72 lines
2.1 KiB
YAML
72 lines
2.1 KiB
YAML
---
|
|
|
|
- name: "Ensure SSH X11 forwarding is disabled"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "^#X11Forwarding|^X11Forwarding"
|
|
line: 'X11Forwarding no'
|
|
|
|
- name: " Ensure SSH MaxAuthTries is set to 4 or less"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: '^(#)?MaxAuthTries \d'
|
|
line: 'MaxAuthTries 6'
|
|
|
|
- name: "Ensure SSH PermitEmptyPasswords is disabled"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "^#PermitEmptyPasswords|^PermitEmptyPasswords"
|
|
line: 'PermitEmptyPasswords no'
|
|
|
|
- name: "Ensure SSH PermitUserEnvironment is disabled"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "^#PermitUserEnvironment|^PermitUserEnvironment"
|
|
line: 'PermitUserEnvironment no'
|
|
|
|
- name: "Ensure SSH Idle Timeout Interval is configured"
|
|
block:
|
|
- name: "Ensure SSH Idle Timeout Interval is configured | Add line in sshd_config for ClientAliveInterval"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: '^ClientAliveInterval'
|
|
line: "ClientAliveInterval {{ sshd['clientaliveinterval'] }}"
|
|
|
|
- name: "Ensure SSH Idle Timeout Interval is configured | Ensure SSH ClientAliveCountMax set to <= 3"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: '^ClientAliveCountMax'
|
|
line: "ClientAliveCountMax {{ sshd['clientalivecountmax'] }}"
|
|
|
|
- name: "Ensure SSH warning banner is configured"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: '^Banner'
|
|
line: "Banner /etc/login.warn"
|
|
|
|
- name: "Ensure SSH MaxStartups is configured"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "^#MaxStartups|^MaxStartups"
|
|
line: 'MaxStartups 10:30:60'
|
|
|
|
- name: "Ensure SSH MaxSessions is limited"
|
|
lineinfile:
|
|
state: present
|
|
dest: /etc/ssh/sshd_config
|
|
regexp: "^#MaxSessions|^MaxSessions"
|
|
line: 'MaxSessions {{ ssh_maxsessions }}'
|
|
|
|
- name: Restart SSHD service
|
|
service:
|
|
name: sshd
|
|
state: reloaded
|