From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39298) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fi6Cw-0001lP-5L for guix-patches@gnu.org; Tue, 24 Jul 2018 18:55:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fi6Cs-0006Gr-VY for guix-patches@gnu.org; Tue, 24 Jul 2018 18:55:06 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:50835) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1fi6Cs-0006Ga-PZ for guix-patches@gnu.org; Tue, 24 Jul 2018 18:55:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1fi6Cs-0002gJ-Ev for guix-patches@gnu.org; Tue, 24 Jul 2018 18:55:02 -0400 Subject: [bug#32264] openssh forwarding options Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:39153) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fi6CV-0001io-5V for guix-patches@gnu.org; Tue, 24 Jul 2018 18:54:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fi6CS-0005ue-1s for guix-patches@gnu.org; Tue, 24 Jul 2018 18:54:39 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:43183) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fi6CR-0005sN-O6 for guix-patches@gnu.org; Tue, 24 Jul 2018 18:54:35 -0400 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id E674921924 for ; Tue, 24 Jul 2018 18:54:33 -0400 (EDT) Received: from localhost (c-98-226-192-215.hsd1.il.comcast.net [98.226.192.215]) by mail.messagingengine.com (Postfix) with ESMTPA id 6D02DE4534 for ; Tue, 24 Jul 2018 18:54:33 -0400 (EDT) From: Eric Brown Date: Tue, 24 Jul 2018 17:54:32 -0500 Message-ID: <878t60tfbr.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 32264@debbugs.gnu.org --=-=-= Content-Type: text/plain Please find attached a patch that enables the configuration of some of openssh's forwarding options. These changes are based off of the existing x11-forwarding? option that already exists in ssh.scm. Also, I have added some documentation for these options. --=-=-= Content-Type: text/x-patch Content-Disposition: attachment; filename=0001-gnu-services-Add-forwarding-options-to-openssh.patch >From f2c0c2387b2dcc4ce092c31a5a024565e4adbb50 Mon Sep 17 00:00:00 2001 From: Eric Brown Date: Tue, 24 Jul 2018 16:19:40 -0500 Subject: [PATCH] gnu: services: Add forwarding options to openssh. * gnu/services/ssh.scm (openssh): Add forwarding options to openssh. --- doc/guix.texi | 9 +++++++++ gnu/services/ssh.scm | 22 ++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/doc/guix.texi b/doc/guix.texi index 84347d156..0341ea29f 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -11634,6 +11634,15 @@ When true, forwarding of X11 graphical client connections is enabled---in other words, @command{ssh} options @option{-X} and @option{-Y} will work. +@item @code{allow-agent-forwarding?} (default: @code{#t}) +Whether to allow agent forwarding. + +@item @code{allow-tcp-forwarding?} (default: @code{#t}) +Whether to allow TCP forwarding. + +@item @code{gateway-ports?} (default: @code{#f}) +Whether to allow gateway ports. + @item @code{challenge-response-authentication?} (default: @code{#f}) Specifies whether challenge response authentication is allowed (e.g. via PAM). diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index f158fdf01..dd96ad6ae 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -289,6 +289,19 @@ The other options should be self-descriptive." ;; Boolean (x11-forwarding? openssh-configuration-x11-forwarding? (default #f)) + + ;; Boolean + (allow-agent-forwarding? openssh-configuration-allow-agent-forwarding? + (default #t)) + + ;; Boolean + (allow-tcp-forwarding? openssh-configuration-allow-tcp-forwarding? + (default #t)) + + ;; Boolean + (gateway-ports? openssh-configuration-gateway-ports? + (default #f)) + ;; Boolean (challenge-response-authentication? openssh-challenge-response-authentication? (default #f)) @@ -418,6 +431,15 @@ of user-name/file-like tuples." (format port "X11Forwarding ~a\n" #$(if (openssh-configuration-x11-forwarding? config) "yes" "no")) + (format port "AllowAgentForwarding ~a\n" + #$(if (openssh-configuration-allow-agent-forwarding? config) + "yes" "no")) + (format port "AllowTcpForwarding ~a\n" + #$(if (openssh-configuration-allow-tcp-forwarding? config) + "yes" "no")) + (format port "GatewayPorts ~a\n" + #$(if (openssh-configuration-gateway-ports? config) + "yes" "no")) (format port "PidFile ~a\n" #$(openssh-configuration-pid-file config)) (format port "ChallengeResponseAuthentication ~a\n" -- 2.18.0 --=-=-=--