parallelvirtualcluster
/
pvc-ansible
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Improve SSH configuration for nodes 

Ensure hostbased auth works with configs, remove erroneous old
conditional for authtypes, remove obsolete config option.
This commit is contained in:
Joshua Boniface 2023-09-01 15:42:24 -04:00
parent 88209a2b70
commit 777a4693a1
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
roles/base/templates/etc/ssh/shosts.equiv.j2
View File

@ -1,3 +1,8 @@
# SSH remote allowed hosts
# {{ ansible_managed }}
{% for host in groups[cluster_group] %}
{{ host }}
{{ host.split('.')[0] }}.{{ networks['cluster']['domain'] }}
{{ host.split('.')[0] }}
{% endfor %}

3
roles/base/templates/etc/ssh/ssh_known_hosts.j2
View File

@ -1,3 +1,6 @@
# SSH remote allowed hosts
# {{ ansible_managed }}
{% for host in groups[cluster_group] %}
{{ host }},{{ host.split('.')[0] }}.{{ networks['cluster']['domain'] }},{{ host.split('.')[0] }} ssh-ed25519 {{ hostvars[host].ansible_ssh_host_key_ed25519_public }}
{% endfor %}

7
roles/base/templates/etc/ssh/sshd_config.j2
View File

@ -6,7 +6,6 @@ ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
@ -29,15 +28,9 @@ PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
{% if 'hv' in group_names %}
HostbasedAuthentication yes
HostbasedUsesNameFromPacketOnly yes
IgnoreRhosts no
PermitRootLogin yes
{% else %}
HostbasedAuthentication no
IgnoreRhosts yes
PermitRootLogin no
{% endif %}
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTH -l INFO