Mic92/ansible
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

restrict ssh ciphers

Browse Source
This commit is contained in:
Jörg Thalheim 2015-01-08 11:47:18 +01:00
parent f2844607f3
commit 164d86761e
3 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
roles/container/tasks/ssh.yml
View File

@ -2,8 +2,8 @@
pacman: name=openssh state=present
- name: Write sshd_config
template: src=sshd_config.j2 dest=/etc/ssh/sshd_config mode=0644
- name: symlink /dev/pts/ptmx to /dev/ptmx for sshd pty
file: src=/dev/pts/ptmx dest=/dev/ptmx state=link
- name: Write ssh_config
template: src=ssh_config.j2 dest=/etc/ssh/ssh_config mode=0644
- name: create link-ptmx.service
copy: src=link-ptmx.service dest=/etc/systemd/system/link-ptmx.service mode=0644
- name: enable link-ptmx.service

4
roles/container/templates/ssh_config.j2 Normal file
View File

@ -0,0 +1,4 @@
Host *
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com

7
roles/container/templates/sshd_config.j2
View File

@ -7,6 +7,7 @@ AuthorizedKeysCommandUser root
AuthorizedKeysFile .ssh/authorized_keys
{% endif %}
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
@ -14,4 +15,8 @@ UsePAM yes
PrintMotd no
UsePrivilegeSeparation sandbox
Subsystem sftp /usr/lib/ssh/sftp-server
Subsystem sftp usr/lib/ssh/sftp-server
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com