33 lines
839 B
YAML
33 lines
839 B
YAML
---
|
|
# General settings
|
|
ssh_protocol: 2
|
|
ssh_permit_root_login: "no"
|
|
ssh_password_authentication: "no"
|
|
ssh_challenge_response_authentication: "no"
|
|
ssh_kerberos_authentication: "no"
|
|
ssh_gssapi_authentication: "no"
|
|
ssh_use_pam: "yes"
|
|
PrintLastLog: "yes"
|
|
|
|
# Session security
|
|
ssh_x11_forwarding: "no"
|
|
ssh_allow_tcp_forwarding: "yes"
|
|
ssh_permit_tunnel: "no"
|
|
ssh_allow_agent_forwarding: "no"
|
|
|
|
# Idle timeout / login attempts
|
|
ssh_client_alive_interval: 300
|
|
ssh_client_alive_count_max: 3
|
|
ssh_login_grace_time: 60
|
|
ssh_max_auth_tries: 3
|
|
ssh_max_sessions: 2
|
|
ssh_max_startups: "10:30:60"
|
|
|
|
# SSH access restrictions
|
|
ssh_allow_users: "adminuser ansibleuser"
|
|
|
|
# Strong encryption
|
|
ssh_ciphers: "aes256-ctr,aes192-ctr,aes128-ctr"
|
|
ssh_macs: "hmac-sha2-512,hmac-sha2-256"
|
|
ssh_kex_algorithms: "[email protected],diffie-hellman-group-exchange-sha256"
|