mirrors/aports
1
0
Fork 0
mirror of https://gitlab.alpinelinux.org/alpine/aports.git synced 2025-08-05 13:27:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

main/openssh: disable tcp forwarding in default config

Browse Source 
Having TCP forward enabled by default may make it eaiser for attackers
who have gained control due to badly configured passwords.

So we keep things disabled by default and users can enable when they
need it.
This commit is contained in:
Natanael Copa 2018-07-29 15:44:38 +00:00
parent 3ab6178f9b
commit 495bbd7fb1
2 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
main/openssh/APKBUILD
View File

@ -4,7 +4,7 @@
pkgname=openssh
pkgver=7.7_p1
_myver=${pkgver%_*}${pkgver#*_}
pkgrel=2
pkgrel=3
pkgdesc="Port of OpenBSD's free SSH release"
url="http://www.openssh.org/portable.html"
arch="all"
@ -33,9 +33,10 @@ source="http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$pkgname-$_myver.tar
openssh7.4-peaktput.patch
fix-utmp.patch
bsd-compatible-realpath.patch
sftp-interactive.patch
disable-forwarding-by-default.patch
sshd.initd
sshd.confd
sftp-interactive.patch
"
# secfixes:
# 7.5_p1-r8:
@ -196,6 +197,7 @@ sha512sums="597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6
398096a89aa104abeff31aa043ac406a6348e0fdd4d313b7888ee0b931d38fd71fc21bceee46145e88f03bc27e00890e068442faee2d33f86cfbc04d58ffa4b6 openssh7.4-peaktput.patch
f35fffcd26635249ce5d820e7b3e406e586f2d2d7f6a045f221e2f9fb53aebc1ab1dd1e603b3389462296ed77921a1d08456e7aaa3825cbed08f405b381a58e1 fix-utmp.patch
f2b8daa537ea3f32754a4485492cc6eb3f40133ed46c0a5a29a89e4bcf8583d82d891d94bf2e5eb1c916fa68ec094abf4e6cd641e9737a6c05053808012b3a73 bsd-compatible-realpath.patch
c1d09c65dbc347f0904edc30f91aa9a24b0baee50309536182455b544f1e3f85a8cecfa959e32be8b101d8282ef06dde3febbbc3f315489339dcf04155c859a9 sftp-interactive.patch
8df35d72224cd255eb0685d2c707b24e5eb24f0fdd67ca6cc0f615bdbd3eeeea2d18674a6af0c6dab74c2d8247e2370d0b755a84c99f766a431bc50c40b557de disable-forwarding-by-default.patch
bcd56bebe37acb69986abd247d6b74daf7dde1712f30640244a1dd70c505a6a536c5536bef11345e128b6785e1c8ff9736627556e702218805fb14b23bd7047c sshd.initd
ec506156c286e5b28a530e9964dd68b7f6c9e881fbc47247a988e52a1f9cd50cbfaf4955c96774f9e2508d8b734c4abf98785fbaa75ae6249e3464b5495f1afc sshd.confd
c1d09c65dbc347f0904edc30f91aa9a24b0baee50309536182455b544f1e3f85a8cecfa959e32be8b101d8282ef06dde3febbbc3f315489339dcf04155c859a9 sftp-interactive.patch"
ec506156c286e5b28a530e9964dd68b7f6c9e881fbc47247a988e52a1f9cd50cbfaf4955c96774f9e2508d8b734c4abf98785fbaa75ae6249e3464b5495f1afc sshd.confd"

16
main/openssh/disable-forwarding-by-default.patch Normal file
View File

@ -0,0 +1,16 @@
--- openssh-7.7p1/sshd_config.old 2018-04-02 00:38:28.000000000 -0500
+++ openssh-7.7p1/sshd_config 2018-07-29 03:08:16.340000000 -0500
@@ -82,9 +82,10 @@
#UsePAM no
#AllowAgentForwarding yes
-#AllowTcpForwarding yes
-#GatewayPorts no
-#X11Forwarding no
+# Feel free to re-enable these if your use case requires them.
+AllowTcpForwarding no
+GatewayPorts no
+X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes