Use more secure sshd defaults

[fullyint]

Background

A discourse thread prompted #561, a call to create more secure sshd defaults. @RiFi2k implemented these improvements in #702 in a ssh-hardening branch that @fullyint augmented and PR-ed to master in #716. Discussion in #716 determined that we should further modify our adaptation of the dev-sec/ansible-ssh-hardening role to match Trellis coding conventions. Many thanks to @RiFi2k and @swalkinshaw for their work preparing these modifications.

In the end, whittling and modifying the dev-sec role ended up being more work and code change than if we'd simply adjusted our existing sshd role. In addition, the final modification of the dev-sec role still struck me as somewhat inorganic to the rest of Trellis (example of nearly final modification here).

This PR

This PR starts over with just our original sshd role, eliminates parts we don't need, then adds the minimum needed to achieve great security and excellent README guidance for users. It strikes me as more streamlined and suitable than #716.

This PR takes one logical step per commit, for easier review. Commits could be squashed on merge.

Sorry @RiFi2k that this didn't directly use and credit all your incredible work. I hope it's ok that I cherry-picked and added your "Remove insecure lines from moduli file" commit (with you as author).

Comparing with #716

Comments in #716 offered a diff of configs before vs. after #716. Here is how the final config of this PR differs from the final config of #716:

  # ssh_config
  # ---------------------

  # stribika recommends 'no'
- challengeresponseauthentication yes
+ challengeresponseauthentication no


  # sshd_config
  # ---------------------

  # we already have PasswordAuthentication no
  # keeping 'yes/no' avoids having to change name/handling of sshd_permit_root_login var
- permitrootlogin without-password
+ permitrootlogin yes

  # Applies to RhostsRSAAuthentication and HostbasedAuthentication which are both 'no'
  # cleaner to omit IgnoreUserKnownHosts option (system default is 'no')
- ignoreuserknownhosts yes
+ ignoreuserknownhosts no

  # KerberosAuthentication is 'no'
  # cleaner to omit KerberosAuthentication option (system default is 'yes')
- kerberosorlocalpasswd no
+ kerberosorlocalpasswd yes

  # LogLevel system default is 'INFO', which seems fine
  # cleaner to omit option
- loglevel VERBOSE
+ loglevel INFO

  # Users who want '-l INFO -f LOCAL6' can add it on their own
- subsystem sftp internal-sftp -l INFO -f LOCAL6
+ subsystem sftp internal-sftp

[swalkinshaw]

This looks good to go. Needs changelog entry as well 👍

[fullyint]

Major thanks to @RiFi2k and @swalkinshaw for a ton of work and review!

[RiFi2k]

@fullyint thanks to you for getting it where it needed to be, I know you put in some hours on this.