diff options
| author |  Johannes Christ <[email protected]> | 2024-05-01 18:35:53 +0200 |
|---|---|---|
| committer | jchristgit <[email protected]> | 2024-05-01 18:44:56 +0200 |
| commit | ff5f3d8b8957295d7d1ed2c9f51cf9e15c42eda6 (patch) | |
| tree | c1a7fd317d3c450b10649f9e37088ad2a4aa6628 /ansible/roles/pydis-users | |
| parent | Depend on ansible-core instead of Ansible (diff) | |
Harden SSH security and prevent some misconfigurations
Disable agent forwarding and X11 forwarding in the default
configuration. Users can still forward this if they really want to by
installing a custom forwarder and utilizing their shell access to spawn
it, but with this, we're making it impossible for people to accidentally
forward their agent or their X socket to the remote server.
Additionally, change the SSH configuration such that only the Python
Discord users are allowed to log in.
Diffstat (limited to 'ansible/roles/pydis-users')
| -rw-r--r-- | ansible/roles/pydis-users/meta/main.yml | 3 | ||||
| -rw-r--r-- | ansible/roles/pydis-users/tasks/main.yml | 15 |
2 files changed, 18 insertions, 0 deletions
diff --git a/ansible/roles/pydis-users/meta/main.yml b/ansible/roles/pydis-users/meta/main.yml new file mode 100644 index 0000000..5526b6b --- /dev/null +++ b/ansible/roles/pydis-users/meta/main.yml @@ -0,0 +1,3 @@ +--- +dependencies: + - ssh diff --git a/ansible/roles/pydis-users/tasks/main.yml b/ansible/roles/pydis-users/tasks/main.yml index 8378af8..c9642d7 100644 --- a/ansible/roles/pydis-users/tasks/main.yml +++ b/ansible/roles/pydis-users/tasks/main.yml @@ -25,3 +25,18 @@ loop: "{{ pydis_users__users | dict2items }}" tags: - role::pydis-users + +- name: Allow SSH logins for pydis users + ansible.builtin.copy: + content: | + # Ansible managed + + AllowUsers {{ pydis_users__users | sort | join(' ') }} + dest: /etc/ssh/sshd_config.d/pydis-users-login.conf + owner: root + group: root + mode: "0444" + notify: + - Reload ssh + tags: + - role::pydis-users |