YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

[enh] Manage SSH PasswordAuthentication setting

Browse source
This commit is contained in:
ljf 2021-12-06 23:01:06 +01:00
parent 47f3c00d0c
commit 4106ed669e
3 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
data/hooks/conf_regen/03-ssh
View file

@ -26,6 +26,7 @@ do_pre_regen() {
# Support different strategy for security configurations # Support different strategy for security configurations
export compatibility="$(yunohost settings get 'security.ssh.compatibility')" export compatibility="$(yunohost settings get 'security.ssh.compatibility')"
export port="$(yunohost settings get 'security.ssh.port')" export port="$(yunohost settings get 'security.ssh.port')"
export password_authentication="$(yunohost settings get 'security.ssh.password_authentication')"
export ssh_keys export ssh_keys
export ipv6_enabled export ipv6_enabled
ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config" ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"

10
data/templates/ssh/sshd_config
View file

@ -2,6 +2,8 @@
# by YunoHost # by YunoHost
Protocol 2 Protocol 2
# PLEASE: to change ssh port properly in YunoHost, use this command
# yunohost settings set security.ssh.port -v <port>
Port {{ port }} Port {{ port }}
{% if ipv6_enabled == "true" %}ListenAddress ::{% endif %} {% if ipv6_enabled == "true" %}ListenAddress ::{% endif %}
@ -53,9 +55,13 @@ PermitEmptyPasswords no
ChallengeResponseAuthentication no ChallengeResponseAuthentication no
UsePAM yes UsePAM yes
# Change to no to disable tunnelled clear text passwords # PLEASE: to force everybody to authenticate using ssh keys, run this command:
# (i.e. everybody will need to authenticate using ssh keys) # yunohost settings set security.ssh.password_authentication -v no
{% if password_authentication == "True" %}
#PasswordAuthentication yes #PasswordAuthentication yes
{% else %}
PasswordAuthentication no
{% endif %}
# Post-login stuff # Post-login stuff
Banner /etc/issue.net Banner /etc/issue.net

5
src/yunohost/settings.py
View file

@ -81,6 +81,10 @@ DEFAULTS = OrderedDict(
"security.ssh.port", "security.ssh.port",
{"type": "int", "default": 22}, {"type": "int", "default": 22},
), ),
(
"security.ssh.password_authentication",
{"type": "bool", "default": True},
),
( (
"security.nginx.redirect_to_https", "security.nginx.redirect_to_https",
{ {
@ -420,6 +424,7 @@ def reconfigure_nginx_and_yunohost(setting_name, old_value, new_value):
@post_change_hook("security.ssh.compatibility") @post_change_hook("security.ssh.compatibility")
@post_change_hook("security.ssh.password_authentication")
def reconfigure_ssh(setting_name, old_value, new_value): def reconfigure_ssh(setting_name, old_value, new_value):
if old_value != new_value: if old_value != new_value:
regen_conf(names=["ssh"]) regen_conf(names=["ssh"])