From: Micah Anderson <micah@riseup.net>
Date: Fri, 26 Sep 2008 20:57:59 +0000 (-0400)
Subject: Add the variable AllowAgentForwarding to be set, with the default of 'no', only the... 
X-Git-Url: https://gitweb.fluxo.info/?a=commitdiff_plain;h=3bd90d741c35ae242befd955566e3f28cf76b81b;p=puppet-sshd.git

Add the variable AllowAgentForwarding to be set, with the default of 'no', only the Debian
template was adjusted for this, as my knowledge of the other operating systems is not good enough
to determine the appropriate setting there
---

diff --git a/manifests/init.pp b/manifests/init.pp
index 95682fd..4e796f3 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -43,6 +43,9 @@
 #                               Valid Values: yes or no
 #                               Default: no
 #
+# sshd_agent_forwarding:	If you want to allow ssh-agent forwarding
+# 				Valid Values: yes or no
+#				Default: no
 
 class sshd {
     include sshd::client 
@@ -81,6 +84,10 @@ class sshd::base {
         '' => 'no',
         default => $sshd_x11_forwarding
     }
+    $real_sshd_agent_forwarding = $sshd_agent_forwarding ? {
+    	'' => 'no',
+	default => $sshd_agent_forwarding
+    }
 
     file { 'sshd_config':
         path => '/etc/ssh/sshd_config',
diff --git a/templates/sshd_config/Debian_normal.erb b/templates/sshd_config/Debian_normal.erb
index 70c1a34..989fa62 100644
--- a/templates/sshd_config/Debian_normal.erb
+++ b/templates/sshd_config/Debian_normal.erb
@@ -94,9 +94,15 @@ UsePAM no
 
 HostbasedUsesNameFromPacketOnly yes
 AllowTcpForwarding yes
+<%- if real_sshd_agent_forwarding.to_s == 'yes' then %>
+AllowAgentForwarding yes
+<%- else %>
+AllowAgentForwarding no
+<%- end %>
 
 ChallengeResponseAuthentication no
 
 <%- unless real_sshd_allowed_users.to_s.empty? then %>
 AllowUsers <%= real_sshd_allowed_users %>
 <%- end %>
+