PhilandClaude Opus 5.5
dff614b481
sshd accepted passwords from the internet (about 12,000 failed logins a day) and root logins with a key. Keys only now, no root, no X11 forwarding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
18 lines
567 B
Markdown
18 lines
567 B
Markdown
# Common Role
|
|
|
|
Base setup applied first by `site.yml` (tag `common`).
|
|
|
|
## What it does
|
|
- Installs `aptitude` and `jq`.
|
|
- Installs `unattended-upgrades` and turns on daily security updates
|
|
(Debian security archive only, no automatic reboots).
|
|
- SSH: keys only, no root login, no X11 forwarding
|
|
(`/etc/ssh/sshd_config.d/10-hardening.conf`, reloads ssh when changed).
|
|
- Makes sure UFW is enabled with default deny. The SSH rule comes from the
|
|
bootstrap role, and container rules from `ufw-docker` in the docker role.
|
|
|
|
## Usage
|
|
```bash
|
|
bin/deploy --tags common
|
|
```
|