Add support for GatewayPorts

Oefenweb · Jan 3, 2018 · 1a414ed · 1a414ed
1 parent dffdbf2
commit 1a414ed
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -40,6 +40,7 @@ None
 * `ssh_server_kerberos_ticket_cleanup`: [optional, default: `true`]: Specifies whether to automatically destroy the user's ticket cache file on logout
 * `ssh_server_gssapi_authentication`: [optional, default: `false`]: Specifies whether user authentication based on GSSAPI is allowed
 * `ssh_server_gssapi_cleanup_credentials`: [optional, default: `true`]: Specifies whether to automatically destroy the user's credentials cache on logout
+* `ssh_server_gateway_ports`: [optional, default: `false`]: Specifies whether remote hosts are allowed to connect to local forwarded ports
 * `ssh_server_x11_forwarding`: [default: `true`]: Specifies whether X11 forwarding is permitted
 * `ssh_server_x11_display_offset`: [default: `10`]: Specifies the first display number available for `sshd`'s X11 forwarding. This prevents `sshd` from interfering with real X11 servers
 * `ssh_server_print_motd`: [default: `false`]: Specifies whether `sshd` should print `/etc/motd` when a user logs in interactively

diff --git a/defaults/main.yml b/defaults/main.yml
@@ -30,6 +30,7 @@ ssh_server_ignore_user_known_hosts: false
 ssh_server_permit_empty_passwords: false
 ssh_server_challenge_response_authentication: false
 ssh_server_password_authentication: true
+ssh_server_gateway_ports: false
 ssh_server_x11_forwarding: true
 ssh_server_x11_display_offset: 10
 ssh_server_print_motd: false

diff --git a/templates/etc/ssh/sshd_config.j2 b/templates/etc/ssh/sshd_config.j2
@@ -79,6 +79,7 @@ GSSAPICleanupCredentials {{ 'yes' if ssh_server_gssapi_cleanup_credentials else
 
 X11Forwarding {{ 'yes' if ssh_server_x11_forwarding else 'no' }}
 X11DisplayOffset {{ ssh_server_x11_display_offset }}
+GatewayPorts {{ 'yes' if ssh_server_gateway_ports else 'no' }}
 PrintMotd {{ 'yes' if ssh_server_print_motd else 'no' }}
 PrintLastLog {{ 'yes' if ssh_server_print_last_log else 'no' }}
 TCPKeepAlive {{ 'yes' if ssh_server_tcp_keep_alive else 'no' }}