search

kairos-io / kairos

:penguin: The immutable Linux meta-distribution for edge Kubernetes.
https://kairos.io
Apache License 2.0
1.08k stars 94 forks source link

SSH Hardening #789

Open sdwilsh opened 1 year ago

sdwilsh commented 1 year ago

Is your feature request related to a problem? Please describe.

I run the ssh role from dev-sec/ansible-collection-hardening on any linux box I run to harden ssh to the DevSec SSH Baseline. The Kairos images all appear to use the default configuration for ssh, which isn't as secure.

Describe the solution you'd like

I would love to see Kairos images pass, and verify with CI, against the compliance profile for the DevSec SSH Baseline.

Describe alternatives you've considered

Supporting the cloud-init ansible module would allow folks to run any arbitrary ansible playbook during cloud-init, and the ansible role for this could be ran during that phase. It's a more generic solution, but I think meeting the baseline profile would be better for most users by default than requiring them to run this playbook.

mudler commented 1 year ago

Thanks for filing the issue, this is something indeed we should support, either ootb or explicitly opting-out from the cloud config.