andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow ssh_allow_tcp_forwarding to be a boolean (#600)

Browse Source 
* Allow ssh_allow_tcp_forwarding to be a boolean

Signed-off-by: Cristian Baldi <[email protected]>

* Update documentation related to ssh_allow_tcp_forwarding

Signed-off-by: Cristian Baldi <[email protected]>

Signed-off-by: Cristian Baldi <[email protected]>
This commit is contained in:
Cristian Baldi authored and GitHub committed 2022-11-23 13:45:01 +01:00
1 parent 03f3974f37
commit 7d1da63c94
2 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/ssh_hardening/README.md
+1 -1
View File
@@ -64,7 +64,7 @@ As this role requires root-privileges, we added `become: true` to all tasks. So
- Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required! - Description: Disable root-login. Set to `'without-password'` or `'yes'` to enable root-login - The quotes are required!
- `ssh_allow_tcp_forwarding` - `ssh_allow_tcp_forwarding`
- Default: `no` - Default: `no`
- Description: `'no'` to disable TCP Forwarding. Set to `'yes'` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`. <br> _Note_: values passed to this variable must be strings, thus values `'yes'`and`'no'` should be passed with quotes. - Description: `'no'` or `False` to disable TCP Forwarding. Set to `'yes'` or `True` to allow TCP Forwarding. If you are using OpenSSH >= 6.2 version, you can specify `'yes'`, `'no'`, `'all'`, `'local'`or`'remote'`.
- `ssh_gateway_ports` - `ssh_gateway_ports`
- Default: `false` - Default: `false`
- Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to. - Description: `false` to disable binding forwarded ports to non-loopback addresses. Set to `true` to force binding on wildcard address. Set to `clientspecified` to allow the client to specify which address to bind to.
roles/ssh_hardening/templates/opensshd.conf.j2
+2 -2
View File
@@ -197,9 +197,9 @@ PermitTunnel {{ 'yes' if (ssh_permit_tunnel|bool) else 'no' }}
# Disable forwarding tcp connections. # Disable forwarding tcp connections.
# no real advantage without denied shell access # no real advantage without denied shell access
{% if sshd_version is version('6.2', '>=') %} {% if sshd_version is version('6.2', '>=') %}
AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else 'no' }} AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no', 'local', 'all', 'remote')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
{% else %} {% else %}
AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else 'no' }} AllowTcpForwarding {{ ssh_allow_tcp_forwarding if (ssh_allow_tcp_forwarding in ('yes', 'no')) else ('yes' if (ssh_allow_tcp_forwarding|bool) else 'no') }}
{% endif %} {% endif %}
# Disable agent forwarding, since local agent could be accessed through forwarded connection. # Disable agent forwarding, since local agent could be accessed through forwarded connection.