miticojo

---
# SSH server settings, in line with https://stribika.github.io/2015/01/04/secure-secure-shell.html
# Before using, change myhosts to your hosts' nickname and myuser to your username (two instances! make sure you replace both or you'll be locked out of ssh!)
- hosts: myhosts
  become: true
  remote_user: myuser
  tasks:
    # Key exchange, ciphers and MACs
    - lineinfile: dest=/etc/ssh/sshd_config regexp='^KexAlgorithms' line='KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
    

miticojo

# Recommendations from https://stribika.github.io/2015/01/04/secure-secure-shell.html

# Github needs diffie-hellman-group-exchange-sha1 some of the time but not always.
#Host github.com
#    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

Host *
    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256

Host *

miticojo

###############################################################################
# LDAP AUTHENTICATION SETTINGS
###############################################################################

# Ansible Tower can be configured to centrally use LDAP as a source for
# authentication information.  When so configured, a user who logs in with
# a LDAP username and password will automatically get an account created for
# them, and they can be automatically placed into multiple organizations as
# either regular users or organization administrators.  If users are created
# via an LDAP login, by default they cannot change their username, firstname,

miticojo

#!/bin/bash -x

yum -y update --security

##########################
## ENABLE SSH RECORDING ##
##########################

# Create a new folder for the log files
mkdir /var/log/bastion