
- name: Modular configuration (redhat)
|
||||
template:
|
||||
src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-50-redhat.conf.j2"
|
||||
dest: "{{ ssh_modular_config }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
validate: /usr/sbin/sshd -t -f %s
|
||||
backup: yes
|
||||
notify: restart_sshd
|
||||
|
||||
- name: Custom Modular Configuration
|
||||
template:
|
||||
src: "etc/ssh/{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-60-shootthej.conf.j2"
|
||||
dest: "/etc/ssh/sshd_config.d/60-shootthej.conf"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0600'
|
||||
validate: /usr/sbin/sshd -t -f %s
|
||||
backup: yes
|
||||
notify: restart_sshd
|
||||
|
||||
rescue:
|
||||
- name: Print errors for configuration and validation
|
||||
debug:
|
||||
|
97
templates/etc/audit/rules.d/collection.rules.j2
Normal file
97
templates/etc/audit/rules.d/collection.rules.j2
Normal file
@ -0,0 +1,97 @@
|
||||
# Ignore CWD logs
|
||||
-a exclude,always -F msgtype=CWD
|
||||
|
||||
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change
|
||||
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change
|
||||
-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change
|
||||
-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change
|
||||
-w /etc/localtime -p wa -k time-change
|
||||
|
||||
## Records when events occur that modify user and group passwords and ID's
|
||||
{% for y in audit_identity_list %}
|
||||
-w {{ y }} -p wa -k identity
|
||||
{% endfor %}
|
||||
|
||||
## Records changes to network environment files or system calls
|
||||
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale
|
||||
-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale
|
||||
-w /etc/issue -p wa -k system-locale
|
||||
-w /etc/issue.net -p wa -k system-locale
|
||||
-w /etc/hosts -p wa -k system-locale
|
||||
-w /etc/hostname -p wa -k system-locale
|
||||
-w /etc/sysconfig/network -p wa -k system-locale
|
||||
-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale
|
||||
|
||||
## Monitors SELinux Mandatory Access Controls
|
||||
-w /etc/selinux/ -p wa -k MAC-policy
|
||||
-w /usr/share/selinux/ -p wa -k MAC-policy
|
||||
|
||||
## Monitors login/logout/failed login events
|
||||
# To be fair, these are normally logged in /var/log/secure
|
||||
{% for y in audit_logins %}
|
||||
-w {{ y }} -p wa -k logins
|
||||
{% endfor %}
|
||||
|
||||
## Monitor session initiation events
|
||||
## This will track file changes within sessions
|
||||
{% for y in audit_session %}
|
||||
-w {{ y }} -p wa -k session
|
||||
{% endfor %}
|
||||
|
||||
## Monitor changes for files for UID's above {{ audit_auid }}
|
||||
# You can take this out if you are on a non-PCI system
|
||||
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>={{ audit_auid }} -F auid!=4294967295 -k perm_mod
|
||||
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>={{ audit_auid }} -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>={{ audit_auid }} -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>={{ audit_auid }} -F auid!=4294967295 -k access
|
||||
-a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>={{ audit_auid }} -F auid!=4294967295 -k access
|
||||
|
||||
## Monitors mounting events for users
|
||||
# You can probably take these out
|
||||
-a always,exit -F arch=b64 -S mount -F auid>={{ audit_auid }} -F auid!=4294967295 -k mounts
|
||||
-a always,exit -F arch=b32 -S mount -F auid>={{ audit_auid }} -F auid!=4294967295 -k mounts
|
||||
## Collect file deletion events by a user
|
||||
-a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>={{ audit_auid }} -F auid!=4294967295 -k delete
|
||||
-a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>={{ audit_auid }} -F auid!=4294967295 -k delete
|
||||
## Collect changes to System Administration Scope
|
||||
# Note: This only records /etc/sudoers and doesn't watch /etc/sudoers.d
|
||||
-w /etc/sudoers -p wa -k scope
|
||||
-w /etc/sudoers.d -p wa -k scope
|
||||
## Collect System Administrator Actions (sudolog)
|
||||
-w /var/log/sudo.log -p wa -k actions
|
||||
## Collect Kernel Module Loading and Unloading
|
||||
-w /sbin/kmod -p x -k modules
|
||||
-w /sbin/insmod -p x -k modules
|
||||
-w /sbin/rmmod -p x -k modules
|
||||
-w /sbin/modprobe -p x -k modules
|
||||
-a always,exit -F arch=b64 -S init_module,finit_module -S delete_module -k modules
|
||||
-a always,exit -F arch=b32 -S init_module,finit_module -S delete_module -k modules
|
||||
|
||||
{% for y in audit_suid_list %}
|
||||
-a always,exit -F path={{ y }} -F perm=x -F auid>={{ audit_auid }} -F auid!=4294967295 -k privileged
|
||||
{% endfor %}
|
||||
|
||||
# Is someone messing with our audit logs?
|
||||
-w /var/log/audit/ -k audit-logs
|
||||
|
||||
-a always,exit -F dir=/var/log/audit/ -F perm=r -F auid>=1000 -F auid!=4294967295 -F key=audit-logs
|
||||
-a always,exit -F path=/usr/sbin/ausearch -F perm=x -F key=audit-logs
|
||||
-a always,exit -F path=/usr/sbin/aureport -F perm=x -F key=audit-logs
|
||||
-a always,exit -F path=/usr/sbin/aulast -F perm=x -F key=audit-logs
|
||||
-a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -F key=audit-logs
|
||||
-a always,exit -F path=/usr/sbin/auvirt -F perm=x -F key=audit-logs
|
||||
|
||||
# Privilege elevation
|
||||
-a always,exit -F arch=b64 -S setuid -Fa0=0 -F exe={{ bin_su }} -F key=privileged
|
||||
-a always,exit -F arch=b32 -S setuid -Fa0=0 -F exe={{ bin_su }} -F key=privileged
|
||||
-a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe={{ bin_sudo }} -F key=privileged
|
||||
-a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe={{ bin_sudo }} -F key=privileged
|
||||
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=privileged
|
||||
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=privileged
|
||||
|
||||
-e 2
|
37
templates/etc/chrony.conf.j2
Normal file
37
templates/etc/chrony.conf.j2
Normal file
@ -0,0 +1,37 @@
|
||||
# Remote servers for client association.
|
||||
{% for s in chrony_timeservers %}
|
||||
server {{ s }} iburst {% if loop.first %}prefer{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
# Ignore stratum in source selection.
|
||||
stratumweight 0
|
||||
|
||||
# Record the rate at which the system clock gains/losses time.
|
||||
driftfile {{ chrony_homedir }}/drift
|
||||
|
||||
# Allow the system clock to be stepped in the first three updates
|
||||
# if its offset is larger than 1.0 second.
|
||||
makestep 1.0 3
|
||||
|
||||
# If chrony_server=true allow clients to connect
|
||||
{% if chrony_server is sameas true %}
|
||||
allow {{ chrony_allow_cidr }}
|
||||
bindaddress 0.0.0.0
|
||||
{% else %}
|
||||
# Else If Client Deny NTP client access.
|
||||
deny all
|
||||
{% endif %}
|
||||
|
||||
# Allow cmdaccess for localhost only (monitoring sometimes requires this to be opened to mgmt interface)
|
||||
bindcmdaddress 127.0.0.1
|
||||
bindcmdaddress ::1
|
||||
cmdallow
|
||||
|
||||
# Send a message to syslog if a clock adjustment is larger than 0.5 seconds.
|
||||
logchange 0.5
|
||||
|
||||
# Specify directory for log files.
|
||||
logdir {{ chrony_logdir }}
|
||||
|
||||
# Enable kernel synchronization of the real-time clock (RTC).
|
||||
rtcsync
|
4
templates/etc/modprobe.d/cis.conf.j2
Normal file
4
templates/etc/modprobe.d/cis.conf.j2
Normal file
@ -0,0 +1,4 @@
|
||||
# Generated by Ansible
|
||||
{% for fs in modprobe_unused_filesystems %}
|
||||
install {{ fs }} /bin/true
|
||||
{% endfor %}
|
3
templates/etc/resolv.conf.j2
Normal file
3
templates/etc/resolv.conf.j2
Normal file
@ -0,0 +1,3 @@
|
||||
# Generated by Ansible
|
||||
search {{ ipareplica_domain }}
|
||||
nameserver {{ ipa_dns_master }}
|
1
templates/etc/ssh/CentOS-8-sshd_config.j2
Symbolic link
1
templates/etc/ssh/CentOS-8-sshd_config.j2
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-8-sshd_config.j2
|
1
templates/etc/ssh/CentOS-9-sshd_config.j2
Symbolic link
1
templates/etc/ssh/CentOS-9-sshd_config.j2
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-9-sshd_config.j2
|
174
templates/etc/ssh/RedHat-8-sshd_config.j2
Normal file
174
templates/etc/ssh/RedHat-8-sshd_config.j2
Normal file
@ -0,0 +1,174 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
# If you want to change the port on a SELinux system, you have to tell
|
||||
# SELinux about this change.
|
||||
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
|
||||
#
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
HostKey /etc/ssh/ssh_host_rsa_key
|
||||
HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# System-wide Crypto policy:
|
||||
# This system is following system-wide crypto policy. The changes to
|
||||
# Ciphers, MACs, KexAlgoritms and GSSAPIKexAlgorithsm will not have any
|
||||
# effect here. They will be overridden by command-line options passed on
|
||||
# the server start up.
|
||||
# To opt out, uncomment a line with redefinition of CRYPTO_POLICY=
|
||||
# variable in /etc/sysconfig/sshd to overwrite the policy.
|
||||
# For more information, see manual page for update-crypto-policies(8).
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
SyslogFacility AUTHPRIV
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
#PermitRootLogin yes
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to no to disable s/key passwords
|
||||
#ChallengeResponseAuthentication yes
|
||||
#ChallengeResponseAuthentication no
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
#KerberosUseKuserok yes
|
||||
|
||||
# GSSAPI options
|
||||
GSSAPIAuthentication yes
|
||||
GSSAPICleanupCredentials no
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
#GSSAPIEnablek5users no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
|
||||
# problems.
|
||||
UsePAM yes
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
X11Forwarding yes
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
|
||||
# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
|
||||
# as it is more configurable and versatile than the built-in version.
|
||||
PrintMotd no
|
||||
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#ShowPatchLevel no
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# Accept locale-related environment variables
|
||||
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
|
||||
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
|
||||
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
|
||||
AcceptEnv XMODIFIERS
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/libexec/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
|
||||
################################################################################
|
||||
# Below managed by {{ ansible_managed }}
|
||||
#
|
||||
Banner /etc/rockybanner
|
||||
PermitRootLogin no
|
||||
X11Forwarding no
|
||||
LoginGraceTime 1m
|
||||
|
||||
# FIPS Compliant
|
||||
# This has no effect in RHEL 8 or Fedora. However, in the case of compliance
|
||||
# higher than that of PCI, it may be a good idea to override it.
|
||||
MACs hmac-sha2-512,hmac-sha2-256
|
||||
Ciphers aes256-ctr,aes192-ctr,aes128-ctr
|
||||
|
||||
# IPA
|
||||
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
|
||||
AuthorizedKeysCommandUser nobody
|
||||
ChallengeResponseAuthentication yes
|
||||
PasswordAuthentication no
|
||||
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
|
||||
{% if 'gitlabservers' in group_names %}
|
||||
AllowUsers git@* *@10.*
|
||||
{% endif %}
|
130
templates/etc/ssh/RedHat-9-sshd_config.j2
Normal file
130
templates/etc/ssh/RedHat-9-sshd_config.j2
Normal file
@ -0,0 +1,130 @@
|
||||
# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
# To modify the system-wide sshd configuration, create a *.conf file under
|
||||
# /etc/ssh/sshd_config.d/ which will be automatically included below
|
||||
Include /etc/ssh/sshd_config.d/*.conf
|
||||
|
||||
# If you want to change the port on a SELinux system, you have to tell
|
||||
# SELinux about this change.
|
||||
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
|
||||
#
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
#PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
#PasswordAuthentication yes
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to no to disable s/key passwords
|
||||
#KbdInteractiveAuthentication yes
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
#KerberosUseKuserok yes
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
#GSSAPIStrictAcceptorCheck yes
|
||||
#GSSAPIKeyExchange no
|
||||
#GSSAPIEnablek5users no
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the KbdInteractiveAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via KbdInteractiveAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and KbdInteractiveAuthentication to 'no'.
|
||||
# WARNING: 'UsePAM no' is not supported in Fedora and may cause several
|
||||
# problems.
|
||||
#UsePAM no
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
#AllowTcpForwarding yes
|
||||
#GatewayPorts no
|
||||
#X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
#PrintMotd yes
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
#PidFile /var/run/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/libexec/openssh/sftp-server
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
1
templates/etc/ssh/Rocky-8-sshd_config.j2
Symbolic link
1
templates/etc/ssh/Rocky-8-sshd_config.j2
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-8-sshd_config.j2
|
1
templates/etc/ssh/Rocky-9-sshd_config.j2
Symbolic link
1
templates/etc/ssh/Rocky-9-sshd_config.j2
Symbolic link
@ -0,0 +1 @@
|
||||
RedHat-9-sshd_config.j2
|
@ -1,6 +1,10 @@
|
||||
# Variables for our common module for RedHat
|
||||
---
|
||||
|
||||
el_distro_name:
|
||||
- CentOS
|
||||
- Rocky
|
||||
|
||||
bin_su: /usr/bin/su
|
||||
bin_sudo: /usr/bin/sudo
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user