check new version

roles/01-server_hardening/templates/sshd_config.j2

@@ -1,25 +1,47 @@
-# SSH Configuration - Managed by Ansible
+# {{ ansible_managed }}
+# SSH Server Configuration
+
 Port {{ ssh_port }}
 Protocol 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
 
 # Authentication
-PermitRootLogin {{ ssh_permit_root_login | ternary('yes', 'no') }}
-PasswordAuthentication {{ ssh_password_authentication | ternary('yes', 'no') }}
-PubkeyAuthentication yes
-AuthorizedKeysFile .ssh/authorized_keys
+LoginGraceTime 120
+PermitRootLogin {{ ssh_permit_root_login }}
+StrictModes yes
 MaxAuthTries {{ ssh_max_auth_tries }}
+MaxSessions {{ ssh_max_sessions }}
 
-# Connection settings
-ClientAliveInterval {{ ssh_client_alive_interval }}
-ClientAliveCountMax {{ ssh_client_alive_count_max }}
-MaxSessions 10
-MaxStartups 10:30:60
+PubkeyAuthentication {{ ssh_pubkey_authentication }}
+AuthorizedKeysFile .ssh/authorized_keys
 
-# Security settings
+PasswordAuthentication {{ ssh_password_authentication }}
 PermitEmptyPasswords no
 ChallengeResponseAuthentication no
-UsePAM yes
+
+# Security
+IgnoreRhosts yes
+HostbasedAuthentication no
 X11Forwarding no
 PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+Compression delayed
+
+# Client alive
+ClientAliveInterval {{ ssh_client_alive_interval }}
+ClientAliveCountMax {{ ssh_client_alive_count_max }}
+
+# Allow only ansible user
+AllowUsers ansible
+
+# Disable unused features
+UsePAM yes
+Banner none
 AcceptEnv LANG LC_*
 Subsystem sftp /usr/lib/openssh/sftp-server