Files

T

PhilandClaude Opus 5.5 dff614b481 Turn off SSH password and root login

sshd accepted passwords from the internet (about 12,000 failed logins a
day) and root logins with a key. Keys only now, no root, no X11 forwarding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 12:17:45 -06:00

handlers

Turn off SSH password and root login

2026-10-31 12:17:45 -06:00

tasks

Turn off SSH password and root login

2026-10-31 12:17:45 -06:00

README.md

Turn off SSH password and root login

2026-10-31 12:17:45 -06:00

README.md

Common Role

Base setup applied first by site.yml (tag common).

What it does

Installs aptitude and jq.
Installs unattended-upgrades and turns on daily security updates (Debian security archive only, no automatic reboots).
SSH: keys only, no root login, no X11 forwarding (/etc/ssh/sshd_config.d/10-hardening.conf, reloads ssh when changed).
Makes sure UFW is enabled with default deny. The SSH rule comes from the bootstrap role, and container rules from ufw-docker in the docker role.

Usage

bin/deploy --tags common