dustin/configpolicy
1
1
Fork 0
Code Issues Releases Activity

r/fileserver: Restrict non-administrators to SFTP

Browse Source 
Normal users do not need shell access to the file server, and certainly
should not be allowed to e.g. forward ports through it.  Using a `Match`
block, we can apply restrictions to users who do not need administrative
functionality.  In this case, we restrict everyone who is not a member
of the *Server Admins* group in the PYROCUFFLINK AD domain.
This commit is contained in:
Dustin
2024-02-01 10:29:32 -06:00
parent b5c54d7bb3
commit 0d30e54fd5
5 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
roles/fileserver/templates/sftp-only.sshd_config.j2 Normal file
View File

@@ -0,0 +1,11 @@
Match {{ fileserver_sftp_only_match }}
AllowAgentForwarding no
AllowStreamLocalForwarding no
AllowTcpForwarding no
DisableForwarding yes
ForceCommand internal-sftp
PermitListen none
PermitOpen none
PermitTTY no
PermitTunnel no
PermitUserRC no