Sorted sysctl values and lists in READMEs alphabetically (No functional changes). (#371)
* Add s's for consistency. Signed-off-by: Farid Joubbi <[email protected]> * Sort lists alphabetically. Signed-off-by: Farid Joubbi <[email protected]> * Sorted sysctl_config alphabetically. Signed-off-by: Farid Joubbi <[email protected]> * Sort removed protocols. Signed-off-by: Farid Joubbi <[email protected]> * Added dots in variable descriptions for the sake of consistency. Signed-off-by: Farid Joubbi <[email protected]> * Added dots in variable descriptions for the sake of consistency. Signed-off-by: Farid Joubbi <[email protected]>
This commit is contained in:
Farid Joubbi authored and GitHub committed
1 parent
e8e552f3ae
commit
5675589e01
4 files changed
+196
-195
No files matched your search
@@ -19,13 +19,13 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: true if IPv6 is needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
|
||||
- `ssh_client_config_file`
|
||||
- Default: `'/etc/ssh/ssh_config'`
|
||||
- Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`
|
||||
- Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.
|
||||
- `ssh_server_config_file`
|
||||
- Default: `'/etc/ssh/sshd_config'`
|
||||
- Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`
|
||||
- Description: path of the ssh server configuration file, e.g. `/etc/ssh/sshd_config.d/custom.conf`.
|
||||
- `ssh_server_ports`
|
||||
- Default: `['22']`
|
||||
- Description: ports on which ssh-server should listen
|
||||
- Description: ports on which ssh-server should listen.
|
||||
- `ssh_client_port`
|
||||
- Default: `'22'`
|
||||
- Description: Specifies the port number to connect on the remote host.
|
||||
@@ -34,19 +34,19 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: one or more ip addresses, to which ssh-server should listen to. Default is all IPv4 adresses, but should be configured to specific addresses for security reasons!
|
||||
- `ssh_host_key_files`
|
||||
- Default: `[]`
|
||||
- Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version
|
||||
- Description: Host keys for sshd. If empty ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key'] will be used, as far as supported by the installed sshd version.
|
||||
- `ssh_host_key_algorithms`
|
||||
- Default: `[]`
|
||||
- Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms
|
||||
- Description: Host key algorithms that the server offers. If empty the [default list](https://man.openbsd.org/sshd_config#HostKeyAlgorithms) will be used, otherwise overrides the setting with specified list of algorithms.
|
||||
- `ssh_client_alive_interval`
|
||||
- Default: `600`
|
||||
- Description: specifies an interval for sending keepalive messages
|
||||
- Description: specifies an interval for sending keepalive messages.
|
||||
- `ssh_client_alive_count`
|
||||
- Default: `3`
|
||||
- Description: defines how often keep-alive messages are sent
|
||||
- Description: defines how often keep-alive messages are sent.
|
||||
- `ssh_permit_tunnel`
|
||||
- Default: `false`
|
||||
- Description: true if SSH Port Tunneling is required
|
||||
- Description: true if SSH Port Tunneling is required.
|
||||
- `ssh_remote_hosts`
|
||||
- Default: `[]`
|
||||
- Description: one or more hosts and their custom options for the ssh-client. Default is empty. See examples in `defaults/main.yml`.
|
||||
@@ -106,52 +106,52 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: list of hashes containing file paths and authorized principals, see `default_custom.yml` for all options. Only used if `ssh_authorized_principals_file` is set.
|
||||
- `ssh_print_motd`
|
||||
- Default: `false`
|
||||
- Description: false to disable printing of the MOTD
|
||||
- Description: false to disable printing of the MOTD.
|
||||
- `ssh_print_pam_motd`
|
||||
- Default: `false`
|
||||
- Description: false to disable printing of the MOTD via pam (Debian and Ubuntu)
|
||||
- Description: false to disable printing of the MOTD via pam (Debian and Ubuntu).
|
||||
- `ssh_print_last_log`
|
||||
- Default: `false`
|
||||
- Description: false to disable display of last login information
|
||||
- Description: false to disable display of last login information.
|
||||
- `sftp_enabled`
|
||||
- Default: `false`
|
||||
- Description: true to enable sftp configuration
|
||||
- Description: true to enable sftp configuration.
|
||||
- `sftp_umask`
|
||||
- Default: `'0027'`
|
||||
- Description: Specifies the umask for sftp
|
||||
- Description: Specifies the umask for sftp.
|
||||
- `sftp_chroot`
|
||||
- Default: `true`
|
||||
- Description: false to disable chroot for sftp
|
||||
- Description: false to disable chroot for sftp.
|
||||
- `sftp_chroot_dir`
|
||||
- Default: `/home/%u`
|
||||
- Description: change default sftp chroot location
|
||||
- Description: change default sftp chroot location.
|
||||
- `ssh_client_roaming`
|
||||
- Default: `false`
|
||||
- Description: enable experimental client roaming
|
||||
- Description: enable experimental client roaming.
|
||||
- `sshd_moduli_file`
|
||||
- Default: `'/etc/ssh/moduli'`
|
||||
- Description: path to the SSH moduli file
|
||||
- Description: path to the SSH moduli file.
|
||||
- `sshd_moduli_minimum`
|
||||
- Default: `2048`
|
||||
- Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam
|
||||
- Description: remove Diffie-Hellman parameters smaller than the defined size to mitigate logjam.
|
||||
- `ssh_challengeresponseauthentication`
|
||||
- Default: `false`
|
||||
- Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM)
|
||||
- Description: Specifies whether challenge-response authentication is allowed (e.g. via PAM).
|
||||
- `ssh_client_password_login`
|
||||
- Default: `false`
|
||||
- Description: `true` to allow password-based authentication with the ssh client
|
||||
- Description: `true` to allow password-based authentication with the ssh client.
|
||||
- `ssh_server_password_login`
|
||||
- Default: `false`
|
||||
- Description: `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`
|
||||
- Description: `true` to allow password-based authentication to the ssh server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `ssh_server_password_login`: `true`.
|
||||
- `ssh_banner`
|
||||
- Default: `false`
|
||||
- Description: `true` to print a banner on login
|
||||
- Description: `true` to print a banner on login.
|
||||
- `ssh_banner_path`
|
||||
- Default: `'/etc/sshd/banner.txt'`
|
||||
- Description: path to the SSH banner file
|
||||
- Description: path to the SSH banner file.
|
||||
- `ssh_client_hardening`
|
||||
- Default: `true`
|
||||
- Description: `false` to stop harden the client
|
||||
- Description: `false` to stop harden the client.
|
||||
- `ssh_client_compression`
|
||||
- Default: `false`
|
||||
- Description: Specifies whether the client requests compression.
|
||||
@@ -160,7 +160,7 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: Specifies whether server-side compression is enabled after the user has authenticated successfully.
|
||||
- `ssh_login_grace_time`
|
||||
- Default: `30s`
|
||||
- Description: specifies the time allowed for successful authentication to the SSH server
|
||||
- Description: specifies the time allowed for successful authentication to the SSH server.
|
||||
- `ssh_max_auth_retries`
|
||||
- Default: `2`
|
||||
- Description: Specifies the maximum number of authentication attempts permitted per connection.
|
||||
@@ -169,13 +169,13 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: Specifies the maximum number of open sessions permitted from a given connection.
|
||||
- `ssh_print_debian_banner`
|
||||
- Default: `false`
|
||||
- Description: `true` to print debian specific banner
|
||||
- Description: `true` to print debian specific banner.
|
||||
- `ssh_server_enabled`
|
||||
- Default: `true`
|
||||
- Description: `false` to disable the opensshd server
|
||||
- Description: `false` to disable the opensshd server.
|
||||
- `ssh_server_hardening`
|
||||
- Default: `true`
|
||||
- Description: `false` to stop harden the server
|
||||
- Description: `false` to stop harden the server.
|
||||
- `ssh_server_match_address`
|
||||
- Default: `''`
|
||||
- Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
|
||||
@@ -190,10 +190,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.
|
||||
- `ssh_server_permit_environment_vars`
|
||||
- Default: `no`
|
||||
- Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings
|
||||
- Description: `yes` to specify that ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. With openssh version 7.8 it is possible to specify a whitelist of environment variable names in addition to global "yes" or "no" settings.
|
||||
- `ssh_server_accept_env_vars`
|
||||
- Default: `''`
|
||||
- Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace
|
||||
- Description: Specifies what environment variables sent by the client will be copied into the session's environment, multiple environment variables may be separated by whitespace.
|
||||
- `ssh_use_dns`
|
||||
- Default: `false`
|
||||
- Description: Specifies whether sshd should look up the remote host name, and to check that the resolved host name for the remote IP address maps back to the very same IP address.
|
||||
@@ -205,31 +205,31 @@ Warning: This role disables root-login on the target server! Please make sure yo
|
||||
- Description: Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
|
||||
- `ssh_macs`
|
||||
- Default: `[]`
|
||||
- Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`
|
||||
- Description: Change this list to overwrite macs. Defaults found in `defaults/main.yml`.
|
||||
- `ssh_kex`
|
||||
- Default: `[]`
|
||||
- Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`
|
||||
- Description: Change this list to overwrite kexs. Defaults found in `defaults/main.yml`.
|
||||
- `ssh_ciphers`
|
||||
- Default: `[]`
|
||||
- Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`
|
||||
- Description: Change this list to overwrite ciphers. Defaults found in `defaults/main.yml`.
|
||||
- `ssh_custom_options`
|
||||
- Default: `[]`
|
||||
- Description: Custom lines for SSH client configuration
|
||||
- Description: Custom lines for SSH client configuration.
|
||||
- `sshd_custom_options`
|
||||
- Default: `[]`
|
||||
- Description: Custom lines for SSH daemon configuration
|
||||
- Description: Custom lines for SSH daemon configuration.
|
||||
- `sshd_syslog_facility`
|
||||
- Default: `'AUTH'`
|
||||
- Description: The facility code that is used when logging messages from sshd
|
||||
- Description: The facility code that is used when logging messages from sshd.
|
||||
- `sshd_log_level`
|
||||
- Default: `'VERBOSE'`
|
||||
- Description: the verbosity level that is used when logging messages from sshd
|
||||
- Description: the verbosity level that is used when logging messages from sshd.
|
||||
- `sshd_strict_modes`
|
||||
- Default: `true`
|
||||
- Description: Check file modes and ownership of the user's files and home directory before accepting login
|
||||
- Description: Check file modes and ownership of the user's files and home directory before accepting login.
|
||||
- `sshd_authenticationmethods`
|
||||
- Default: `publickey`
|
||||
- Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`
|
||||
- Description: Specifies the authentication methods that must be successfully completed for a user to be granted access. Make sure to set all required variables for your selected authentication method. Defaults found in `defaults/main.yml`.
|
||||
|
||||
## Example Playbook
|
||||
|
||||
|
||||
Reference in new issue
Block a user