| Variable Group | Variable | Default Value | Comment |
|---|---|---|---|
| base | admin_group | 'support' | Support group name (for support users on the system) |
| base | admin_users | ['root'] | Users that should be created and added to support group |
| global_config | ansible_managed_file | "# This file is managed by Ansible. Do not edit directly" | |
| global_config | sshd_config_file | True | Whether Ansible should modify the SSHD config file |
| global_config | sshd_service_restart | True | Whether Ansible should restart SSHD after making a config file change |
| global_config | enable_repo_gpgcheck | True | Whether Ansible shoudl force GPG Checks of repositories |
| global_config | enable_epel_repo | True | |
| global_config | enable_selinux | True | |
| global_config | selinux_restart | True | Whether a reboot should be triggered after SELinux is done being configured |
| global_config | configure_auditd | True | |
| global_config | plesk_server | True | Allows exceptions to SSHD for Plesk |
| sshd_config | PermitEmptyPasswords | 'no' | |
| sshd_config | Protocol | '2' | |
| sshd_config | PasswordAuthentication | 'no' | |
| sshd_config | PermitUserEnvironment | 'no' | |
| sshd_config | HostbasedAuthentication | 'no' | |
| sshd_config | Ciphers | 'aes128-ctr,aes192-ctr,aes256-ctr' | |
| sshd_config | Banner | '/etc/issue' | |
| sshd_config | ClientAliveInterval | 600 | |
| sshd_config | IgnoreRhosts | 'yes' | |
| sshd_config | PrintLastLog | 'yes' | |
| sshd_config | PermitRootLogin | 'no' | |
| sshd_config | IgnoreUserKnownHosts | 'yes' | |
| sshd_config | MACS | 'hmac-sha2-256, hmac-sha2-512' | |
| sshd_config | GSSAPIAuthentication | 'no' | |
| sshd_config | KerberosAuthentication | 'no' | |
| sshd_config | StrictModes | 'yes' | |
| sshd_config | UsePrivilegeSeparation | 'yes' | |
| sshd_config | Compression | 'delayed' | |
| sshd_config | PubKeyAuthentication | 'yes' | |
| packages | automate_security_packages | True | Adds a cronjob for yum update --security |
| packages | security_packages_log_dir | "/var/log/security-packages/" | Where to log yum update --security output |
| packages | security_packages_log_rotate_content | See variables | The logrotate content to add for security package logs |
| aws | verify_awscli | True | Installs awscli package if not present |
| aws | configure_cloudwatch | True |