From 7d1da63c94e4a7e24bd7503f76b5002500f8ebfa Mon Sep 17 00:00:00 2001 From: Cristian Baldi Date: Wed, 23 Nov 2022 13:45:01 +0100 Subject: [PATCH] Allow ssh_allow_tcp_forwarding to be a boolean (#600) * Allow ssh_allow_tcp_forwarding to be a boolean Signed-off-by: Cristian Baldi * Update documentation related to ssh_allow_tcp_forwarding Signed-off-by: Cristian Baldi Signed-off-by: Cristian Baldi --- roles/ssh_hardening/README.md | 2 +- roles/ssh_hardening/templates/opensshd.conf.j2 | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/ssh_hardening/README.md b/roles/ssh_hardening/README.md index 18a0d3a2..85185946 100644 --- a/roles/ssh_hardening/README.md +++ b/roles/ssh_hardening/README.md @@ -64,7 +64,7 @@ As this role requires root-privileges, we added `become: true` to all tasks. So - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required! - `ssh_allow_tcp_forwarding` - Default: `no` - - Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
_Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes. + - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. - `ssh_gateway_ports` - Default: `false` - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to. diff --git a/roles/ssh_hardening/templates/opensshd.conf.j2 b/roles/ssh_hardening/templates/opensshd.conf.j2 index 7e9b1f8c..f3fea445 100644 --- a/roles/ssh_hardening/templates/opensshd.conf.j2 +++ b/roles/ssh_hardening/templates/opensshd.conf.j2 @@ -197,9 +197,9 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }} # Disable forwarding tcp connections. # no real advantage without denied shell access {% if sshd_version is version('6.2', '>=') %} -AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }} +AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }} {% else %} -AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }} +AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }} {% endif %} # Disable agent forwarding, since local agent could be accessed through forwarded connection.