starlingx/config-files
Code Issues Proposed changes

Update sshd_config for "denied ssh access" group

Browse Source 
Local OpenLDAP and WAD servers are being used for k8s api and SSH
authentication. We need the ability to disallow SSH authentication
for selective users. As part of the solution, we create a Linux
group where all ldap users with "denied ssh access" will be added.
This commit sets the group for "denied ssh access" in the sshd
configuration file "/etc/ssh/sshd_config".

Test Plan:
PASS: Debian image gets successfully installed in AIO-SX system.
PASS: Verify the Linux group has been created and the sshd
configuration file was updated with denied ssh access for that group.
PASS: Create an openldap user and add to the "deny ssh access" group.
Verify that the user cannot ssh.
PASS: Create a WAD group with the same name and gidNumber as the
Linux group for "deny ssh access". Create a WAD user in this group.
Validate that the new WAD user in the "deny ssh group" cannot ssh
to stx platform.
PASS: Remove the WAD user from the WAD "deny ssh access" group.
Validate that now the user can have ssh access to stx platform.
PASS: Remove the openldap user from the Linux "deny ssh access" group.
Validate that now the user can have ssh access to stx platform.

Story: 2010589
Task: 48231
Depends-On: https://review.opendev.org/c/starlingx/stx-puppet/+/886150

Signed-off-by: Carmen Rata <carmen.rata@windriver.com>
Change-Id: If96f3f52cb10a8c32df5b777ba7c85f33edb3f96
This commit is contained in:
Carmen Rata 2023-06-15 01:07:42 +00:00
parent 2be96003ab
commit 62b1150e29
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
openssh-config/source-debian/sshd_config
View File

@ -139,6 +139,7 @@ Subsystem sftp /usr/lib/openssh/sftp-server
# PermitTTY no
# ForceCommand cvs server
DenyUsers admin secadmin operator
DenyGroups denyssh
# Filtered cipher, MAC and key exchange algorithm list, defaults can be
# obtained by ssh -Q cipher, ssh -Q mac and ssh -Q kex
# TODO (aning): once openssh is updated to 7.5, an explicit exclusion list