YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

[fix] Reduce right given to ynh users with ssh (#1050)

Browse source 
* [fix] Avoid ynh user to be able to use X11 forwarding

* [fix] Avoid some bad situations

* [fix] Remove chroot restrictions and x11 authorization

* Update comments

Co-authored-by: Alexandre Aubin <alex.aubin@mailoo.org>
This commit is contained in:
ljf (zamentur) 2020-09-11 20:27:40 +02:00 • committed by Alexandre Aubin
parent d49f1ce733
commit 1b62ce0240
1 changed files with 13 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
data/templates/ssh/sshd_config
View file

@ -66,12 +66,19 @@ AcceptEnv LANG LC_*
# SFTP stuff # SFTP stuff
Subsystem sftp internal-sftp Subsystem sftp internal-sftp
Match User sftpusers
ForceCommand internal-sftp # Forbid users from using their account SSH as a VPN (even if SSH login is disabled)
ChrootDirectory /home/%u AllowTcpForwarding no
AllowTcpForwarding no AllowStreamLocalForwarding no
GatewayPorts no
X11Forwarding no # Disable .ssh/rc, which could be edited (e.g. from Nextcloud or whatever) by users to execute arbitrary commands even if SSH login is disabled
PermitUserRC no
Match User admin,root
AllowTcpForwarding yes
AllowStreamLocalForwarding yes
PermitUserRC yes
# root login is allowed on local networks # root login is allowed on local networks
# It's meant to be a backup solution in case LDAP is down and # It's meant to be a backup solution in case LDAP is down and