From 0b180227270cf5d1a5e2176142c2a129940f523a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Fri, 26 Sep 2008 17:55:02 -0400
Subject: add sshd_allow_tcp_forwarding variable, with the default changed to
 no (note this is opposite of what the existing template had enabled for
 Debian, but this is a better setting)

---
 templates/sshd_config/CentOS_normal.erb  | 8 +++++++-
 templates/sshd_config/Debian_normal.erb  | 6 ++++++
 templates/sshd_config/Gentoo_normal.erb  | 7 ++++++-
 templates/sshd_config/OpenBSD_normal.erb | 7 ++++++-
 4 files changed, 25 insertions(+), 3 deletions(-)

(limited to 'templates')

diff --git a/templates/sshd_config/CentOS_normal.erb b/templates/sshd_config/CentOS_normal.erb
index 92ba92e..a0ec786 100644
--- a/templates/sshd_config/CentOS_normal.erb
+++ b/templates/sshd_config/CentOS_normal.erb
@@ -140,7 +140,13 @@ UsePAM no
 AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES 
 AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT 
 AcceptEnv LC_IDENTIFICATION LC_ALL
-#AllowTcpForwarding yes
+
+<%- if real_sshd_tcp_forwarding.to_s == 'yes' then %>
+AllowTcpForwarding yes
+<%- else %>
+AllowTcpForwarding no
+<%- end %>
+
 #GatewayPorts no
 #X11Forwarding no
 <%- if real_sshd_x11_forwarding.to_s == 'yes' then %>
diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb
index 92cb7b0..f6a2a81 100644
--- a/templates/sshd_config/Debian_normal.erb
+++ b/templates/sshd_config/Debian_normal.erb
@@ -138,7 +138,13 @@ UsePAM no
 <%- end %>
 
 HostbasedUsesNameFromPacketOnly yes
+
+<%- if real_sshd_tcp_forwarding.to_s == 'yes' then %>
 AllowTcpForwarding yes
+<%- else %>
+AllowTcpForwarding no
+<%- end %>
+
 <%- if real_sshd_agent_forwarding.to_s == 'yes' then %>
 AllowAgentForwarding yes
 <%- else %>
diff --git a/templates/sshd_config/Gentoo_normal.erb b/templates/sshd_config/Gentoo_normal.erb
index a9f9916..ca6b90a 100644
--- a/templates/sshd_config/Gentoo_normal.erb
+++ b/templates/sshd_config/Gentoo_normal.erb
@@ -139,7 +139,12 @@ UsePAM yes
 UsePAM no
 <%- end %>
 
-#AllowTcpForwarding yes
+<%- if real_sshd_tcp_forwarding.to_s == 'yes' then %>
+AllowTcpForwarding yes
+<%- else %>
+AllowTcpForwarding no
+<%- end %>
+
 #GatewayPorts no
 <%- if real_sshd_x11_forwarding.to_s == 'yes' then %>
 X11Forwarding yes
diff --git a/templates/sshd_config/OpenBSD_normal.erb b/templates/sshd_config/OpenBSD_normal.erb
index dd6bb69..96d8bbd 100644
--- a/templates/sshd_config/OpenBSD_normal.erb
+++ b/templates/sshd_config/OpenBSD_normal.erb
@@ -116,7 +116,12 @@ ChallengeResponseAuthentication no
 #GSSAPIAuthentication no
 #GSSAPICleanupCredentials yes
 
-#AllowTcpForwarding yes
+<%- if real_sshd_tcp_forwarding.to_s == 'yes' then %>
+AllowTcpForwarding yes
+<%- else %>
+AllowTcpForwarding no
+<%- end %>
+
 #GatewayPorts no
 <%- if real_sshd_x11_forwarding.to_s == 'yes' then %>
 X11Forwarding yes
-- 
cgit v1.2.3