From 0a52f9195a12e524d7709924c44dab3a0eb52ca2 Mon Sep 17 00:00:00 2001
From: mib1185 <mail@mib85.de>
Date: Thu, 19 Sep 2024 13:28:59 +0200
Subject: [PATCH] allow seperate password login for sftp

Signed-off-by: Michael <35783820+mib1185@users.noreply.github.com>
---
 roles/ssh_hardening/README.md                  | 5 +++++
 roles/ssh_hardening/defaults/main.yml          | 3 +++
 roles/ssh_hardening/templates/opensshd.conf.j2 | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/roles/ssh_hardening/README.md b/roles/ssh_hardening/README.md
index 8e9e188d..1593ede6 100644
--- a/roles/ssh_hardening/README.md
+++ b/roles/ssh_hardening/README.md
@@ -89,6 +89,11 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Description: Specifies the umask for sftp.
   - Type: str
   - Required: no
+- `sftp_password_login`
+  - Default: inherite from `ssh_server_password_login`
+  - Description: Set to `true` to allow password-based authentication to the sftp server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `sftp_password_login`: `true`.
+  - Type: bool
+  - Required: no
 - `ssh_allow_agent_forwarding`
   - Default: `False`
   - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
diff --git a/roles/ssh_hardening/defaults/main.yml b/roles/ssh_hardening/defaults/main.yml
index d96f8c00..5824ac91 100644
--- a/roles/ssh_hardening/defaults/main.yml
+++ b/roles/ssh_hardening/defaults/main.yml
@@ -180,6 +180,9 @@ sftp_umask: "0027"
 # change default sftp chroot location
 sftp_chroot_dir: /home/%u
 
+# If true, password login for sftp is allowed
+sftp_password_login: "{{ ssh_server_password_login }}"
+
 # enable experimental client roaming
 ssh_client_roaming: false
 
diff --git a/roles/ssh_hardening/templates/opensshd.conf.j2 b/roles/ssh_hardening/templates/opensshd.conf.j2
index 4f2a9f50..ca0724bd 100644
--- a/roles/ssh_hardening/templates/opensshd.conf.j2
+++ b/roles/ssh_hardening/templates/opensshd.conf.j2
@@ -283,7 +283,7 @@ Match Group sftponly
 {% endif %}
     AllowTcpForwarding no
     AllowAgentForwarding no
-    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
+    PasswordAuthentication {{ 'yes' if (sftp_password_login|bool) else 'no' }}
     PermitRootLogin no
     X11Forwarding no
 {% endif %}