Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-09-20 05:11:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #598 from dennisse/master

Browse source 
OpenBSD does not support GSSAPI Authentication
This commit is contained in:
schurzi 2022-11-08 10:26:42 +01:00 committed by GitHub
commit d982a89cc1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
roles/ssh_hardening/templates/openssh.conf.j2
View file

@ -106,10 +106,13 @@ RSAAuthentication yes
# Disable password-based authentication, it can allow for potentially easier brute-force attacks.
PasswordAuthentication {{ 'yes' if ssh_client_password_login else 'no' }}
{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
{% if ansible_facts.os_family != 'OpenBSD' %}
# Only use GSSAPIAuthentication if implemented on the network.
GSSAPIAuthentication {{ 'yes' if (ssh_gssapi_support|bool) else 'no' }}
GSSAPIDelegateCredentials {{ 'yes' if (ssh_gssapi_delegation|bool) else 'no' }}
{% endif %}
# Disable tunneling
Tunnel no

3
roles/ssh_hardening/templates/opensshd.conf.j2
View file

@ -143,10 +143,13 @@ KerberosTicketCleanup yes
#KerberosGetAFSToken no
{% endif %}
{# OpenBSD does not support GSSAPIAuthentication, so leave this out if on OpenBSD #}
{% if ansible_facts.os_family != 'OpenBSD' -%}
# Only enable GSSAPI authentication if it is configured.
GSSAPIAuthentication {{ 'yes' if ssh_gssapi_support else 'no' }}
GSSAPICleanupCredentials yes
{% endif %}
{% if ssh_deny_users %}
# In case you don't use PAM (`UsePAM no`), you can alternatively restrict users and groups here.
# For key-based authentication this is not necessary, since all keys must be explicitely enabled.