YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

ssh config: Add ssh_allow_root_on_localnet

Browse source 
A global setting name ssh_allow_root_on_localnet is added
The old sshd_config template enable PermitRootLogin from
client on the localnet. According to the server where Yunohost
is deployed it doesn't make sense and could be a security issue
when hosted on a 3rd party.

Signed-off-by: Nicolas Palix <nicolas.palix@imag.fr>
This commit is contained in:
Nicolas Palix 2022-12-19 21:08:32 +01:00
parent 4a3a9f8064
commit df5b986801
4 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
conf/ssh/sshd_config
View file

@ -100,11 +100,11 @@ Match Group sftp.app,!ssh.app
PermitTunnel no PermitTunnel no
PermitUserRC no PermitUserRC no
PasswordAuthentication {{ password_authentication }} PasswordAuthentication {{ password_authentication }}
{% if allow_root_on_localnet == "true" %}
# root login is allowed on local networks # root login is allowed on local networks
# It's meant to be a backup solution in case LDAP is down and # It's meant to be a backup solution in case LDAP is down and
# user admin can't be used... # user admin can't be used...
# If the server is a VPS, it's expected that the owner of the # If the server is a VPS, it's expected that the owner of the
# server has access to a web console through which to log in. # server has access to a web console through which to log in.
Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8 Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8
PermitRootLogin yes PermitRootLogin yes{% endif %}

1
hooks/conf_regen/03-ssh
View file

@ -18,6 +18,7 @@ do_pre_regen() {
export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')" export compatibility="$(yunohost settings get 'security.ssh.ssh_compatibility')"
export port="$(yunohost settings get 'security.ssh.ssh_port')" export port="$(yunohost settings get 'security.ssh.ssh_port')"
export password_authentication="$(yunohost settings get 'security.ssh.ssh_password_authentication')" export password_authentication="$(yunohost settings get 'security.ssh.ssh_password_authentication')"
export allow_root_on_localnet="$(yunohost settings get 'security.ssh.ssh_allow_root_on_localnet')"
export ssh_keys export ssh_keys
export ipv6_enabled export ipv6_enabled
ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config" ynh_render_template "sshd_config" "${pending_dir}/etc/ssh/sshd_config"

2
locales/en.json
View file

@ -423,6 +423,8 @@
"global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects). See https://infosec.mozilla.org/guidelines/openssh for more info.", "global_settings_setting_ssh_compatibility_help": "Compatibility vs. security tradeoff for the SSH server. Affects the ciphers (and other security-related aspects). See https://infosec.mozilla.org/guidelines/openssh for more info.",
"global_settings_setting_ssh_password_authentication": "Password authentication", "global_settings_setting_ssh_password_authentication": "Password authentication",
"global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH", "global_settings_setting_ssh_password_authentication_help": "Allow password authentication for SSH",
"global_settings_setting_ssh_allow_root_on_localnet": "Permit root from localnet",
"global_settings_setting_ssh_allow_root_on_localnet_help": "Allow root login from the local network",
"global_settings_setting_ssh_port": "SSH port", "global_settings_setting_ssh_port": "SSH port",
"global_settings_setting_ssowat_panel_overlay_enabled": "Enable the small 'YunoHost' portal shortcut square on apps", "global_settings_setting_ssowat_panel_overlay_enabled": "Enable the small 'YunoHost' portal shortcut square on apps",
"global_settings_setting_portal_theme": "Portal theme", "global_settings_setting_portal_theme": "Portal theme",

6
share/config_global.toml
View file

@ -45,6 +45,12 @@ name = "Security"
yes = "yes" yes = "yes"
no = "no" no = "no"
[security.ssh.ssh_allow_root_on_localnet]
type = "boolean"
default = true
yes = "true"
no = "false"
[security.nginx] [security.nginx]
name = "NGINX (web server)" name = "NGINX (web server)"
[security.nginx.nginx_redirect_to_https] [security.nginx.nginx_redirect_to_https]