{"id":39459871,"url":"https://github.com/id-unibe-ch/ansible-role-ssh","last_synced_at":"2026-01-18T04:42:02.633Z","repository":{"id":199251870,"uuid":"649852480","full_name":"id-unibe-ch/ansible-role-ssh","owner":"id-unibe-ch","description":"A role to configure ssh","archived":false,"fork":false,"pushed_at":"2025-03-17T06:30:31.000Z","size":39,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-17T07:35:08.357Z","etag":null,"topics":["ansible","ansible-role"],"latest_commit_sha":null,"homepage":null,"language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/id-unibe-ch.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-05T19:28:13.000Z","updated_at":"2024-05-16T13:35:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"bee1783b-b2bd-48eb-b981-e2e528936634","html_url":"https://github.com/id-unibe-ch/ansible-role-ssh","commit_stats":null,"previous_names":["id-unibe-ch/ansible-role-ssh"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/id-unibe-ch/ansible-role-ssh","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/id-unibe-ch%2Fansible-role-ssh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/id-unibe-ch%2Fansible-role-ssh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/id-unibe-ch%2Fansible-role-ssh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/id-unibe-ch%2Fansible-role-ssh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/id-unibe-ch","download_url":"https://codeload.github.com/id-unibe-ch/ansible-role-ssh/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/id-unibe-ch%2Fansible-role-ssh/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28529986,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T00:39:45.795Z","status":"online","status_checked_at":"2026-01-18T02:00:07.578Z","response_time":98,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role"],"created_at":"2026-01-18T04:42:02.551Z","updated_at":"2026-01-18T04:42:02.616Z","avatar_url":"https://github.com/id-unibe-ch.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ssh\n\nAn Ansible role that manages ssh and sshd. Currently the role has the following\nfeatures:\n\n* Install sshd server and SSH clients\n* Manage server config settings in `/etc/ssh/sshd_config`, see\n  [role variables](#role-variables)\n* Manage SSH client config settings in `/etc/ssh/ssh_config`, see\n  [role variables](#role-variables)\n* Support global known hosts files for ssh clients (`/etc/ssh/ssh_config`)\n\n\u003e [!NOTE]\n\u003e This role does NOT include firewall configuration. If your system is\n\u003e protected by a firewall, which it probably should, you need to manage the\n\u003e respective firewall rules independently, e.g. in the playbook that\n\u003e includes or imports this role.\n\n## Requirements\n\nNo prerequisites necessary at the moment.\n\n## Role Variables\n\nAvailable variables are listed below, along with default values (see also\n`defaults/main.yml` as well as `man sshd_config`):\n\n### ssh_manage_sshd\n\n    ssh_manage_sshd: true\n\nSpecifies whether the sshd service should be managed by this role or not.\nUsually this is left to true, but might be temporarily set to false when this is\nneeded.\n\n### ssh_manage_motd_file\n\n    ssh_manage_motd_file: false\n\nSpecifies whether to craft a custom `/etc/motd` file showing some system\ninformations like OS name/version, IP addresses and CPU and memory information.\nIf set to false, the file `/etc/motd` is not modified, if set to true the file\nis managed an updated if needed.\n\n### ssh_port\n\n    ssh_port: \"22\"\n\nSpecifies the port number that sshd listens on. If you want to change the port\non a SELinux system, you have to tell SELinux about this change, for example:\n`semanage port -a -t ssh_port_t -p tcp #PORTNUMBER`\n\n### ssh_address_family\n\n    ssh_address_family: \"inet\"\n\nSpecifies which address family should be used by sshd.  Valid arguments are\n`any` (the default), `inet` (use IPv4 only), or `inet6` (use IPv6 only). Specifies\nwhich address family should be used by sshd. The default is IPv4 only.\n\n### ssh_permit_root_login\n\n    ssh_permit_root_login: \"prohibit-password\"\n\nSpecifies whether root can log in using ssh. The argument must be one of `yes`,\n`prohibit-password`, `forced-commands-only`, or `no`. The default is\n`prohibit-password`, which disables password and keyboard-interactive\nauthentication for root.\n\n### ssh_syslogfacility\n\n    ssh_syslogfacility: \"\"\n\nGives the facility code that is used when logging messages from sshd. The\ndefault is OS-dependent, e.g. `AUTHPRIV` for Enterprise Linux and `AUTH` for\nUbuntu. For possible values see `man sshd_config`.\n\n### ssh_use_pam\n\n    ssh_use_pam: \"yes\"\n\nEnables the Pluggable Authentication Module interface. See `man sshd_config` for\ndetailed information. This defaults to `yes` as having this set to `no` is not\nsupported in RHEL!\n\n### ssh_password_auth\n\n    ssh_password_auth: \"no\"\n\nSpecifies whether password authentication is allowed. Leave this to `no` when\nusing PAM. Default to `no` to disable tunneled clear text passwords.\n\n### ssh_kbdinteractive\n\n    ssh_kbdinteractive: \"yes\"\n\nSpecifies whether to allow keyboard-interactive authentication.\n\n### ssh_gssapi_auth\n\n    ssh_gssapi_auth: \"no\"\n\nSpecifies whether user authentication based on GSSAPI is allowed.\n\n### ssh_pubkey_auth\n\n    ssh_pubkey_auth: \"yes\"\n\nSpecifies whether public key authentication is allowed.\n\n### ssh_x11_forwarding\n\n    ssh_x11_forwarding: \"yes\"\n\nSpecifies whether X11 forwarding is permitted.\n\n### ssh_permit_tunnel\n\n    ssh_permit_tunnel: \"no\"\n\nSpecifies whether tun device forwarding is allowed.\n\n### ssh_maxstartups\n\n    ssh_maxstartups: \"10:30:100\"\n\nSpecifies the maximum number of concurrent unauthenticated connections to the\nSSH daemon. The role features the OpenSSH default value. Overriding this\noption is rarely needed but then important, like for the GPFS file system daemon\nthat may rapidly spawn a lot of SSH connections and therefore needs this option\nset to 1024.\n\n### ssh_use_dns\n\n    ssh_use_dns: \"no\"\n\nSpecifies whether sshd should look up the remote host name, and to check that\nthe resolved host name for the remote IP address maps back to the very same IP\naddress.  \nIf this option is set to no (the default) then only addresses and not host names\nmay be used in ~/.ssh/authorized_keys.\n\n### ssh_sftp_server\n\n    ssh_sftp_server: \"\"\n\nConfigures an external sftp server. By default, when set to an empty value, the\nexternal command `sftp-server` is used, for which the path is OS-dependent.\nOverride this config value if you want to use another sftp server, i.e. `internal-sftp`\nfor the in-process SFTP server.\n\n### ssh_authorized_keys_command\n\n    ssh_authorized_keys_command: \"none\"\n\nSpecifies a program to be used to look up the user's public keys.  The program must be owned by root, not writable by\ngroup or others and specified by an absolute path. The program should produce on standard output zero or more lines of authorized_keys output (see the man pages for sshd and sshd_config for details). AuthorizedKeysCommand is tried after the usual AuthorizedKeysFile files and will not be executed if a matching key is found there. By default no command is run.\n\n### ssh_authorized_keys_command_user\n\n    ssh_authorized_keys_command_user: \"nobody\"\n\nSpecifies the user under whose account the AuthorizedKeysCommand is run.  It is recommended to use a dedicated user that\nhas no other role on the host than running authorized keys commands. By default\nthe nobody user is used to run the program specified in AuthorizedKeysCommand.\n\n### ssh_allowusers\n\n    ssh_allowusers: []\n\nThis keyword can be followed by a list of user name patterns, separated by\nspaces.  If specified, login is allowed only for user names that match one of\nthe patterns.\n\n### ssh_allowgroups\n\n    ssh_allowgroups: []\n\nThis keyword can be followed by a list of group name patterns, separated by\nspaces.  If specified, login is allowed only for users whose primary group or\nsupplementary group list matches one of the patterns.  Only group names are\nvalid; a numerical group ID is not recognized.\n\n### ssh_global_known_hosts\n\n    ssh_global_known_hosts: []\n\nSpecifies one or more files to use for the global host key database, separated\nby whitespace.\n\n### ssh_crypto_hostkey_algos\n\n    ssh_crypto_hostkey_algos: []\n\nThis role configures only secure algorithms by default in order to have\n`ssh-audit` pass with all green. Use this variable to override the host key\nalgorithms that this role defines by defaults. See `vars/*.yml` for details.\n\n### ssh_crypto_kex_algos\n\n    ssh_crypto_kex_algos: []\n\nThis role configures only secure algorithms by default in order to have\n`ssh-audit` pass with all green. Use this variable to override the key exchange\nalgorithms that this role defines by defaults. See `vars/*.yml` for details.\n\n### ssh_crypto_ciphers\n\n    ssh_crypto_ciphers: []\n\nThis role configures only secure algorithms by default in order to have\n`ssh-audit` pass with all green. Use this variable to override the encryption\nalgorithms that this role defines by defaults. See `vars/*.yml` for details.\n\n### ssh_crypto_macs\n\n    ssh_crypto_macs: []\n\nThis role configures only secure algorithms by default in order to have\n`ssh-audit` pass with all green. Use this variable to override the message\nauthentication code algorithms that this role defines by defaults. See\n`vars/*.yml` for details.\n\n## Example Playbook\n\nIncluding an example of how to use your role (for instance, with variables\npassed in as parameters) is always nice for users too:\n\n    - hosts: servers\n      roles:\n         - role: unibeid.ssh\n           vars:\n             ssh_port: \"42\"\n\n## Compatibility\n\nThis role has been written for and tested on and is therefore compatible with:\n\n* CentOS-7\n* Rocky-8\n* Rocky-9\n* Ubuntu-20.04\n* Ubuntu-22.04\n\n## Dependencies\n\nThis role has no dependencies.\n\n## License\n\nMIT\n\n## Author Information\n\nThe role was created in 2023 by the IT-Services Office of the University of Bern\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fid-unibe-ch%2Fansible-role-ssh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fid-unibe-ch%2Fansible-role-ssh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fid-unibe-ch%2Fansible-role-ssh/lists"}