new files from source

Infrastrucutre as Code/Ansible/roles/cis_hardening/ssh_hardening/defaults/main.yml

@@ -0,0 +1,32 @@
+---
+# General settings
+ssh_protocol: 2
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_challenge_response_authentication: "no"
+ssh_kerberos_authentication: "no"
+ssh_gssapi_authentication: "no"
+ssh_use_pam: "yes"
+PrintLastLog: "yes"
+
+# Session security
+ssh_x11_forwarding: "no"
+ssh_allow_tcp_forwarding: "yes"
+ssh_permit_tunnel: "no"
+ssh_allow_agent_forwarding: "no"
+
+# Idle timeout / login attempts
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 3
+ssh_login_grace_time: 60
+ssh_max_auth_tries: 3
+ssh_max_sessions: 2
+ssh_max_startups: "10:30:60"
+
+# SSH access restrictions
+ssh_allow_users: "adminuser ansibleuser"
+
+# Strong encryption
+ssh_ciphers: "aes256-ctr,aes192-ctr,aes128-ctr"
+ssh_macs: "hmac-sha2-512,hmac-sha2-256"
+ssh_kex_algorithms: "[email protected],diffie-hellman-group-exchange-sha256"