krincap/gitlab-mirror
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add controls for tunneling and forwarding

Browse Source
This commit is contained in:
Alexander Gorelyshev
2026-06-08 14:08:28 +04:00
parent 310bda74af
commit aa24942348
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
roles/sshd/README.md
View File

@@ -11,7 +11,14 @@ None
Role Variables Role Variables
-------------- --------------
None - `sshd_disable_pam`: whether to disable PAM support. Default: `false`
- `sshd_password_auth`: whether to allow password authentication. Default: `false`
- `sshd_challenge_response_auth`: whether to allow challenge-response authentication. Default: `false`
- `sshd_gss_api_auth`: whether to allow GSSAPI authentication. Default: `false`
- `sshd_allow_agent_forwarding`: whether to allow SSH agent forwarding. Default: `false`
- `sshd_allow_tcp_forwarding`: whether to allow TCP forwarding. Default: `false`
- `sshd_gateway_ports`: whether to allow gateway ports. Default: `false`
- `sshd_permit_tunnel`: whether to allow SSH tunneling. Default: `false`
Dependencies Dependencies
------------ ------------

4
roles/sshd/defaults/main.yml
View File

@@ -3,3 +3,7 @@ sshd_disable_pam: false
sshd_password_auth: false sshd_password_auth: false
sshd_challenge_response_auth: false sshd_challenge_response_auth: false
sshd_gss_api_auth: false sshd_gss_api_auth: false
sshd_allow_agent_forwarding: false
sshd_allow_tcp_forwarding: false
sshd_gateway_ports: false
sshd_permit_tunnel: false

4
roles/sshd/tasks/restrictions.yml
View File

@@ -10,6 +10,10 @@
- { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' } - { regexp: '^#?\s*KbdInteractiveAuthentication\s+', line: 'KbdInteractiveAuthentication no' }
- { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' } - { regexp: '^#?\s*HostbasedAuthentication\s+', line: 'HostbasedAuthentication no' }
- { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' } - { regexp: '^#?\s*PermitUserEnvironment\s+', line: 'PermitUserEnvironment no' }
- { regexp: '^#?\s*AllowAgentForwarding\s+', line: 'AllowAgentForwarding {{ sshd_allow_agent_forwarding | ternary("yes", "no") }}' }
- { regexp: '^#?\s*AllowTcpForwarding\s+', line: 'AllowTcpForwarding {{ sshd_allow_tcp_forwarding | ternary("yes", "no") }}' }
- { regexp: '^#?\s*GatewayPorts\s+', line: 'GatewayPorts {{ sshd_gateway_ports | ternary("yes", "no") }}' }
- { regexp: '^#?\s*PermitTunnel\s+', line: 'PermitTunnel {{ sshd_permit_tunnel | ternary("yes", "no") }}' }
- { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' } - { regexp: '^#?\s*StrictModes\s+', line: 'StrictModes yes' }
- { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' } - { regexp: '^#?\s*IgnoreUserKnownHosts\s+', line: 'IgnoreUserKnownHosts yes' }
ansible.builtin.lineinfile: ansible.builtin.lineinfile: