Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Extend GSSAPI configuration support to ssh_config #403

Merged
merged 3 commits into from
Feb 15, 2021
Merged

Extend GSSAPI configuration support to ssh_config #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8baab75
Extend GSSAPI configuration support to ssh_config
wzzrd Feb 12, 2021
54c8e6a
Split off ssh_gssapi_delegation into own variable
wzzrd Feb 14, 2021
64713ce
add default for new variable
schurzi Feb 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 4 additions & 1 deletion roles/ssh_hardening/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,10 @@ Warning: This role disables root-login on the target server! Please make sure yo
- Description: false to disable pam authentication.
- `ssh_gssapi_support`
- Default: `false`
- Description: true if SSH has GSSAPI support.
- Description: Set to true to enable GSSAPI authentication (both client and server).
- `ssh_gssapi_delegation`
- Default: `false`
- Description: Set to true to enable GSSAPI credential forwarding.
- `ssh_kerberos_support`
- Default: `true`
- Description: true if SSH has Kerberos support.
Expand Down
5 changes: 4 additions & 1 deletion roles/ssh_hardening/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,9 +91,12 @@ ssh_use_pam: true # sshd
# specify AuthenticationMethods
sshd_authenticationmethods: 'publickey'

# true if SSH support GSSAPI
# Set to true to enable GSSAPI authentication (both client and server)
ssh_gssapi_support: false

# Set to true to enable GSSAPI credential forwarding
ssh_gssapi_delegation: false

# if specified, login is disallowed for user names that match one of the patterns.
ssh_deny_users: '' # sshd

Expand Down
4 changes: 2 additions & 2 deletions roles/ssh_hardening/templates/openssh.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,8 +104,8 @@ RSAAuthentication yes
PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}

# Only use GSSAPIAuthentication if implemented on the network.
GSSAPIAuthentication no
GSSAPIDelegateCredentials no
GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}

# Disable tunneling
Tunnel no
Expand Down