Skip to content

[ssh_hardening] AllowUsers passing user with brackets #838

Open
@Dan-Sun

Description

@Dan-Sun

Description

I use the the variable ssh_allow_users for a debian system:

ssh_allow_users: 
      - "{{ ansible_user }}"
      - user2
      - user3

The outcome is AllowUsers ['user1', 'user2', 'user3'] which doesn't work on my end.
It would work like AllowUsers user1 user2 user3.

Reproduction steps

Add the variable:

ssh_allow_users: 
      - "{{ ansible_user }}"
      - user2
      - user3


### Current Behavior

The out come is `AllowUsers ['user1', 'user2', 'user3']` which doesn't work on my side.

### Expected Behavior

It would work like `AllowUsers user1 user2 user3`.

### OS / Environment

The target is a fresh installed Debian minimal system. Coming from an Arch system.

### Ansible Version

```Shell
2.18.1

Collection Version

10.2.0

Additional information

...

Activity

self-assigned this
on Jan 13, 2025
schurzi

schurzi commented on Jan 13, 2025

@schurzi
Contributor

Thanks for the report.

We documented that parameter as string, so a list is not expected here.

  • ssh_allow_users
    • Default: ``
    • Description: if specified, login is allowed only for user names that match one of the patterns.
    • Type: str

To fix your problem, you need to convert the list to a string in your vars. e.g.:

ssh_allow_users: "{{ ansible_user }} user2 user3"

Your use-case seems reasonable though. Let me think a bit on how to support that, this might be a good addition to our collection.

Dan-Sun

Dan-Sun commented on Feb 4, 2025

@Dan-Sun
Author

Thanks!

I should read it properly ;)
I'm happy with that solution.

I'll leave the issue open.

linked a pull request that will close this issue on Feb 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Participants

    @schurzi@Dan-Sun

    Issue actions

      [ssh_hardening] AllowUsers passing user with brackets · Issue #838 · dev-sec/ansible-collection-hardening