groups:
- ssh
- ssh_client
- ssh_server
- sshd_strengthen_firewall
name: openssh
packages:
- openssh
- openssh-clients
- openssh-server
rules:
- configure_custom_crypto_policy_cis
- directory_groupowner_sshd_config_d
- directory_owner_sshd_config_d
- directory_permissions_sshd_config_d
- disable_host_auth
- file_groupowner_etc_sysconfig_sshd
- file_groupowner_sshd_config
- file_groupowner_sshd_drop_in_config
- file_groupownership_sshd_private_key
- file_groupownership_sshd_pub_key
- file_owner_etc_sysconfig_sshd
- file_owner_sshd_config
- file_owner_sshd_drop_in_config
- file_ownership_sshd_private_key
- file_ownership_sshd_pub_key
- file_permissions_etc_sysconfig_sshd
- file_permissions_sshd_config
- file_permissions_sshd_drop_in_config
- file_permissions_sshd_private_key
- file_permissions_sshd_pub_key
- file_sshd_50_redhat_exists
- firewalld_sshd_disabled
- firewalld_sshd_port_enabled
- iptables_sshd_disabled
- package_openssh-clients_installed
- package_openssh-server_installed
- package_openssh-server_removed
- package_openssh_installed
- package_openssh_removed
- service_sshd_disabled
- service_sshd_enabled
- ssh_client_rekey_limit
- ssh_client_use_strong_rng_csh
- ssh_client_use_strong_rng_sh
- ssh_client_use_approved_ciphers_ordered_stig
- ssh_keys_passphrase_protected
- ssh_private_keys_have_passcode
- ssh_use_approved_macs_ordered_stig
- sshd_allow_only_protocol2
- sshd_disable_compression
- sshd_disable_empty_passwords
- sshd_disable_forwarding
- sshd_disable_gssapi_auth
- sshd_disable_kerb_auth
- sshd_disable_pubkey_auth
- sshd_disable_rhosts
- sshd_disable_rhosts_rsa
- sshd_disable_root_login
- sshd_disable_root_password_login
- sshd_disable_tcp_forwarding
- sshd_disable_user_known_hosts
- sshd_disable_x11_forwarding
- sshd_do_not_permit_user_env
- sshd_enable_gssapi_auth
- sshd_enable_pam
- sshd_enable_pubkey_auth
- sshd_enable_strictmodes
- sshd_enable_warning_banner
- sshd_enable_warning_banner_net
- sshd_enable_x11_forwarding
- sshd_limit_user_access
- sshd_print_last_log
- sshd_rekey_limit
- sshd_set_idle_timeout
- sshd_set_keepalive
- sshd_set_keepalive_0
- sshd_set_login_grace_time
- sshd_set_loglevel_info
- sshd_set_loglevel_verbose
- sshd_set_max_auth_tries
- sshd_set_max_sessions
- sshd_set_maxstartups
- sshd_use_approved_ciphers
- sshd_use_approved_ciphers_ordered_stig
- sshd_use_approved_kex_ordered_stig
- sshd_use_approved_macs
- sshd_use_approved_macs_ordered_stig
- sshd_use_directory_configuration
- sshd_use_priv_separation
- sshd_use_strong_ciphers
- sshd_use_strong_kex
- sshd_use_strong_macs
- sshd_use_strong_rng
- sshd_x11_use_localhost
- sshd_include_crypto_policy
- harden_sshd_crypto_policy
templates:
- sshd_lineinfile
