From: Julien Cristau <jcristau@debian.org>
Date: Mon, 5 Feb 2018 16:29:31 +0000 (+0100)
Subject: Use "restrict" key option for buildd access to upload hosts
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=556eff26b9addd806abc9b4acc6abc90ee30f217;p=mirror%2Fdsa-puppet.git

Use "restrict" key option for buildd access to upload hosts
---

diff --git a/modules/roles/templates/ssh_upload_buildd-uploader-authorized_keys.erb b/modules/roles/templates/ssh_upload_buildd-uploader-authorized_keys.erb
index 8dccbfb40..ad506d04b 100644
--- a/modules/roles/templates/ssh_upload_buildd-uploader-authorized_keys.erb
+++ b/modules/roles/templates/ssh_upload_buildd-uploader-authorized_keys.erb
@@ -30,7 +30,7 @@ for m in buildds do
     lines << "## no key for node"
   else
     lines << "command=\"/home/buildd-uploader/rsync-ssh-wrap #{m['node'].split('.')[0]}\"," +
-             'no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-user-rc,' +
+             'restrict,' +
              'from="' + m['addr'].join(',') + '" ' +
              m['key']
   end