From 4ae5acf05033df2833144bcd8473044e3afd9754 Mon Sep 17 00:00:00 2001
From: Michael <35783820+mib1185@users.noreply.github.com>
Date: Tue, 25 Feb 2025 15:24:46 +0000
Subject: [PATCH] move `Match Group sftponly` block to the end

Signed-off-by: Michael <35783820+mib1185@users.noreply.github.com>
---
 roles/ssh_hardening/README.md                 |  5 ----
 roles/ssh_hardening/defaults/main.yml         |  3 ---
 .../ssh_hardening/templates/opensshd.conf.j2  | 26 ++++++++++---------
 3 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/roles/ssh_hardening/README.md b/roles/ssh_hardening/README.md
index 1593ede6..8e9e188d 100644
--- a/roles/ssh_hardening/README.md
+++ b/roles/ssh_hardening/README.md
@@ -89,11 +89,6 @@ For more information, see [this issue](https://github.com/dev-sec/ansible-collec
   - Description: Specifies the umask for sftp.
   - Type: str
   - Required: no
-- `sftp_password_login`
-  - Default: inherite from `ssh_server_password_login`
-  - Description: Set to `true` to allow password-based authentication to the sftp server. You probably also need to change `sshd_authenticationmethods` to include `password` if you set `sftp_password_login`: `true`.
-  - Type: bool
-  - Required: no
 - `ssh_allow_agent_forwarding`
   - Default: `False`
   - Description: Set to `false` to disable Agent Forwarding. Set to `true` to allow Agent Forwarding.
diff --git a/roles/ssh_hardening/defaults/main.yml b/roles/ssh_hardening/defaults/main.yml
index 5824ac91..d96f8c00 100644
--- a/roles/ssh_hardening/defaults/main.yml
+++ b/roles/ssh_hardening/defaults/main.yml
@@ -180,9 +180,6 @@ sftp_umask: "0027"
 # change default sftp chroot location
 sftp_chroot_dir: /home/%u
 
-# If true, password login for sftp is allowed
-sftp_password_login: "{{ ssh_server_password_login }}"
-
 # enable experimental client roaming
 ssh_client_roaming: false
 
diff --git a/roles/ssh_hardening/templates/opensshd.conf.j2 b/roles/ssh_hardening/templates/opensshd.conf.j2
index ca0724bd..8ac636e9 100644
--- a/roles/ssh_hardening/templates/opensshd.conf.j2
+++ b/roles/ssh_hardening/templates/opensshd.conf.j2
@@ -274,18 +274,6 @@ RevokedKeys /etc/ssh/revoked_keys
 # Subsystem sftp /opt/app/openssh5/libexec/sftp-server
 
 Subsystem sftp internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-
-# These lines must appear at the *end* of sshd_config
-Match Group sftponly
-    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
-{% if sftp_chroot %}
-    ChrootDirectory {{ sftp_chroot_dir }}
-{% endif %}
-    AllowTcpForwarding no
-    AllowAgentForwarding no
-    PasswordAuthentication {{ 'yes' if (sftp_password_login|bool) else 'no' }}
-    PermitRootLogin no
-    X11Forwarding no
 {% endif %}
 {% if ssh_server_match_address %}
 
@@ -335,3 +323,17 @@ Match LocalPort {{ item.port }}
   {% endfor %}
 {% endfor %}
 {% endif %}
+
+{% if sftp_enabled %}
+# These lines must appear at the *end* of sshd_config
+Match Group sftponly
+    ForceCommand internal-sftp -l INFO -f LOCAL6 -u {{ sftp_umask }}
+{% if sftp_chroot %}
+    ChrootDirectory {{ sftp_chroot_dir }}
+{% endif %}
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    PasswordAuthentication {{ 'yes' if (ssh_server_password_login|bool) else 'no' }}
+    PermitRootLogin no
+    X11Forwarding no
+{% endif %}