confdroid/confdroid_ssh
1
0
Fork 0
Code Issues Projects Wiki Activity

OP#575 add more params

Browse Source
This commit is contained in:
Arne Teuke
2026-04-13 15:51:49 +02:00
parent c8139772a2
commit ceeb28aa1f
2 changed files with 130 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

109
manifests/params.pp
View File

@@ -95,6 +95,95 @@
# related to PasswordAuthentication and KbdInteractiveAuthentication, and
# should be set to 'yes' only if you want to use PAM for authentication
# together with those settings.
# @param [String] ssh_allow_agent_forwarding setting for sshd_config.
# Default is 'yes', which allows SSH agent forwarding, but can be set to 'no'
# if you want to disable this feature for security reasons.
# @param [String] ssh_allow_tcp_forwarding setting for sshd_config.
# Default is 'yes', which allows TCP forwarding, but can be set to 'no'
# if you want to disable this feature for security reasons.
# @param [String] ssh_gateway_ports setting for sshd_config.
# Default is 'no', which means that remote hosts cannot connect to
# forwarded ports, but can be set to 'yes' or 'clientspecified' if you want
# to allow remote hosts to connect to forwarded ports. This setting should
# be used with caution if enabled, as it can introduce security risks.
# @param [String] ssh_x11_forwarding setting for sshd_config.
# Default is 'no', which disables X11 forwarding, but can be set to 'yes'
# if you want to allow X11 forwarding. This setting should be used with
# caution if enabled.
# @param [String] ssh_x11_display_offset setting for sshd_config.
# Default is '10'. This setting is only relevant if X11 forwarding is
# enabled, and specifies the first display number available for X11
# forwarding. The default of '10' means that the first forwarded display
# will be :10, the second will be :11, and so on. This setting can be
# adjusted if you want to use a different range of display numbers for
# X11 forwarding.
# @param [String] ssh_x11_use_localhost setting for sshd_config.
# Default is 'yes', which means that X11 forwarding will only be
# available on the loopback interface, but can be set to 'no' if you want
# to allow X11 forwarding on all network interfaces.
# @param [String] ssh_permit_tty setting for sshd_config.
# Default is 'yes', which allows TTY allocation, but can be set to 'no'
# if you want to disable TTY allocation.
# @param [String] ssh_print_motd setting for sshd_config.
# Default is 'yes', which means that the message of the day will be printed
# when users log in, but can be set to 'no' if you want to disable this feature.
# @param [String] ssh_print_lastlog setting for sshd_config.
# Default is 'yes', which means that the last login information will be printed
# when users log in, but can be set to 'no' if you want to disable this feature.
# @param [String] ssh_tcp_keepalive setting for sshd_config.
# Default is 'yes', which means that TCP keepalive messages will be sent, but
# can be set to 'no' if you want to disable this feature. This setting can
# be useful to disable if you have issues with dropped connections, but in
# general it is recommended to keep it enabled.
# @param [String] ssh_permit_user_environment setting for sshd_config.
# Default is 'no', which means that user environment variables will not be
# processed, but can be set to 'yes' if you want to allow users to specify
# environment variables in their ~/.ssh/environment file.
# @param [String] ssh_compression setting for sshd_config.
# Default is 'delayed', which means that compression will be enabled after
# successful authentication, but can be set to 'yes' if you want to enable
# compression from the start of the connection. The 'delayed' setting is a
# good compromise that allows for faster authentication while still providing
# the benefits of compression for the rest of the session.
# @param [String] ssh_client_alive_interval setting for sshd_config.
# Default is '0', which means that no keepalive messages will be sent by the
# server, but can be set to a positive integer to specify the interval in seconds
# between keepalive messages sent by the server to the client. This can be useful
# to detect and close stale connections, but should be used with caution as it can
# cause unexpected disconnections if set too aggressively.
# @param [String] ssh_client_alive_count_max setting for sshd_config.
# Default is '3'. This setting is only relevant if ssh_client_alive_interval is set
# to a positive integer, and specifies the number of consecutive keepalive messages
# that can be sent without receiving a response from the client before the server
# considers the connection to be stale and disconnects it.
# @param [String] ssh_use_dns setting for sshd_config.
# Default is 'no', which means that the server will not perform DNS lookups on
# connecting clients, but can be set to 'yes' if you want the server to
# perform DNS lookups. Disabling DNS lookups can improve connection times
# and reduce the risk of DNS spoofing attacks, so it is generally
# recommended to keep this setting disabled unless you have a specific need for it.
# @param [String] ssh_pid_file setting for sshd_config.
# Default is '/var/run/sshd.pid', which is the common location for the
# sshd PID file, but can be set to a different path if desired.
# This setting specifies the location of the sshd PID file.
# @param [String] ssh_max_startups setting for sshd_config.
# Default is '10:30:100', which means that the server will allow up to 10
# concurrent unauthenticated connections, and will start dropping connections
# with a probability that increases linearly.
# @param [String] ssh_permit_tunnel setting for sshd_config.
# Default is 'no', which means that tunneling is not allowed, but can be
# set to 'yes' if you want to allow tunneling, or 'point-to-point' to allow
# only point-to-point tunneling. This setting should be used with caution if enabled.
# @param [String] ssh_chroot_directory setting for sshd_config.
# Default is 'none', which means that no chroot directory will be used, but
# can be set to a valid directory path if you want to use chroot for SSH
# sessions.
# @param [String] ssh_version_addendum setting for sshd_config.
# Default is 'none', which means that no version addendum will be included in
# the SSH banner, but can be set to a custom string if you want to include
# additional information in the SSH version banner. This can be used for
# branding purposes, but should be used with caution as it can potentially
# leak information about the server that could be useful to attackers.
##############################################################################
class confdroid_ssh::params (
@@ -140,6 +229,26 @@ class confdroid_ssh::params (
String $ssh_gssapi_key_exchange = 'no',
String $ssh_gssapi_enablek5users = 'no',
String $ssh_use_pam = 'no',
String $ssh_allow_agent_forwarding = 'yes',
String $ssh_allow_tcp_forwarding = 'yes',
String $ssh_gateway_ports = 'no',
String $ssh_x11_forwarding = 'no',
String $ssh_x11_display_offset = '10',
String $ssh_x11_use_localhost = 'yes',
String $ssh_permit_tty = 'yes',
String $ssh_print_motd = 'yes',
String $ssh_print_lastlog = 'yes',
String $ssh_tcp_keepalive = 'yes',
String $ssh_permit_user_environment = 'no',
String $ssh_compression = 'delayed',
String $ssh_client_alive_interval = '0',
String $ssh_client_alive_count_max = '3',
String $ssh_use_dns = 'no',
String $ssh_pid_file = '/var/run/sshd.pid',
String $ssh_max_startups = '10:30:100',
String $ssh_permit_tunnel = 'no',
String $ssh_chroot_directory = 'none',
String $ssh_version_addendum = 'none',
) {
# default facts