boma/roles/base/templates/sshd_hardening.conf.j2

# Managed by Ansible (base role, ADR-002). Do not edit on the host.
PasswordAuthentication {{ base__ssh_password_authentication }}
PermitRootLogin {{ base__ssh_permit_root_login }}
PubkeyAuthentication yes
KbdInteractiveAuthentication no
{% if base__ssh_listen_mesh_only | bool %}
ListenAddress {{ base__ssh_listen_addr_resolved }}
{% endif %}
feat(base): ssh hardening + fail2ban (hardening concern, ADR-002) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-14 16:42:56 +02:00			`# Managed by Ansible (base role, ADR-002). Do not edit on the host.`
			`PasswordAuthentication {{ base__ssh_password_authentication }}`
			`PermitRootLogin {{ base__ssh_permit_root_login }}`
			`PubkeyAuthentication yes`
			`KbdInteractiveAuthentication no`
feat(base): opt-in sshd ListenAddress on the mesh IP (fail-closed) base__ssh_listen_mesh_only binds sshd to the live wt0 IP only, with ip_nonlocal_bind to beat the post-boot bind race and a fail-closed assert so an unresolved address never silently listens on all interfaces. Molecule covers the render + sysctl. Mesh-hardening 1/3 (ADR-016/021). Environmental checkpoint applied: the molecule-debian13 container image lacks procps (no sysctl binary). Added molecule/default/prepare.yml to install procps and sysctls: {net.ipv4.ip_nonlocal_bind: "0"} to molecule.yml platform so the ansible.posix.sysctl task can write and read back the value hermetically. Sysctl file format is net.ipv4.ip_nonlocal_bind=1 (no spaces); verify.yml grep pattern updated to match ansible.posix.sysctl's actual output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 2026-06-17 20:39:23 +02:00			`{% if base__ssh_listen_mesh_only \| bool %}`
			`ListenAddress {{ base__ssh_listen_addr_resolved }}`
			`{% endif %}`