Sunil Mohan Adapa 21c8a8945f
ssh: Restrict logins to groups root, admin and freedombox-ssh
Tests:

- Remove restricted console logins. Try to login via SSH with non-admin and note
that it fails. sudo into the user succeeds.

- Add a user to freedombox-ssh group from Users & Groups app. Login with SSH
succeeds.

- Login with admin user succeeds with and without adding to freedombox-ssh
group.

- On a fresh install, non-admin users are not restricted.

- On an upgrade from a version with the patch, non-admin users are restricted.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2022-12-05 20:47:08 -05:00

19 lines
477 B
Python

# SPDX-License-Identifier: AGPL-3.0-or-later
"""
Application manifest for ssh.
"""
backup = {
'config': {
'files': ['/etc/ssh/sshd_config.d/freedombox.conf']
},
'secrets': {
'files': [
'/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ecdsa_key.pub',
'/etc/ssh/ssh_host_ed25519_key',
'/etc/ssh/ssh_host_ed25519_key.pub', '/etc/ssh/ssh_host_rsa_key',
'/etc/ssh/ssh_host_rsa_key.pub'
]
}
}