58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
---
|
|
# Variables de construction du golden template Debian 13 Proxmox.
|
|
|
|
sudo_ansible_admin_user: "ansible"
|
|
|
|
# SSH : cloud-init doit avoir injecté ciuser et clé publique avant Ansible.
|
|
ssh_baseline_password_authentication: "no"
|
|
ssh_baseline_permit_root_login: "no"
|
|
ssh_baseline_pubkey_authentication: "yes"
|
|
|
|
ssh_hardening_port: 22
|
|
ssh_hardening_password_authentication: "no"
|
|
ssh_hardening_permit_root_login: "no"
|
|
ssh_hardening_pubkey_authentication: "yes"
|
|
ssh_hardening_client_alive_interval: 300
|
|
ssh_hardening_client_alive_count_max: 2
|
|
ssh_hardening_max_auth_tries: 3
|
|
ssh_hardening_login_grace_time: "20s"
|
|
|
|
systemd_ssh_auto_disable: true
|
|
|
|
cloud_init_ssh_pwauth: false
|
|
cloud_init_manage_etc_hosts: true
|
|
cloud_init_disable_root: true
|
|
cloud_init_ssh_deletekeys: true
|
|
|
|
# Pare-feu : préparé mais non activé dans le template.
|
|
nftables_baseline_enabled: false
|
|
nftables_baseline_allow_ssh: true
|
|
nftables_baseline_allow_icmp: true
|
|
nftables_baseline_ssh_port: 22
|
|
nftables_baseline_input_policy: "drop"
|
|
nftables_baseline_forward_policy: "drop"
|
|
nftables_baseline_output_policy: "accept"
|
|
nftables_baseline_extra_tcp_ports: []
|
|
nftables_baseline_extra_udp_ports: []
|
|
|
|
fail2ban_ssh_enabled: true
|
|
fail2ban_ssh_port: 22
|
|
fail2ban_ssh_bantime: "1h"
|
|
fail2ban_ssh_findtime: "10m"
|
|
fail2ban_ssh_maxretry: 5
|
|
|
|
auditd_enabled: true
|
|
apparmor_enabled: true
|
|
sysctl_hardening_apply: true
|
|
core_dumps_disable: true
|
|
|
|
unattended_upgrades_enabled: true
|
|
unattended_upgrades_remove_unused_dependencies: true
|
|
unattended_upgrades_automatic_reboot: false
|
|
|
|
journald_system_max_use: "200M"
|
|
journald_runtime_max_use: "100M"
|
|
journald_max_retention_sec: "1month"
|
|
|
|
template_cleanup_confirm: false
|
|
template_cleanup_admin_user: "ansible"
|