Update README

README.md

@@ -1,3 +1,55 @@
 # ansible-role-openssh
 
 Sensible and secure defaults for OpenSSH server.
+
+## Defaults
+
+The defaults provided in this role are compliant with the [Mozilla Modern](https://infosec.mozilla.org/guidelines/openssh) for OpenSSH 6.7+
+
+If you are running this role with older versions of OpenSSH, such as version 5.3 on RHEL or CentOS 6, you will need to override the defaults elsewhere (i.e. in your `group_vars` or `host_vars`). Below are a few Mozzila recommendations.
+
+### Mozilla Modern
+This is the default in this role.
+
+```yaml
+ssh_kexalgorithms:
+  - curve25519-sha256@libssh.org
+  - ecdh-sha2-nistp521
+  - ecdh-sha2-nistp384
+  - ecdh-sha2-nistp256
+  - diffie-hellman-group-exchange-sha256
+
+ssh_ciphers:
+  - chacha20-poly1305@openssh.com
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_macs:
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - umac-128-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - umac-128@openssh.com
+```
+
+### Mozilla Intermediate
+```yaml
+ssh_hostkey_file: /etc/ssh/ssh_host_rsa_key
+ssh_hostkey_file: /etc/ssh/ssh_host_ecdsa_key
+
+ssh_kexalgorithms:
+  - diffie-hellman-group-exchange-sha256
+
+ssh_ciphers:
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_macs:
+  - hmac-sha2-512
+  - hmac-sha2-256
+```

defaults/main.yaml

@@ -7,8 +7,6 @@ ssh_address_family: any
 ssh_listen_addresses:
   - 0.0.0.0
 
-ssh_host_key_file: /etc/ssh/ssh_host_ed25519_key
-
 ssh_allow_groups: ssh
 ssh_login_grace_time: 20
 ssh_permit_root_login: 'no'
@@ -20,6 +18,32 @@ ssh_pubkey_authentication: 'yes'
 
 ssh_authorized_keys_file: .ssh/authorized_keys
 
+ssh_kexalgorithms:
+  # Mozilla Modern
+  - curve25519-sha256@libssh.org
+  - ecdh-sha2-nistp521
+  - ecdh-sha2-nistp384
+  - ecdh-sha2-nistp256
+  - diffie-hellman-group-exchange-sha256
+
+ssh_ciphers:
+  # Mozilla Modern
+  - chacha20-poly1305@openssh.com
+  - aes256-gcm@openssh.com
+  - aes128-gcm@openssh.com
+  - aes256-ctr
+  - aes192-ctr
+  - aes128-ctr
+
+ssh_macs:
+  # Mozilla Modern
+  - hmac-sha2-512-etm@openssh.com
+  - hmac-sha2-256-etm@openssh.com
+  - umac-128-etm@openssh.com
+  - hmac-sha2-512
+  - hmac-sha2-256
+  - umac-128@openssh.com
+
 ssh_hostbased_authentication: 'no'
 ssh_password_authentication: 'no'
 ssh_permit_empty_passwords: 'no'
@@ -42,3 +66,5 @@ ssh_accept_env:
 
 ssh_banner: true
 ssh_banner_file: /etc/issue.net
+
+ssh_loglevel: "VERBOSE"

makefile

@@ -0,0 +1,2 @@
+test:
+	ansible-playbook test.yaml

templates/sshd_config.j2

@@ -6,7 +6,26 @@ AddressFamily {{ ssh_address_family }}
 ListenAddress {{ a }}
 {% endfor %}
 
-HostKey {{ ssh_host_key_file }}
+{% if ssh_hostkey_file is defined %}
+HostKey {{ ssh_hostkey_file }}
+{% else %}
+HostKey /etc/ssh/ssh_host_ed25519_key
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+{% endif %}
+
+{% if ssh_kexalgorithms is defined %}
+KexAlgorithms {% for alg in ssh_kexalgorithms %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+{% endif %}
+
+{% if ssh_ciphers is defined %}
+Ciphers {% for alg in ssh_ciphers %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+{% endif %}
+
+{% if ssh_macs is defined %}
+MACs {% for alg in ssh_macs %}{{ alg }}{{ "," if not loop.last }}{% endfor %}
+{% endif %}
+
 
 AllowGroups {{ ssh_allow_groups }}
 LoginGraceTime {{ ssh_login_grace_time }}
@@ -47,8 +66,10 @@ AcceptEnv {{ e }}
 PermitUserEnvironment no
 {% endif %}
 
+LogLevel {{ ssh_loglevel }}
+
 {% if ansible_facts['os_family'] == 'RedHat' %}
-Subsystem sftp	/usr/libexec/openssh/sftp-server
+Subsystem sftp	/usr/libexec/openssh/sftp-server -f AUTHPRIV -l INFO
 {% elif ansible_facts['os_family'] == 'Debian' %}
-Subsystem sftp	/usr/lib/openssh/sftp-server
+Subsystem sftp	/usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
 {% endif %}

test.yaml

@@ -0,0 +1,15 @@
+
+---
+- hosts: 127.0.0.1
+  vars_files:
+    - defaults/main.yaml
+  tasks:
+    - name: Test Jinja2 templates
+      check_mode: true
+      diff: true
+      ansible.builtin.template:
+        src: "{{ item }}"
+        dest: "/tmp/{{ item }}"
+      with_items:
+        - templates/sshd_config.j2
+        - templates/issue.net.j2