Role common: add task sftpd.yml for chrooted SFTP access.

- group 'sftpusers' (GID 200 or next free), sshd drop-in
  /etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h,
  ForceCommand internal-sftp), PasswordAuthentication via
  'sftp_password_authentication'
- new sftp users (UID 201 or next free) with root owned chroot home,
  upload dir and root owned authorized_keys (always created)
- existing users (e.g. www-data, suexec users) can be added to the group;
  chroot requirements of their home are checked, not changed
- passwords: update_password defaults to 'always', password of users with
  shell access is never changed
- controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd'
- add empty sftpd section to all host_vars *-common.yml

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

chris

2026-11-14 10:42:42 +01:00

co-authored by

Claude Opus 5.5

parent 2b5bffe2be

commit 67c1086e2c

179 changed files with 1376 additions and 0 deletions

									
										host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml
									
		+5
		
												View File
												
				@@ -93,6 +93,11 @@ network_interfaces:

				# ---

				# ---

				# vars used by roles/common/tasks/sftpd.yml

				# ---

				# ---

				# vars used by roles/common/tasks/apt.yml

				# ---