aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMicah Anderson <micah@riseup.net>2008-09-26 16:57:59 -0400
committerMicah Anderson <micah@riseup.net>2008-09-26 16:57:59 -0400
commit3bd90d741c35ae242befd955566e3f28cf76b81b (patch)
tree54cad414540edc469a350b657dbebc10340eb45e
parente3ce449ff48f8245f7358cd98b59a86d8ddbf9bf (diff)
downloadpuppet-sshd-3bd90d741c35ae242befd955566e3f28cf76b81b.tar.gz
puppet-sshd-3bd90d741c35ae242befd955566e3f28cf76b81b.tar.bz2
Add the variable AllowAgentForwarding to be set, with the default of 'no', only the Debian
template was adjusted for this, as my knowledge of the other operating systems is not good enough to determine the appropriate setting there
-rw-r--r--manifests/init.pp7
-rw-r--r--templates/sshd_config/Debian_normal.erb6
2 files changed, 13 insertions, 0 deletions
diff --git a/manifests/init.pp b/manifests/init.pp
index 95682fd..4e796f3 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -43,6 +43,9 @@
# Valid Values: yes or no
# Default: no
#
+# sshd_agent_forwarding: If you want to allow ssh-agent forwarding
+# Valid Values: yes or no
+# Default: no
class sshd {
include sshd::client
@@ -81,6 +84,10 @@ class sshd::base {
'' => 'no',
default => $sshd_x11_forwarding
}
+ $real_sshd_agent_forwarding = $sshd_agent_forwarding ? {
+ '' => 'no',
+ default => $sshd_agent_forwarding
+ }
file { 'sshd_config':
path => '/etc/ssh/sshd_config',
diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb
index 70c1a34..989fa62 100644
--- a/templates/sshd_config/Debian_normal.erb
+++ b/templates/sshd_config/Debian_normal.erb
@@ -94,9 +94,15 @@ UsePAM no
HostbasedUsesNameFromPacketOnly yes
AllowTcpForwarding yes
+<%- if real_sshd_agent_forwarding.to_s == 'yes' then %>
+AllowAgentForwarding yes
+<%- else %>
+AllowAgentForwarding no
+<%- end %>
ChallengeResponseAuthentication no
<%- unless real_sshd_allowed_users.to_s.empty? then %>
AllowUsers <%= real_sshd_allowed_users %>
<%- end %>
+