From cce172b9fe3c2565706a21d5d61c77807577279b Mon Sep 17 00:00:00 2001 From: boxswapper Date: Sun, 13 Sep 2026 13:27:02 -0600 Subject: [PATCH] removed ssh stuff --- .../ses_f63e23ebcffe7Q6sJKCl9W8sFt.json | 4 ++-- README.md | 13 ++--------- roles/stoat/tasks/harden.yml | 23 ------------------- roles/stoat/templates/sshd_hardening.conf.j2 | 8 ------- 4 files changed, 4 insertions(+), 44 deletions(-) delete mode 100644 roles/stoat/templates/sshd_hardening.conf.j2 diff --git a/.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json b/.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json index 1f1eb66..e161aac 100644 --- a/.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json +++ b/.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json @@ -1,10 +1,10 @@ { "sessionID": "ses_f63e23ebcffe7Q6sJKCl9W8sFt", - "updatedAt": "2026-09-13T19:22:32.998Z", + "updatedAt": "2026-09-13T19:25:59.636Z", "sources": { "background-task": { "state": "idle", - "updatedAt": "2026-09-13T19:22:32.998Z" + "updatedAt": "2026-09-13T19:25:59.636Z" } } } \ No newline at end of file diff --git a/README.md b/README.md index cd0b647..c6a8549 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm ├── handlers/main.yml └── templates/ ├── jail.local.j2 # fail2ban config - ├── sshd_hardening.conf.j2 # sshd drop-in └── podman-compose-stoat.service.j2 # systemd unit for the stack ``` @@ -44,11 +43,7 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm stoat-demo ansible_host=stoat-demo ansible_user=YOUR_SSH_USER ``` -3. **SSH password login is intentionally enabled** (`sshd_password_authentication: yes`). - - Root login stays disabled — use your SSH user + `sudo`. - - Fail2Ban is the brute-force defense: `3` failed attempts → `1 h` ban (tunable). - - If you ever want key-only auth again, flip the var to `no`. - - Ansible connects with a password via `-k`: +3. **SSH is not touched by this playbook** — the server keeps its SSH configuration exactly as you have it. Fail2Ban still protects the login (`3` failed attempts → `1 h` ban, tunable). Ansible connects with your SSH password via `-k`: ```bash ansible-playbook -i inventory.ini site.yml -k @@ -62,7 +57,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm |---|---| | **System** | `dnf update` all packages; install `git`, `curl`, `openssl` | | **Firewall** | firewalld default-deny; allow `ssh`, `http`, `https`, `7881/tcp`, `50000-50100/udp` (LiveKit voice) | -| **SSH** | drop-in `00-hardening.conf`: `PermitRootLogin no`, `PasswordAuthentication yes`; config validated with `sshd -t` before restart | | **Fail2Ban** | `sshd` jail (3 retries → 1 h ban, incremental for repeat offenders) | | **Auto-updates** | `dnf5-plugin-automatic`, security-only, `apply_updates = yes`, started timer | | **Logs** | logrotate rule for fail2ban logs (daily, 7 rotations, compressed) | @@ -94,9 +88,6 @@ Ansible automation that **hardens a Fedora 44 server**, installs **rootless Podm | `stoat_service_user` | `stoat` | unprivileged user running rootless podman | | `podman_unprivileged_port_start` | `80` | lowest port rootless containers may bind | | `fail2ban_port` / `fail2ban_maxretry` / `fail2ban_bantime` | `22` / `3` / `3600` | sshd jail tuning | -| `sshd_permit_root_login` | `no` | root SSH access | -| `sshd_password_authentication` | `yes` | password login (fail2ban guards it) | -| `sshd_mfa_required` | `false` | only enable if a 2FA PAM module exists, else you lock yourself out | | `firewall_services` / `firewall_ports` | ssh,http,https / 7881, UDP range | firewalld allow rules | Override any variable per-run, without editing files: @@ -152,6 +143,6 @@ sudo firewall-cmd --list-all - **First start pulls ~2 GB of images** and initializes MongoDB — allow a few minutes; the systemd unit tolerates up to 15 min (`TimeoutStartSec=900`). - **Podman, not Docker**: the upstream stack is docker-compose based; this deployment runs it with `podman-compose` (rootless). It supports the compose features this stack needs (`depends_on: condition: service_healthy`, bind mounts, port ranges). - **`generate_config.sh` is guarded** by `creates:` — it never overwrites existing `secrets.env`/`Revolt.toml` unintentionally. To regenerate config deliberately, run it manually with `--overwrite` as the `stoat` user (after backing up secrets). -- **Security posture**: rootless containers, non-root SSH user, fail2ban, firewalld default-deny, security-only auto-updates. (Aligned with the upstream guide's recommendations.) +- **Security posture**: rootless containers, fail2ban, firewalld default-deny, security-only auto-updates. SSH configuration is left exactly as you set it. (Aligned with the upstream guide's recommendations.) - **Rootless bind mounts**: data persists in `/opt/stoat/self-hosted/data/` (mongodb, rabbitmq, minio, caddy). - System hardening + Stoat are one role run; to re-apply only config changes, re-running `site.yml` is idempotent. \ No newline at end of file diff --git a/roles/stoat/tasks/harden.yml b/roles/stoat/tasks/harden.yml index ce31bf8..becea6e 100644 --- a/roles/stoat/tasks/harden.yml +++ b/roles/stoat/tasks/harden.yml @@ -34,29 +34,6 @@ when: item.rc | int != 0 notify: Reload firewalld -# ------------------------------------------------------------ -# SSH hardening (Drop-in config, validated before restart) -# ------------------------------------------------------------ -- name: Deploy sshd hardening drop-in - ansible.builtin.template: - src: sshd_hardening.conf.j2 - dest: /etc/ssh/sshd_config.d/00-hardening.conf - owner: root - group: root - mode: "0644" - register: sshd_conf - -- name: Validate sshd configuration - ansible.builtin.command: sshd -t - changed_when: false - when: sshd_conf is changed - -- name: Restart sshd - ansible.builtin.service: - name: sshd - state: restarted - when: sshd_conf is changed - # ------------------------------------------------------------ # Fail2Ban - brute force protection # ------------------------------------------------------------ diff --git a/roles/stoat/templates/sshd_hardening.conf.j2 b/roles/stoat/templates/sshd_hardening.conf.j2 deleted file mode 100644 index da43bc1..0000000 --- a/roles/stoat/templates/sshd_hardening.conf.j2 +++ /dev/null @@ -1,8 +0,0 @@ -# Managed by Ansible - stoat role (sshd hardening drop-in) -# Values come from group_vars/all/vars.yml - -PermitRootLogin {{ sshd_permit_root_login }} -PasswordAuthentication {{ sshd_password_authentication }} -{% if sshd_mfa_required %} -AuthenticationMethods publickey,keyboard-interactive:pam -{% endif %} \ No newline at end of file