chrisandClaude Opus 5.5
67c1086e2c
- group 'sftpusers' (GID 200 or next free), sshd drop-in /etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h, ForceCommand internal-sftp), PasswordAuthentication via 'sftp_password_authentication' - new sftp users (UID 201 or next free) with root owned chroot home, upload dir and root owned authorized_keys (always created) - existing users (e.g. www-data, suexec users) can be added to the group; chroot requirements of their home are checked, not changed - passwords: update_password defaults to 'always', password of users with shell access is never changed - controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd' - add empty sftpd section to all host_vars *-common.yml Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
79 lines
1.3 KiB
YAML
79 lines
1.3 KiB
YAML
---
|
|
# yamllint disable rule:line-length
|
|
|
|
# ---
|
|
# vars used by role 'firewall'
|
|
# ---
|
|
|
|
is_web_server: true
|
|
|
|
is_mail_server: true
|
|
dovecot_auth_service_port: 44444
|
|
has_dovecot_auth_service_ipv4: false
|
|
has_dovecot_auth_service_ipv6: false
|
|
dovecot_auth_allowed_network_ipv4:
|
|
- 192.68.11.79
|
|
dovecot_auth_allowed_network_ipv6:
|
|
- 2001:678:a40:3000::/64
|
|
- 2a01:30:0:13:2f7:50ff:fed2:cef7
|
|
|
|
# ---
|
|
# vars used by roles/ansible_dependencies
|
|
# ---
|
|
|
|
|
|
# ---
|
|
# vars used by roles/common/tasks/basic.yml
|
|
# ---
|
|
|
|
|
|
# ---
|
|
# vars used by cron.yml
|
|
# ---
|
|
|
|
# cron_env_entries: []
|
|
cron_env_entries:
|
|
- name: PATH
|
|
job: /root/bin/admin-stuff:/root/bin:/usr/local/php/bin:/usr/local/apache2/bin:/sbin:/bin:/usr/local/dovecot/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
|
|
- name: SHELL
|
|
job: /bin/bash
|
|
|
|
|
|
# ---
|
|
# vars used by apt.yml
|
|
# ---
|
|
|
|
|
|
# ---
|
|
# vars used by roles/common/tasks/sshd.yml
|
|
# ---
|
|
|
|
|
|
# ---
|
|
# vars used by roles/common/tasks/sftpd.yml
|
|
# ---
|
|
|
|
|
|
# ---
|
|
# vars used by roles/common/tasks/users.yml
|
|
# ---
|
|
|
|
create_sftp_group: true
|
|
|
|
# ---
|
|
# vars used by roles/common/tasks/sudoers.yml
|
|
# ---
|
|
|
|
insert_sudoers_back_postgres_privileges: true
|
|
|
|
insert_sudoers_postfixadmin_privileges: true
|
|
|
|
|
|
# ==============================
|
|
|
|
|
|
# ---
|
|
# vars used by scripts/reset_root_passwd.yml
|
|
# ---
|