Ansible config for hetzner mailserver

ansible/mailserver/roles/ssh/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+ssh_port: 22
+ssh_permit_root_login: "prohibit-password"  # allows key-based root login
+ssh_password_authentication: "no"
+ssh_max_auth_tries: 3
+ssh_allowed_users: "root"  # space-separated list

ansible/mailserver/roles/ssh/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: restarted

ansible/mailserver/roles/ssh/tasks/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Deploy hardened sshd config
+  ansible.builtin.template:
+    src: sshd_config.j2
+    dest: /etc/ssh/sshd_config
+    owner: root
+    group: root
+    mode: "0600"
+    validate: "sshd -t -f %s"
+  notify: restart sshd

ansible/mailserver/roles/ssh/templates/sshd_config.j2

@@ -0,0 +1,38 @@
+Port {{ ssh_port }}
+AddressFamily any
+ListenAddress 0.0.0.0
+ListenAddress ::
+
+# Authentication
+PermitRootLogin {{ ssh_permit_root_login }}
+PasswordAuthentication {{ ssh_password_authentication }}
+ChallengeResponseAuthentication no
+KbdInteractiveAuthentication no
+UsePAM yes
+MaxAuthTries {{ ssh_max_auth_tries }}
+PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+
+# Disable unused auth methods
+GSSAPIAuthentication no
+KerberosAuthentication no
+HostbasedAuthentication no
+PermitEmptyPasswords no
+
+# Session
+X11Forwarding no
+PrintMotd no
+TCPKeepAlive yes
+ClientAliveInterval 300
+ClientAliveCountMax 2
+LoginGraceTime 30
+
+# Restrict users
+AllowUsers {{ ssh_allowed_users }}
+
+# Logging
+LogLevel VERBOSE
+SyslogFacility AUTH
+
+# SFTP
+Subsystem sftp /usr/lib/openssh/sftp-server