andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OpenBSD does not support GSSAPIAuthentication

Browse Source 
... and freaks out when it is mentioned in the config files. So let's
just remove the GSSAPI-stuff.

Signed-off-by: Dennis Eriksen <[email protected]>
This commit is contained in:
Dennis Eriksen committed 2022-11-08 09:12:18 +01:00
1 parent e32d550e9b
commit 681898bd96
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/ssh_hardening/templates/openssh.conf.j2
+3
View File
@@ -106,10 +106,13 @@ RSAAuthentication yes
# Disable password-based authentication, it can allow for potentially easier brute-force attacks. # Disable password-based authentication, it can allow for potentially easier brute-force attacks.
PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }} PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
{% if ansible_facts.os_family != 'OpenBSD' %}
# Only use GSSAPIAuthentication if implemented on the network. # Only use GSSAPIAuthentication if implemented on the network.
GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }} GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }} GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
{% endif %}
# Disable tunneling # Disable tunneling
Tunnel no Tunnel no
roles/ssh_hardening/templates/opensshd.conf.j2
+3
View File
@@ -143,10 +143,13 @@ KerberosTicketCleanup yes
#KerberosGetAFSToken no #KerberosGetAFSToken no
{% endif %} {% endif %}
{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
{% if ansible_facts.os_family != 'OpenBSD' -%}
# Only enable GSSAPI authentication if it is configured. # Only enable GSSAPI authentication if it is configured.
GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }} GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
GSSAPICleanupCredentials yes GSSAPICleanupCredentials yes
{% endif %}
{% if ssh_deny_users %} {% if ssh_deny_users %}
# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here. # In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
# For key-based authentication this is not necessary, since all keys must be explicitely enabled. # For key-based authentication this is not necessary, since all keys must be explicitely enabled.