WarlockFish/fedora-infra_ansible
1
0
Fork 0
mirror of https://pagure.io/fedora-infra/ansible.git synced 2026-02-02 20:59:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

bastion: allow ssh tcp forwarding on bastion hosts

Browse Source 
We need this in order to be able to use them as jumphosts with ssh.
Without it, there's no easy way to get to any internal machines.
Just enable it here and leave the default off.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>
This commit is contained in:
Kevin Fenzi
2026-01-30 11:16:01 -08:00
parent 3d68919779
commit 278d9427f8
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
roles/basessh/templates/sshd_config.j2
View File

@@ -40,7 +40,12 @@ UsePAM yes
AllowAgentForwarding no
X11Forwarding no
PermitTunnel no
{% if not ansible_hostname.startswith(('bastion')) %}
# This is a bastion host, we need tcp forwarding here.
AllowTcpForwarding yes
{% else %}
AllowTcpForwarding no
{% endif %}
# Accept locale-related environment
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES