Skip to content

sshd: sshd__x11_forwarding and sshd__gssapi_authentication have no effect on the Red Hat family #354

Description

@NavidSassan

Bug description

On RHEL 8, 9 and 10 the deployed sshd_config places Include /etc/ssh/sshd_config.d/*.conf (line 18) above every directive the role sets. sshd uses the first value it obtains, and the distribution's /etc/ssh/sshd_config.d/50-redhat.conf sets X11Forwarding yes and GSSAPIAuthentication yes, so both role settings are ignored. Since sshd__x11_forwarding defaults to false, every host has X11 forwarding enabled although the role says otherwise.

Steps to reproduce

  1. Deploy the role with its defaults on Rocky 9 or Rocky 10.
  2. Run sshd -T | grep -E '^(x11forwarding|gssapiauthentication) '.

Expected behavior

x11forwarding no, as set by sshd__x11_forwarding: false. The actual result is x11forwarding yes. Setting sshd__gssapi_authentication: false likewise still reports gssapiauthentication yes.

Environment

LFOps main, Rocky Linux 9.8 and 10.2, openssh-server 9.9p1.

Additional context

Moving the Include line below the role's directives makes both settings effective, and the crypto policy still applies (the post-quantum mlkem768x25519-sha256 key exchange stays first on RHEL 10). An alternative is a 49-linuxfabrik.conf drop-in, which keeps administrator drop-ins with a higher number in charge. Either way X11 forwarding turns off on existing hosts, so this needs a Breaking Changes entry. The other directives the role sets do not overlap with 50-redhat.conf and are unaffected.

While at it: RedHat9-sshd_config.j2 and RedHat10-sshd_config.j2 differ only in the header timestamp and one comment line.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions