X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;ds=sidebyside;f=modules%2Fssh%2Ftemplates%2Fsshd_config.erb;h=ea08324f090ec31c80d232180d6b0dc5ae0ed1ec;hb=f1baa5185956fbd4be6916ffcf95b384cd4e054a;hp=7a8ff877cbc900b5cd7c0f861fd7838a742bff41;hpb=249b713a08d35bffb1cd52739be6f5808baa5a5f;p=mirror%2Fdsa-puppet.git diff --git a/modules/ssh/templates/sshd_config.erb b/modules/ssh/templates/sshd_config.erb index 7a8ff877c..ea08324f0 100644 --- a/modules/ssh/templates/sshd_config.erb +++ b/modules/ssh/templates/sshd_config.erb @@ -3,10 +3,6 @@ ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git ## -# Package generated configuration file -# See the sshd(8) manpage for details - -# What ports, IPs and protocols we listen for Port 22 <%= extraports = case @fqdn when "paradis.debian.org" then " @@ -19,70 +15,30 @@ ListenAddress [2001:41c8:1000:21::21:31]:443 extraports %> # Use these options to restrict which interfaces/protocols sshd will bind to -#ListenAddress :: -#ListenAddress 0.0.0.0 Protocol 2 -# HostKeys for protocol version 2 + HostKey /etc/ssh/ssh_host_rsa_key -<%- if has_variable?("has_etc_ssh_ssh_host_ed25519_key") && @has_etc_ssh_ssh_host_ed25519_key == "true" -%> +<%- if has_variable?("has_etc_ssh_ssh_host_ed25519_key") && @has_etc_ssh_ssh_host_ed25519_key -%> HostKey /etc/ssh/ssh_host_ed25519_key <% end %> -#Privilege Separation is turned on for security -UsePrivilegeSeparation yes - -# Lifetime and size of ephemeral version 1 server key -KeyRegenerationInterval 3600 -ServerKeyBits 1024 +<% if scope.function_has_role(['ssh.upload.d.o']) -%> +# On ssh upload hosts we have many clients doing ssh connections to us. +# sshd has - by default - a limit of 10 on the number of currently +# unauthenticated (or not yet authenticated) connections. Raise that limit. +MaxStartups 100:30:200 +<% end %> -# Logging -SyslogFacility AUTH -LogLevel INFO +LogLevel VERBOSE # Authentication: -LoginGraceTime 120 PermitRootLogin without-password -StrictModes yes - -RSAAuthentication yes -PubkeyAuthentication yes - -# Don't read the user's ~/.rhosts and ~/.shosts files -IgnoreRhosts yes -# For this to work you will also need host keys in /etc/ssh_known_hosts -RhostsRSAAuthentication no -# similar for protocol version 2 -HostbasedAuthentication no -# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#IgnoreUserKnownHosts yes -# To enable empty passwords, change to yes (NOT RECOMMENDED) -PermitEmptyPasswords no - -# Change to yes to enable challenge-response passwords (beware issues with -# some PAM modules and threads) ChallengeResponseAuthentication no -# Kerberos options -#KerberosAuthentication no -#KerberosGetAFSToken no -#KerberosOrLocalPasswd yes -#KerberosTicketCleanup yes - -# GSSAPI options -#GSSAPIAuthentication no -#GSSAPICleanupCredentials yes - -X11Forwarding no -X11DisplayOffset 10 PrintMotd no -PrintLastLog yes -TCPKeepAlive yes -#UseLogin no #MaxStartups 10:30:60 -#Banner /etc/issue.net -# Allow client to pass locale environment variables AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server @@ -92,3 +48,26 @@ UsePAM yes AuthorizedKeysFile /etc/ssh/userkeys/%u /var/lib/misc/userkeys/%u /etc/ssh/userkeys/%u.more PasswordAuthentication no + +# Match Address <%= + allnodeinfo = scope.lookupvar('site::allnodeinfo') + dbs = [] + allnodeinfo.keys.sort.each do |node| + next unless allnodeinfo[node].has_key?('ipHostNumber') + allnodeinfo[node]['ipHostNumber'].each do |ipnum| + if ipnum =~ /:/ + dbs << "#{ipnum}/128" + else + dbs << "#{ipnum}/32" + end + end + end + dbs.flatten.join(',') +%> +# Banner "You're coming from a debian.org host." + +Match Group sftponly + AllowStreamLocalForwarding no + AllowTCPForwarding no + X11Forwarding no + ForceCommand internal-sftp