From 3bd90d741c35ae242befd955566e3f28cf76b81b Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Fri, 26 Sep 2008 16:57:59 -0400
Subject: Add the variable AllowAgentForwarding to be set, with the default of
 'no', only the Debian template was adjusted for this, as my knowledge of the
 other operating systems is not good enough to determine the appropriate
 setting there

---
 manifests/init.pp                       | 7 +++++++
 templates/sshd_config/Debian_normal.erb | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/manifests/init.pp b/manifests/init.pp
index 95682fd..4e796f3 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -43,6 +43,9 @@
 #                               Valid Values: yes or no
 #                               Default: no
 #
+# sshd_agent_forwarding:	If you want to allow ssh-agent forwarding
+# 				Valid Values: yes or no
+#				Default: no
 
 class sshd {
     include sshd::client 
@@ -81,6 +84,10 @@ class sshd::base {
         '' => 'no',
         default => $sshd_x11_forwarding
     }
+    $real_sshd_agent_forwarding = $sshd_agent_forwarding ? {
+    	'' => 'no',
+	default => $sshd_agent_forwarding
+    }
 
     file { 'sshd_config':
         path => '/etc/ssh/sshd_config',
diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb
index 70c1a34..989fa62 100644
--- a/templates/sshd_config/Debian_normal.erb
+++ b/templates/sshd_config/Debian_normal.erb
@@ -94,9 +94,15 @@ UsePAM no
 
 HostbasedUsesNameFromPacketOnly yes
 AllowTcpForwarding yes
+<%- if real_sshd_agent_forwarding.to_s == 'yes' then %>
+AllowAgentForwarding yes
+<%- else %>
+AllowAgentForwarding no
+<%- end %>
 
 ChallengeResponseAuthentication no
 
 <%- unless real_sshd_allowed_users.to_s.empty? then %>
 AllowUsers <%= real_sshd_allowed_users %>
 <%- end %>
+
-- 
cgit v1.2.3