From 698234c0402eeff37517869695c75682a3fad332 Mon Sep 17 00:00:00 2001
From: Georg Pfuetzenreuter
Date: Thu, 26 Jan 2023 23:05:21 +0100
Subject: Manage common SSH server

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
---
 pillar/global/ssh.sls | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 pillar/global/ssh.sls

(limited to 'pillar/global/ssh.sls')

diff --git a/pillar/global/ssh.sls b/pillar/global/ssh.sls
new file mode 100644
index 0000000..bd960bd
--- /dev/null
+++ b/pillar/global/ssh.sls
@@ -0,0 +1,31 @@
+{%- from slspath ~ '/../global/macros.jinja' import listeners -%}
+{#-
+{%- from '/tmp/salt-libertacasa/pillar/global/macros.jinja' import listeners with context -%}
+#}
+{%- set host = grains['host'] -%}
+
+sshd_config:
+  ConfigBanner: |
+    ### This file is managed via https://git.com.de/LibertaCasa/salt
+    ### Manual changes will be overwritten
+  ListenAddress: {{ listeners() | indent }}
+  Protocol: 2
+  SyslogFacility: AUTH
+  LogLevel: FATAL
+  HostKey:
+    - /etc/ssh/{{ host }}
+  HostKeyAlgorithms: ssh-ed25519-cert-v01@openssh.com
+  HostCertificate: /etc/ssh/{{ host }}-cert.pub
+  TrustedUserCAKeys: /etc/ssh/user_ca
+  PasswordAuthentication: 'no'
+  LoginGraceTime: 1m
+  PermitRootLogin: 'no'
+  StrictModes: 'yes'
+  MaxAuthTries: 1
+  MaxSessions: 3
+  UsePAM: 'yes'
+  X11Forwarding: 'no'
+  PrintMotd: 'yes'
+  PrintLastLog: 'yes'
+  Subsystem: sftp /usr/lib/ssh/sftp-server
+
-- 
cgit v1.2.3