parallelvirtualcluster
/
pvc-ansible
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Improve SSH configuration for nodes 

Ensure hostbased auth works with configs, remove erroneous old
conditional for authtypes, remove obsolete config option.
This commit is contained in:
Joshua Boniface 2020-08-06 15:54:12 -04:00
parent 6851d42885
commit a0e4f3bd30
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
roles/base/templates/etc/ssh/shosts.equiv.j2
View File

@ -1,3 +1,8 @@
# SSH remote allowed hosts
# {{ ansible_managed }}
{% for host in groups[cluster_group] %}
{{ host }}
{{ host.split('.')[0] }}.{{ networks['cluster']['domain'] }}
{{ host.split('.')[0] }}
{% endfor %}

3
roles/base/templates/etc/ssh/ssh_known_hosts.j2
View File

@ -1,3 +1,6 @@
# SSH remote allowed hosts
# {{ ansible_managed }}
{% for host in groups[cluster_group] %}
{{ host }},{{ host.split('.')[0] }}.{{ networks['cluster']['domain'] }},{{ host.split('.')[0] }} ssh-ed25519 {{ hostvars[host].ansible_ssh_host_key_ed25519_public }}
{% endfor %}

7
roles/base/templates/etc/ssh/sshd_config.j2
View File

@ -6,7 +6,6 @@ ListenAddress ::
ListenAddress 0.0.0.0
Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
@ -29,15 +28,9 @@ PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no
{% if 'hv' in group_names %}
HostbasedAuthentication yes
HostbasedUsesNameFromPacketOnly yes
IgnoreRhosts no
PermitRootLogin yes
{% else %}
HostbasedAuthentication no
IgnoreRhosts yes
PermitRootLogin no
{% endif %}
Subsystem sftp /usr/lib/openssh/sftp-server -f AUTH -l INFO