50 lines
1.6 KiB
Django/Jinja
50 lines
1.6 KiB
Django/Jinja
|
# Ansible managed
|
||
|
|
AcceptEnv LANG LC_*
|
||
|
|
AllowAgentForwarding no
|
||
|
|
AllowGroups provision users
|
||
|
|
AllowTcpForwarding yes
|
||
|
|
AuthenticationMethods any
|
||
|
|
Banner __PROGRAMDATA__/ssh/issue.net
|
||
|
|
ChallengeResponseAuthentication no
|
||
|
|
Ciphers {{ __ssh_ciphers__ | join(',') }}
|
||
|
|
ClientAliveCountMax 1
|
||
|
|
ClientAliveInterval 200
|
||
|
|
Compression no
|
||
|
|
GSSAPIAuthentication no
|
||
|
|
HostbasedAuthentication no
|
||
|
|
HostKeyAlgorithms {{ __ssh_hostkey_algorithms__ | join(',') }}
|
||
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
||
|
|
PubkeyAcceptedAlgorithms {{ __ssh_pubkey_accepted_algorithms__ | join(',') }}
|
||
|
|
IgnoreUserKnownHosts yes
|
||
|
|
{% set __ssh_supported_kex__ = ssh_supported_kex.stdout_lines | default([]) | map('trim') | reject('equalto', '') | list %}
|
||
|
|
{% set __ssh_effective_kex__ = (__ssh_kex_algorithms__ | intersect(__ssh_supported_kex__)) if (__ssh_supported_kex__ | length > 0) else __ssh_kex_algorithms__ %}
|
||
|
|
{% if __ssh_effective_kex__ | length > 0 %}
|
||
|
|
KexAlgorithms {{ __ssh_effective_kex__ | join(',') }}
|
||
|
|
{% endif %}
|
||
|
|
LoginGraceTime 20
|
||
|
|
LogLevel VERBOSE
|
||
|
|
Macs {{ __ssh_macs__ | join(',') }}
|
||
|
|
MaxAuthTries {{ __ssh_max_auth_tries__ }}
|
||
|
|
MaxSessions {{ __ssh_max_sessions__ }}
|
||
|
|
MaxStartups 10:30:60
|
||
|
|
PasswordAuthentication no
|
||
|
|
PermitEmptyPasswords no
|
||
|
|
PermitRootLogin no
|
||
|
|
PermitUserEnvironment no
|
||
|
|
Port 22
|
||
|
|
PrintLastLog yes
|
||
|
|
PrintMotd no
|
||
|
|
RekeyLimit 512M 1h
|
||
|
|
RequiredRSASize 2048
|
||
|
|
StrictModes yes
|
||
|
|
TCPKeepAlive no
|
||
|
|
UseDNS no
|
||
|
|
X11Forwarding no
|
||
|
|
Subsystem sftp internal-sftp
|
||
|
|
{% if __ssh_subsystem_path__ | default('') | length > 0 %}
|
||
|
|
Subsystem powershell "{{ __ssh_subsystem_path__ }}" -sshs -NoLogo -NoProfile
|
||
|
|
{% endif %}
|
||
|
|
Match Group administrators
|
||
|
|
AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
|
||
|
|
|