YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

ssh config: Fix handling of ssh_password_authentication

Browse source 
The current template use if/else/endif which introduce
spurious empty lines. As the setting value is "yes" or "no", as expected
by the configuration file, the value is directly use.

All uses of passwordauthentication are addressed. This adds the one
used for the sftp group.

Finally, the global configuration sets the yes and no values
to "yes" and "no" respectively. Currently, the value is set to "0"
which breaks the configuration generation when "0" is compared to "False".

Signed-off-by: Nicolas Palix <nicolas.palix@imag.fr>
This commit is contained in:
Nicolas Palix 2022-12-19 18:38:08 +01:00
parent 80a060dd94
commit 4a3a9f8064
2 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
conf/ssh/sshd_config
View file

@ -57,11 +57,7 @@ UsePAM yes
# PLEASE: if you wish to force everybody to authenticate using ssh keys, run this command: # PLEASE: if you wish to force everybody to authenticate using ssh keys, run this command:
# yunohost settings set security.ssh.ssh_password_authentication -v no # yunohost settings set security.ssh.ssh_password_authentication -v no
{% if password_authentication == "False" %} PasswordAuthentication {{ password_authentication }}
PasswordAuthentication no
{% else %}
#PasswordAuthentication yes
{% endif %}
# Post-login stuff # Post-login stuff
Banner /etc/issue.net Banner /etc/issue.net
@ -103,7 +99,7 @@ Match Group sftp.app,!ssh.app
AllowStreamLocalForwarding no AllowStreamLocalForwarding no
PermitTunnel no PermitTunnel no
PermitUserRC no PermitUserRC no
PasswordAuthentication yes PasswordAuthentication {{ password_authentication }}
# root login is allowed on local networks # root login is allowed on local networks
# It's meant to be a backup solution in case LDAP is down and # It's meant to be a backup solution in case LDAP is down and

2
share/config_global.toml
View file

@ -42,6 +42,8 @@ name = "Security"
[security.ssh.ssh_password_authentication] [security.ssh.ssh_password_authentication]
type = "boolean" type = "boolean"
default = true default = true
yes = "yes"
no = "no"
[security.nginx] [security.nginx]
name = "NGINX (web server)" name = "NGINX (web server)"