infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

basessh: Only use useprivseperation on rhel7 and add sftp on koji01

Browse source 
Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi 2019-04-13 21:56:57 +00:00
parent b3d2c42fd1
commit 59e3454683
3 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
inventory/group_vars/all
View file

@ -307,3 +307,8 @@ copr_build_virthost: false
# like the prerelease to final ones. # like the prerelease to final ones.
# #
redirectmatch_enabled: True redirectmatch_enabled: True
#
# sshd can run a internal sftp server, we need this on some hosts, but
# not on most of them, so default to false
sshd_sftp: false

3
inventory/host_vars/koji01.phx2.fedoraproject.org
View file

@ -24,3 +24,6 @@ fedmsg_koji_instance: primary
koji_topurl: "https://kojipkgs.fedoraproject.org/" koji_topurl: "https://kojipkgs.fedoraproject.org/"
koji_server_url: "https://koji.fedoraproject.org/kojihub" koji_server_url: "https://koji.fedoraproject.org/kojihub"
koji_weburl: "https://koji.fedoraproject.org/koji" koji_weburl: "https://koji.fedoraproject.org/koji"
# we need sftp here in order to support the sshfs mount on buildvm-s390x-01
sshd_sftp: true

5
roles/basessh/templates/sshd_config
View file

@ -33,7 +33,7 @@ PermitTunnel no
{% if ansible_distribution_major_version == "6" %} {% if ansible_distribution_major_version == "6" %}
UsePrivilegeSeparation yes UsePrivilegeSeparation yes
{% else %} {% elif ansible_distribution_major_version == "7" %}
UsePrivilegeSeparation sandbox UsePrivilegeSeparation sandbox
{% endif %} {% endif %}
@ -48,3 +48,6 @@ AcceptEnv XMODIFIERS
AuthorizedKeysCommandUser git AuthorizedKeysCommandUser git
AuthorizedKeysCommand /usr/libexec/pagure/keyhelper.py "%u" "%h" "%t" "%f" AuthorizedKeysCommand /usr/libexec/pagure/keyhelper.py "%u" "%h" "%t" "%f"
{% endif %} {% endif %}
{% if sshd_sftp %}
Subsystem sftp internal-sftp
{% endif %}