summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--doc/guix.texi9
-rw-r--r--gnu/services/ssh.scm22
2 files changed, 31 insertions, 0 deletions
diff --git a/doc/guix.texi b/doc/guix.texi
index 19c9813f6a..d5588066bb 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -11650,6 +11650,15 @@ When true, forwarding of X11 graphical client connections is
enabled---in other words, @command{ssh} options @option{-X} and
@option{-Y} will work.
+@item @code{allow-agent-forwarding?} (default: @code{#t})
+Whether to allow agent forwarding.
+
+@item @code{allow-tcp-forwarding?} (default: @code{#t})
+Whether to allow TCP forwarding.
+
+@item @code{gateway-ports?} (default: @code{#f})
+Whether to allow gateway ports.
+
@item @code{challenge-response-authentication?} (default: @code{#f})
Specifies whether challenge response authentication is allowed (e.g. via
PAM).
diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm
index f158fdf01f..dd96ad6aec 100644
--- a/gnu/services/ssh.scm
+++ b/gnu/services/ssh.scm
@@ -289,6 +289,19 @@ The other options should be self-descriptive."
;; Boolean
(x11-forwarding? openssh-configuration-x11-forwarding?
(default #f))
+
+ ;; Boolean
+ (allow-agent-forwarding? openssh-configuration-allow-agent-forwarding?
+ (default #t))
+
+ ;; Boolean
+ (allow-tcp-forwarding? openssh-configuration-allow-tcp-forwarding?
+ (default #t))
+
+ ;; Boolean
+ (gateway-ports? openssh-configuration-gateway-ports?
+ (default #f))
+
;; Boolean
(challenge-response-authentication? openssh-challenge-response-authentication?
(default #f))
@@ -418,6 +431,15 @@ of user-name/file-like tuples."
(format port "X11Forwarding ~a\n"
#$(if (openssh-configuration-x11-forwarding? config)
"yes" "no"))
+ (format port "AllowAgentForwarding ~a\n"
+ #$(if (openssh-configuration-allow-agent-forwarding? config)
+ "yes" "no"))
+ (format port "AllowTcpForwarding ~a\n"
+ #$(if (openssh-configuration-allow-tcp-forwarding? config)
+ "yes" "no"))
+ (format port "GatewayPorts ~a\n"
+ #$(if (openssh-configuration-gateway-ports? config)
+ "yes" "no"))
(format port "PidFile ~a\n"
#$(openssh-configuration-pid-file config))
(format port "ChallengeResponseAuthentication ~a\n"