diff options
Diffstat (limited to 'meta-unit-core/recipes-connectivity/openssh')
| -rw-r--r-- | meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend index d520f4a..ce77f4d 100644 --- a/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend +++ b/meta-unit-core/recipes-connectivity/openssh/openssh_%.bbappend @@ -9,6 +9,9 @@ do_install:append () { # Add global authorized_keys file to AuthorizedKeysFile sed -i -e 's:^AuthorizedKeysFile.*:AuthorizedKeysFile\t.ssh/authorized_keys /etc/ssh/authorized_keys:' ${D}${sysconfdir}/ssh/sshd_config + + # Disable authorized keys file + sed -i -E 's/^AuthorizedKeysFile[[:blank:]]+\.ssh\/authorized_keys$/#&/' ${D}${sysconfdir}/ssh/sshd_config # Disable password authentication sed -i -e 's:#PasswordAuthentication yes:PasswordAuthentication no:' ${D}${sysconfdir}/ssh/sshd_config @@ -20,4 +23,9 @@ do_install:append () { echo "" >> ${D}${sysconfdir}/ssh/sshd_config echo "# Allow only the unitexe user" >> ${D}${sysconfdir}/ssh/sshd_config echo "AllowUsers unitexe" >> ${D}${sysconfdir}/ssh/sshd_config + + # Restrict SSH access to keys that have been signed by CA only + echo "" >> ${D}${sysconfdir}/ssh/sshd_config + echo "# Allow only keys signed by CA" >> ${D}${sysconfdir}/ssh/sshd_config + echo "TrustedUserCAKeys /etc/ssh/ssh-client-ca.pub" >> ${D}${sysconfdir}/ssh/sshd_config } |