systems/infrastructure
1
Fork 0
Code Issues 1 Pull Requests 13 Actions Activity

Restrict SSH connections to wireguard cidr

Browse Source 
Except on home server, still handy to connect on same network.
This commit is contained in:
Jake Howard 2020-07-12 17:53:02 +01:00
parent a6a3982cc8
commit 9c0682ef9b
Signed by: jake
GPG Key ID: 57AFB45680EDD477
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ansible/group_vars/all/ssh.yml Normal file
View File

@ -0,0 +1 @@
expose_ssh: false

1
ansible/host_vars/intersect.yml Normal file
View File

@ -0,0 +1 @@
expose_ssh: true

5
ansible/roles/base/files/sshd_config
View File

@ -2,8 +2,11 @@
# Change to a high/odd port if this server is exposed to the internet directly
Port 7743
# Deny all other users besides the following
{% if expose_ssh %}
AllowUsers {{ user }}
{% else %}
AllowUsers {{ user }}@{{ wireguard.cidr }}
{% endif %}
# Bind to all interfaces (change to specific interface if needed)
ListenAddress 0.0.0.0