Merge pull request dev-sec#49 from hardening-io/disable_client_roaming

Disable experimental client roaming.
divialth · Feb 24, 2016 · 78e75f3 · 78e75f3
2 parents c3f0246 + eac2d55
commit 78e75f3
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -74,3 +74,6 @@ sftp_enabled: false
 
 # change default sftp chroot location
 sftp_chroot_dir: /home/%u
+
+# enable experimental client roaming
+ssh_client_roaming: false
diff --git a/templates/openssh.conf.j2 b/templates/openssh.conf.j2
@@ -145,3 +145,6 @@ Compression yes
 
 #EscapeChar ~
 #VisualHostKey yes
+
+# Disable experimental client roaming. This is known to cause potential issues with secrets being disclosed to malicious servers and defaults to being disabled.
+UseRoaming {{ 'yes' if ssh_client_roaming else 'no' }}