From: Julien Cristau <jcristau@debian.org>
Date: Mon, 5 Feb 2018 15:03:51 +0000 (+0100)
Subject: Simplify portforwarder authorized_keys options
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=a433d0c70fc4870cc1a4cb4193d41bff2fc05945;p=mirror%2Fdsa-puppet.git

Simplify portforwarder authorized_keys options

Replace "no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding" with
"restrict" since all hosts using this module are on stretch with new enough
sshd
---

diff --git a/modules/portforwarder/templates/authorized_keys.erb b/modules/portforwarder/templates/authorized_keys.erb
index ec11e54f6..755f344b3 100644
--- a/modules/portforwarder/templates/authorized_keys.erb
+++ b/modules/portforwarder/templates/authorized_keys.erb
@@ -44,7 +44,7 @@ config.each_pair do |sourcehost, services|
 			lines << "# insufficient config values"
 		else
 			command = "/usr/bin/portforwarder-ssh-wrap #{sourcehost} #{local_bind} #{allowed_ports.join(' ')}"
-			lines << "from=\"#{remote_ip}\",command=\"#{command}\",no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding #{sshkey}"
+			lines << "from=\"#{remote_ip}\",command=\"#{command}\",restrict #{sshkey}"
 		end
 	end
 end