Skip to content
This repository was archived by the owner on Dec 26, 2020. It is now read-only.

Commit 004dbca

Browse files
author
Sebastian Gumprich
committed
update readme for dev-sec and make vars a table
1 parent b259a3b commit 004dbca

File tree

1 file changed

+34
-32
lines changed

1 file changed

+34
-32
lines changed

‎README.md‎

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# ssh-hardening (Ansible Role)
22

3-
[![Build Status](http://img.shields.io/travis/hardening-io/ansible-ssh-hardening.svg)][1]
3+
[![Build Status](http://img.shields.io/travis/dev-sec/ansible-ssh-hardening.svg)][1]
44
[![Gitter Chat](https://badges.gitter.im/Join%20Chat.svg)][2]
55
[![Ansible Galaxy](https://img.shields.io/badge/galaxy-ssh--hardening-660198.svg)][3]
66

@@ -13,39 +13,41 @@ This role provides secure ssh-client and ssh-server configurations.
1313
* Ansible
1414

1515
## Role Variables
16-
* ``network_ipv6_enable`` - true if IPv6 is needed
17-
* ``ssh_client_cbc_required`` - true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.
18-
* ``ssh_server_cbc_required`` - true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.
19-
* ``ssh_client_weak_hmac`` - true if weaker HMAC mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure HMACs enabled.
20-
* ``ssh_server_weak_hmac`` - true if weaker HMAC mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure HMACs enabled.
21-
* ``ssh_client_weak_kex`` - true if weaker Key-Exchange (KEX) mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure KEXs enabled.
22-
* ``ssh_server_weak_kex`` - true if weaker Key-Exchange (KEX) mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure KEXs enabled.
23-
* ``ssh_server_ports: ['22']`` - ports to which ssh-server should listen to
24-
* ``ssh_client_ports: ['22']`` - ports to which ssh-client should connect to
25-
* ``ssh_listen_to: ['0.0.0.0']`` - one or more ip addresses, to which ssh-server should listen to. Default is all adresseses, but should be configured to specific addresses for security reasons!
26-
* ``ssh_host_key_files: ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_dsa_key', '/etc/ssh/ssh_host_ecdsa_key']`` - Host keys to look for when starting sshd.
27-
* ``ssh_client_alive_interval: 600``
28-
* ``ssh_client_alive_count: 3``
29-
* ``ssh_remote_hosts: []`` - one or more hosts, to which ssh-client can connect to. Default is empty, but should be configured for security reasons!
30-
* ``ssh_allow_root_with_key`` - false to disable root login altogether. Set to true to allow root to login via key-based mechanism.
31-
* ``ssh_allow_tcp_forwarding`` false to disable TCP Forwarding. Set to true to allow TCP Forwarding.
32-
* ``ssh_allow_agent_forwarding`` false to disable Agent Forwarding. Set to true to allow Agent Forwarding.
33-
* ``ssh_use_pam: false`` - false to disable pam authentication.
34-
* ``ssh_deny_users: ''`` - if specified, login is disallowed for user names that match one of the patterns.
35-
* ``ssh_allow_users: ''`` - if specified, login is allowed only for user names that match one of the patterns.
36-
* ``ssh_deny_groups: ''`` - if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.
37-
* ``ssh_allow_groups: ''`` - if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.
38-
* ``ssh_print_motd`` - false to disable printing of the MOTD
39-
* ``ssh_print_last_log`` - false to disable display of last login information
40-
* ``sftp_enabled`` - true to enable sftp configuration
41-
* ``sftp_chroot_dir`` - change default sftp chroot location
42-
* ``ssh_client_roaming`` - enable experimental client roaming
16+
| Name | Default Value | Description |
17+
| -------------- | ------------- | -----------------------------------|
18+
|`network_ipv6_enable` | false |true if IPv6 is needed|
19+
|`ssh_client_cbc_required` | false |true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.|
20+
|`ssh_server_cbc_required` | false |true if CBC for ciphers is required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure ciphers enabled. CBC is a weak alternative. Anything weaker should be avoided and is thus not available.|
21+
|`ssh_client_weak_hmac` | false |true if weaker HMAC mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure HMACs enabled.|
22+
|`ssh_server_weak_hmac` | false |true if weaker HMAC mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure HMACs enabled.|
23+
|`ssh_client_weak_kex` | false |true if weaker Key-Exchange (KEX) mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure KEXs enabled.|
24+
|`ssh_server_weak_kex` | false |true if weaker Key-Exchange (KEX) mechanisms are required. This is usually only necessary, if older M2M mechanism need to communicate with SSH, that don't have any of the configured secure KEXs enabled.|
25+
|`ssh_server_ports` | 22 |ports to which ssh-server should listen to|
26+
|`ssh_client_ports` | 22 |ports to which ssh-client should connect to|
27+
|`ssh_listen_to` | ['0.0.0.0'] |one or more ip addresses, to which ssh-server should listen to. Default is all adresseses, but should be configured to specific addresses for security reasons!|
28+
|`ssh_host_key_files` | ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_dsa_key', '/etc/ssh/ssh_host_ecdsa_key'] |Host keys to look for when starting sshd.|
29+
|`ssh_client_alive_interval` | 600 | specifies an interval for sending keepalive messages |
30+
|`ssh_client_alive_count` | 3 | defines how often keep-alive messages are sent |
31+
|`ssh_remote_hosts` | [] | one or more hosts, to which ssh-client can connect to. Default is empty, but should be configured for security reasons!|
32+
|`ssh_allow_root_with_key` | false | false to disable root login altogether. Set to true to allow root to login via key-based mechanism.|
33+
|`ssh_allow_tcp_forwarding` | false | false to disable TCP Forwarding. Set to true to allow TCP Forwarding.|
34+
|`ssh_allow_agent_forwarding` | false | false to disable Agent Forwarding. Set to true to allow Agent Forwarding.|
35+
|`ssh_use_pam` | false | false to disable pam authentication.|
36+
|`ssh_deny_users` | '' | if specified, login is disallowed for user names that match one of the patterns.|
37+
|`ssh_allow_users` | '' | if specified, login is allowed only for user names that match one of the patterns.|
38+
|`ssh_deny_groups` | '' | if specified, login is disallowed for users whose primary group or supplementary group list matches one of the patterns.|
39+
|`ssh_allow_groups` | '' | if specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns.|
40+
|`ssh_print_motd` | false | false to disable printing of the MOTD|
41+
|`ssh_print_last_log` | false | false to disable display of last login information|
42+
|`sftp_enabled` | false | true to enable sftp configuration|
43+
|`sftp_chroot_dir` | /home/%u | change default sftp chroot location|
44+
|`ssh_client_roaming` | false | enable experimental client roaming|
4345

4446
## Example Playbook
4547

4648
- hosts: localhost
4749
roles:
48-
- hardening.ssh-hardening
50+
- dev-sec.ssh-hardening
4951

5052
## Local Testing
5153

@@ -126,6 +128,6 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
126128
See the License for the specific language governing permissions and
127129
limitations under the License.
128130

129-
[1]: http://travis-ci.org/hardening-io/ansible-ssh-hardening
130-
[2]: https://gitter.im/hardening-io/general
131-
[3]: https://galaxy.ansible.com/list#/roles/4204
131+
[1]: http://travis-ci.org/dev-sec/ansible-ssh-hardening
132+
[2]: https://gitter.im/dev-sec/general
133+
[3]: https://galaxy.ansible.com/list#/roles/4204

0 commit comments

Comments
 (0)