opuppet/module-sshd
5
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge branch 'disable_debian_banner' into 'master'

Browse source 
disable the debian/ubuntu package version from being sent to clients

dkg pointed out to riseup that our ssh servers were revealing the package version to clients, which is controlled by the DebianBanner config option. It exists in both Debian and Ubuntu and defaults to 'yes', so we explicitly set it to 'no' in the templates for those distros.

See merge request !17
This commit is contained in:
Jerome Charaoui 2015-10-09 17:23:30 +00:00
commit 571373e081
6 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
templates/sshd_config/Debian_jessie.erb
View file

@ -83,6 +83,8 @@ TCPKeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

2
templates/sshd_config/Debian_sid.erb
View file

@ -83,6 +83,8 @@ TCPKeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

2
templates/sshd_config/Debian_squeeze.erb
View file

@ -87,6 +87,8 @@ TCPKeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

2
templates/sshd_config/Debian_wheezy.erb
View file

@ -86,6 +86,8 @@ TCPKeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

2
templates/sshd_config/Ubuntu.erb
View file

@ -87,6 +87,8 @@ TCPKeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

2
templates/sshd_config/Ubuntu_lucid.erb
View file

@ -88,6 +88,8 @@ KeepAlive yes
#MaxStartups 10:30:60
#Banner /etc/issue.net
# do not reveal debian version (default is yes)
DebianBanner no
#ReverseMappingCheck yes
Subsystem sftp <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>