new version

roles/01-server_hardening/templates/sshd_config.j2

@@ -1,47 +1,21 @@
-# {{ ansible_managed }}
-# SSH Server Configuration
-
+# Configuration SSH sécurisée générée par Ansible
 Port {{ ssh_port }}
 Protocol 2
-HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_ed25519_key
 
-# Logging
-SyslogFacility AUTH
-LogLevel INFO
-
-# Authentication
-LoginGraceTime 120
+# Authentification
 PermitRootLogin {{ ssh_permit_root_login }}
-StrictModes yes
-MaxAuthTries {{ ssh_max_auth_tries }}
-MaxSessions {{ ssh_max_sessions }}
-
-PubkeyAuthentication {{ ssh_pubkey_authentication }}
-AuthorizedKeysFile .ssh/authorized_keys
-
 PasswordAuthentication {{ ssh_password_authentication }}
-PermitEmptyPasswords no
-ChallengeResponseAuthentication no
+MaxAuthTries {{ ssh_max_auth_tries }}
+PubkeyAuthentication yes
 
-# Security
-IgnoreRhosts yes
-HostbasedAuthentication no
-X11Forwarding no
-PrintMotd no
-PrintLastLog yes
-TCPKeepAlive yes
-Compression delayed
-
-# Client alive
+# Sessions
 ClientAliveInterval {{ ssh_client_alive_interval }}
 ClientAliveCountMax {{ ssh_client_alive_count_max }}
 
-# Allow only ansible user
-AllowUsers ansible
-
-# Disable unused features
+# Sécurité
+X11Forwarding no
 UsePAM yes
-Banner none
-AcceptEnv LANG LC_*
-Subsystem sftp /usr/lib/openssh/sftp-server
+UseDNS no
+
+# Utilisateurs autorisés
+AllowUsers {{ allowed_ssh_users | join(' ') }}