Restrict tf user in sshd

ComputeCanada · Jul 22, 2024 · 32e4bc2 · 32e4bc2
1 parent bcb671c
commit 32e4bc2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/common/configuration/puppet.yaml b/common/configuration/puppet.yaml
@@ -130,7 +130,7 @@ runcmd:
   - test -f /etc/magic-castle-release && systemctl start puppet || true
 
 write_files:
-  - content: restrict,agent-forwarding ${tf_ssh_public_key}
+  - content: restrict%{ if contains(tags, "puppet") },pty%{ else }%{ for host, ip in puppetservers },permitopen="${ip}:22"%{ endfor },port-forwarding,command="/sbin/nologin"%{ endif } ${tf_ssh_public_key}
     path: /etc/ssh/authorized_keys.tf
     permissions: "0644"
   - content: |