#jinja2: lstrip_blocks: True {{ ansible_managed | comment }} # This is the sshd server system-wide configuration file. # See sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/local/bin:/usr/bin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. # If you want to change the port on a SELinux system, you have to tell # SELinux about this change. # semanage port -a -t ssh_port_t -p tcp #PORTNUMBER # Port {{ sshd_port }} #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: {% if ansible_os_family | lower == "redhat" and ansible_distribution_major_version is version('8', '<') %} Protocol {{ sshd_protocol }} {% endif %} HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none {% if sshd_crypto_policy_enabled | bool %} # This system is following system-wide crypto policy. The changes to # crypto properties (Ciphers, MACs, ...) will not have any effect here. # They will be overridden by command-line options passed to the server # on command line. # Please, check manual pages for update-crypto-policies(8) and sshd_config(5). {% else %} Ciphers {{ sshd_ciphers | join(',') }} KexAlgorithms {{ sshd_kex | join(',') }} MACs {{ sshd_macs | join(',') }} {% endif %} # Logging #SyslogFacility AUTH SyslogFacility AUTHPRIV LogLevel {{ sshd_log_level }} # Authentication: LoginGraceTime {{ sshd_login_grace_time }} PermitRootLogin {{ sshd_permit_root_login }} StrictModes {{ sshd_strict_modes }} {% if sshd_allow_groups %} AllowGroups {{ sshd_allow_groups|join(',') }} {% endif %} MaxAuthTries {{ sshd_max_auth_tries }} MaxSessions {{ sshd_max_sessions }} #PubkeyAuthentication yes # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys #AuthorizedPrincipalsFile none #AuthorizedKeysCommand none #AuthorizedKeysCommandUser nobody HostbasedAuthentication {{ sshd_hostbased_authentication }} #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files IgnoreRhosts {{ sshd_ignore_rhosts }} {% if sshd_google_auth_enabled %} # Force public key auth then ask for google auth code AuthenticationMethods publickey,keyboard-interactive {% endif %} # To disable tunneled clear text passwords, change to no here! PasswordAuthentication {{ sshd_password_authentication }} PermitEmptyPasswords {{ sshd_permit_empty_passwords }} # Change to no to disable s/key passwords ChallengeResponseAuthentication {{ sshd_challenge_response_authentication }} # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no #KerberosUseKuserok yes # GSSAPI options GSSAPIAuthentication {{ sshd_gssapi_authentication }} GSSAPICleanupCredentials no #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no #GSSAPIEnablek5users no # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. # WARNING: 'UsePAM no' is not supported on RH based systems and may # cause several problems. UsePAM yes AllowAgentForwarding {{ sshd_allow_agent_forwarding }} AllowTcpForwarding {{ sshd_allow_tcp_forwarding }} #GatewayPorts no X11Forwarding {{ sshd_x11_forwarding }} #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes {% if ansible_os_family | lower == "redhat" and ansible_distribution_major_version is version('7', '>') %} PrintMotd no {% endif %} #PrintLastLog no TCPKeepAlive {{ sshd_tcp_keep_alive }} #UseLogin no {% if ansible_os_family | lower == "redhat" and ansible_distribution_major_version is version('8', '<') %} UsePrivilegeSeparation sandbox {% endif %} #PermitUserEnvironment no Compression {{ sshd_compression }} ClientAliveInterval {{ sshd_client_alive_interval }} ClientAliveCountMax {{ sshd_client_alive_count_max }} UseDNS {{ sshd_use_dns }} #PidFile /var/run/sshd.pid MaxStartups {{ sshd_max_startups }} #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # Accept locale-related environment variables AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS # override default of no subsystems Subsystem sftp /usr/libexec/openssh/sftp-server # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server {% if sshd_google_auth_exclude_group is defined %} Match User {{ sshd_google_auth_exclude_group }} AuthenticationMethods publickey {% endif %}