YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

regenconf: Add a new ssh security setting to hide the banner

Browse source
This commit is contained in:
Étienne Deparis 2023-02-21 20:50:49 +01:00
parent 90b8e78eff
commit 2145b9cbee
3 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
conf/ssh/sshd_config
View file

@ -64,7 +64,13 @@ PasswordAuthentication no
{% endif %} {% endif %}
# Post-login stuff # Post-login stuff
# PLEASE: if you wish to hide the system name and version when attempting to connect to your server, run this command:
# yunohost settings set security.ssh.ssh_banner -v no
{% if banner == "False" %}
#Banner none
{% else %}
Banner /etc/issue.net Banner /etc/issue.net
{% endif %}
PrintMotd no PrintMotd no
PrintLastLog yes PrintLastLog yes
ClientAliveInterval 60 ClientAliveInterval 60

1
hooks/conf_regen/03-ssh
View file

@ -18,6 +18,7 @@ do_pre_regen() {
export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')" export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')"
export port="$(yunohost settings get 'security.ssh.ssh_port')" export port="$(yunohost settings get 'security.ssh.ssh_port')"
export password_authentication="$(yunohost settings get 'security.ssh.ssh_password_authentication' | int_to_bool)" export password_authentication="$(yunohost settings get 'security.ssh.ssh_password_authentication' | int_to_bool)"
export banner="$(yunohost settings get 'security.ssh.ssh_banner')"
export ssh_keys export ssh_keys
export ipv6_enabled export ipv6_enabled
ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config" ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"

4
share/config_global.toml
View file

@ -43,6 +43,10 @@ name = "Security"
type = "boolean" type = "boolean"
default = true default = true
[security.ssh.ssh_banner]
type = "boolean"
default = true
[security.nginx] [security.nginx]
name = "NGINX (web server)" name = "NGINX (web server)"
[security.nginx.nginx_redirect_to_https] [security.nginx.nginx_redirect_to_https]