From cb85a99e22f345b18ac644a22252387ff718259f Mon Sep 17 00:00:00 2001 From: Shizzlebix Date: Mon, 11 Nov 2024 19:52:38 +0100 Subject: [PATCH] adding switch for ForwardAgent in ssh_config (#818) * Update openssh.conf.j2 add switch for FowardAgent * Update openssh.conf.j2 fix typo * Update openssh.conf.j2 change ssh_ForwardAgent to ssh_forward_agent * Update argument_specs.yml adding context for ssh_forward_agent --- roles/ssh_hardening/meta/argument_specs.yml | 3 +++ roles/ssh_hardening/templates/openssh.conf.j2 | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/roles/ssh_hardening/meta/argument_specs.yml b/roles/ssh_hardening/meta/argument_specs.yml index ad95e387..d1d415a3 100644 --- a/roles/ssh_hardening/meta/argument_specs.yml +++ b/roles/ssh_hardening/meta/argument_specs.yml @@ -365,3 +365,6 @@ argument_specs: default: sandbox description: Specifies whether sshd separates privileges by creating an unprivileged child process to deal with incoming network traffic. + ssh_forward_agent: + default: 'no' + description: Enables the ssh forward agent for the Cli if set to 'yes' diff --git a/roles/ssh_hardening/templates/openssh.conf.j2 b/roles/ssh_hardening/templates/openssh.conf.j2 index e8c91145..170321ae 100644 --- a/roles/ssh_hardening/templates/openssh.conf.j2 +++ b/roles/ssh_hardening/templates/openssh.conf.j2 @@ -90,7 +90,9 @@ StrictHostKeyChecking ask {% endif %} # Disable agent forwarding, since local agent could be accessed through forwarded connection. -ForwardAgent no + +ForwardAgent {{ ((ssh_forward_agent) if ssh_forward_agent is defined else 'no')}} + # Disable X11 forwarding, since local X11 display could be accessed through forwarded connection. ForwardX11 no