Bug description
On RHEL 8, 9 and 10 the deployed sshd_config places Include /etc/ssh/sshd_config.d/*.conf (line 18) above every directive the role sets. sshd uses the first value it obtains, and the distribution's /etc/ssh/sshd_config.d/50-redhat.conf sets X11Forwarding yes and GSSAPIAuthentication yes, so both role settings are ignored. Since sshd__x11_forwarding defaults to false, every host has X11 forwarding enabled although the role says otherwise.
Steps to reproduce
- Deploy the role with its defaults on Rocky 9 or Rocky 10.
- Run
sshd -T | grep -E '^(x11forwarding|gssapiauthentication) '.
Expected behavior
x11forwarding no, as set by sshd__x11_forwarding: false. The actual result is x11forwarding yes. Setting sshd__gssapi_authentication: false likewise still reports gssapiauthentication yes.
Environment
LFOps main, Rocky Linux 9.8 and 10.2, openssh-server 9.9p1.
Additional context
Moving the Include line below the role's directives makes both settings effective, and the crypto policy still applies (the post-quantum mlkem768x25519-sha256 key exchange stays first on RHEL 10). An alternative is a 49-linuxfabrik.conf drop-in, which keeps administrator drop-ins with a higher number in charge. Either way X11 forwarding turns off on existing hosts, so this needs a Breaking Changes entry. The other directives the role sets do not overlap with 50-redhat.conf and are unaffected.
While at it: RedHat9-sshd_config.j2 and RedHat10-sshd_config.j2 differ only in the header timestamp and one comment line.
Bug description
On RHEL 8, 9 and 10 the deployed
sshd_configplacesInclude /etc/ssh/sshd_config.d/*.conf(line 18) above every directive the role sets. sshd uses the first value it obtains, and the distribution's/etc/ssh/sshd_config.d/50-redhat.confsetsX11Forwarding yesandGSSAPIAuthentication yes, so both role settings are ignored. Sincesshd__x11_forwardingdefaults tofalse, every host has X11 forwarding enabled although the role says otherwise.Steps to reproduce
sshd -T | grep -E '^(x11forwarding|gssapiauthentication) '.Expected behavior
x11forwarding no, as set bysshd__x11_forwarding: false. The actual result isx11forwarding yes. Settingsshd__gssapi_authentication: falselikewise still reportsgssapiauthentication yes.Environment
LFOps main, Rocky Linux 9.8 and 10.2, openssh-server 9.9p1.
Additional context
Moving the
Includeline below the role's directives makes both settings effective, and the crypto policy still applies (the post-quantummlkem768x25519-sha256key exchange stays first on RHEL 10). An alternative is a49-linuxfabrik.confdrop-in, which keeps administrator drop-ins with a higher number in charge. Either way X11 forwarding turns off on existing hosts, so this needs a Breaking Changes entry. The other directives the role sets do not overlap with50-redhat.confand are unaffected.While at it:
RedHat9-sshd_config.j2andRedHat10-sshd_config.j2differ only in the header timestamp and one comment line.