diff options
| author | Eric Brown <brown@fastmail.com> | 2018-07-24 16:19:40 -0500 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2018-07-29 18:50:28 +0200 |
| commit | 5b6823907216d6c6c98fdb962f2005f154328878 (patch) | |
| tree | 0e2a813dbcccdb5dfe2f558f112780777f353c59 | |
| parent | b90d97ec2e80830e387716d2919ba36e5b6afac8 (diff) | |
| download | patches-5b6823907216d6c6c98fdb962f2005f154328878.tar patches-5b6823907216d6c6c98fdb962f2005f154328878.tar.gz | |
services: openssh: Add forwarding options.
* gnu/services/ssh.scm (<openssh-configuration>)[allow-agent-forwarding?]
[allow-tcp-forwarding?, gateway-ports?]: New fields.
(openssh-config-file): Handle them.
* doc/guix.texi (Networking Services): Adjust accordingly.
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
| -rw-r--r-- | doc/guix.texi | 9 | ||||
| -rw-r--r-- | gnu/services/ssh.scm | 22 |
2 files changed, 31 insertions, 0 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index 19c9813f6a..d5588066bb 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -11650,6 +11650,15 @@ When true, forwarding of X11 graphical client connections is enabled---in other words, @command{ssh} options @option{-X} and @option{-Y} will work. +@item @code{allow-agent-forwarding?} (default: @code{#t}) +Whether to allow agent forwarding. + +@item @code{allow-tcp-forwarding?} (default: @code{#t}) +Whether to allow TCP forwarding. + +@item @code{gateway-ports?} (default: @code{#f}) +Whether to allow gateway ports. + @item @code{challenge-response-authentication?} (default: @code{#f}) Specifies whether challenge response authentication is allowed (e.g. via PAM). diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index f158fdf01f..dd96ad6aec 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -289,6 +289,19 @@ The other options should be self-descriptive." ;; Boolean (x11-forwarding? openssh-configuration-x11-forwarding? (default #f)) + + ;; Boolean + (allow-agent-forwarding? openssh-configuration-allow-agent-forwarding? + (default #t)) + + ;; Boolean + (allow-tcp-forwarding? openssh-configuration-allow-tcp-forwarding? + (default #t)) + + ;; Boolean + (gateway-ports? openssh-configuration-gateway-ports? + (default #f)) + ;; Boolean (challenge-response-authentication? openssh-challenge-response-authentication? (default #f)) @@ -418,6 +431,15 @@ of user-name/file-like tuples." (format port "X11Forwarding ~a\n" #$(if (openssh-configuration-x11-forwarding? config) "yes" "no")) + (format port "AllowAgentForwarding ~a\n" + #$(if (openssh-configuration-allow-agent-forwarding? config) + "yes" "no")) + (format port "AllowTcpForwarding ~a\n" + #$(if (openssh-configuration-allow-tcp-forwarding? config) + "yes" "no")) + (format port "GatewayPorts ~a\n" + #$(if (openssh-configuration-gateway-ports? config) + "yes" "no")) (format port "PidFile ~a\n" #$(openssh-configuration-pid-file config)) (format port "ChallengeResponseAuthentication ~a\n" |