68 lines
2 KiB
Django/Jinja
68 lines
2 KiB
Django/Jinja
# {{ ansible_managed }}
|
|
|
|
{% if sshd_Port_list is defined %}
|
|
{% for port in sshd_Port_list %}
|
|
Port {{ port }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% if sshd_ListenAddress_list is defined %}
|
|
{% for address in sshd_ListenAddress_list %}
|
|
ListenAddress {{ address }}
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% for keyfile in sshd_HostKey_file_list %}
|
|
HostKey {{ keyfile }}
|
|
{% endfor %}
|
|
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
PrintMotd no
|
|
AcceptEnv LANG LC_*
|
|
|
|
{% if sshd_sssd_ldap and ((ansible_distribution == "Ubuntu" and ansible_distribution_version is version('20.04', '>=')) or (ansible_distribution == "Debian" and ansible_distribution_version is version('11', '>='))) %}
|
|
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
|
|
AuthorizedKeysCommandUser nobody
|
|
{% endif %}
|
|
{% if sshd_AllowGroups_list is defined %}
|
|
|
|
AllowGroups {{ sshd_AllowGroups_list | join(' ') }}
|
|
{% elif ansible_virtualization_role == "host" or ansible_virtualization_role == "NA" %}
|
|
|
|
AllowGroups {{ sshd_default_AllowGroups_list_physical | join(' ') }}
|
|
{% elif ansible_virtualization_type == "lxc" %}
|
|
|
|
AllowGroups {{ sshd_default_AllowGroups_list_container | join(' ') }}
|
|
{% else %}
|
|
|
|
AllowGroups {{ sshd_default_AllowGroups_list_virtual_machine | join(' ') }}
|
|
{% endif %}
|
|
|
|
# BEGIN extended security settings
|
|
Ciphers {{ sshd_Ciphers | join(',') }}
|
|
MACs {{ sshd_MACs | join(',') }}
|
|
KexAlgorithms {{ sshd_KexAlgorithms | join(',') }}
|
|
TCPKeepAlive no
|
|
ClientAliveCountMax 4
|
|
ClientAliveInterval 30
|
|
{% if sshd_RevokedKeys_list is defined %}
|
|
RevokedKeys /etc/ssh/revoked_keys
|
|
{% endif %}
|
|
# END extended security settings
|
|
|
|
{% if sshd_sftp_enabled %}
|
|
# enable sftp configuration using internal-sftp subsystem for group policies
|
|
Subsystem sftp internal-sftp
|
|
{% for item in sshd_sftp_group_access %}
|
|
|
|
# sftp configuration for group {{ item.name }}
|
|
Match Group {{ item.name }}
|
|
ForceCommand internal-sftp
|
|
ChrootDirectory {{ item.ChrootDirectory }}
|
|
AllowTcpForwarding no
|
|
AllowAgentForwarding no
|
|
PermitRootLogin no
|
|
X11Forwarding no
|
|
{% endfor %}
|
|
{% else %}
|
|
Subsystem sftp /usr/lib/openssh/sftp-server
|
|
{% endif %}
|