MieuxVoter
/
gitea-fork-majority-judgment
mirror of https://github.com/domi41/gitea.git
4
0
Fork 0
Code Issues 8 Releases Wiki Polls Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '1bf46836da'
${ noResults }
gitea-fork-majority-judgment/docker/root/etc/templates/sshd_config

41 lines
970 B
Raw Normal View History Unescape

Fix #8453 by making openssh listen on SSH_LISTEN_PORT not SSH_PORT (#8477)
5 years ago
Port ${SSH_LISTEN_PORT}
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
Protocol 2
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
LogLevel INFO
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
HostKey /data/ssh/ssh_host_ed25519_key
Only offer hostcertificates if they exist (#15849) (#15853) Backport #15849 A common bug report is the otherwise harmless sshd logging: ``` Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory ``` This PR simply checks if these files exist before creation of sshd_config and if they do not exist, doesn't add a reference to them. Fix #14110 amongst others. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de>
3 years ago
${SSH_ED25519_CERT}
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
HostKey /data/ssh/ssh_host_rsa_key
Only offer hostcertificates if they exist (#15849) (#15853) Backport #15849 A common bug report is the otherwise harmless sshd logging: ``` Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory ``` This PR simply checks if these files exist before creation of sshd_config and if they do not exist, doesn't add a reference to them. Fix #14110 amongst others. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de>
3 years ago
${SSH_RSA_CERT}
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
HostKey /data/ssh/ssh_host_ecdsa_key
Only offer hostcertificates if they exist (#15849) (#15853) Backport #15849 A common bug report is the otherwise harmless sshd logging: ``` Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory ``` This PR simply checks if these files exist before creation of sshd_config and if they do not exist, doesn't add a reference to them. Fix #14110 amongst others. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de>
3 years ago
${SSH_ECDSA_CERT}
Disable DSA ssh keys by default (#13056) * Disable DSA ssh keys by default OpenSSH has disabled DSA keys since version 7.0 As the docker runs openssh > v7.0 we should just disable DSA keys by default. Refers to #11417 Signed-off-by: Andrew Thornton <art27@cantab.net> * Just disable DSA keys by default Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove DSA type * Fix Tests Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
4 years ago
HostKey /data/ssh/ssh_host_dsa_key
Only offer hostcertificates if they exist (#15849) (#15853) Backport #15849 A common bug report is the otherwise harmless sshd logging: ``` Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory ``` This PR simply checks if these files exist before creation of sshd_config and if they do not exist, doesn't add a reference to them. Fix #14110 amongst others. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: 6543 <6543@obermui.de>
3 years ago
${SSH_DSA_CERT}
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
AuthorizedKeysFile .ssh/authorized_keys
Add ssh certificate support (#12281) * Add ssh certificate support * Add ssh certificate support to builtin ssh * Write trusted-user-ca-keys.pem based on configuration * Update app.example.ini * Update templates/user/settings/keys_principal.tmpl Co-authored-by: silverwind <me@silverwind.io> * Remove unused locale string * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * Add missing creation of SSH.Rootpath * Update cheatsheet, example and locale strings * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go * Optimizations based on feedback * Validate CA keys for external sshd * Add filename option and change default filename Add a SSH_TRUSTED_USER_CA_KEYS_FILENAME option which default is RUN_USER/.ssh/gitea-trusted-user-ca-keys.pem Do not write a file when SSH_TRUSTED_USER_CA_KEYS is empty. Add some more documentation. * Remove unneeded principalkey functions * Add blank line * Apply suggestions from code review Co-authored-by: zeripath <art27@cantab.net> * Add SSH_AUTHORIZED_PRINCIPALS_ALLOW option This adds a SSH_AUTHORIZED_PRINCIPALS_ALLOW which is default email,username this means that users only can add the principals that match their email or username. To allow anything the admin need to set the option anything. This allows for a safe default in gitea which protects against malicious users using other user's prinicipals. (before that user could set it). This commit also has some small other fixes from the last code review. * Rewrite principal keys file on user deletion * Use correct rewrite method * Set correct AuthorizedPrincipalsBackup default setting * Rewrite principalsfile when adding principals * Add update authorized_principals option to admin dashboard * Handle non-primary emails Signed-off-by: Andrew Thornton <art27@cantab.net> * Add the command actually to the dashboard template * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * By default do not show principal options unless there are CA keys set or they are explicitly set Signed-off-by: Andrew Thornton <art27@cantab.net> * allow settings when enabled * Fix typos in TrustedUserCAKeys path * Allow every CASignatureAlgorithms algorithm As this depends on the content of TrustedUserCAKeys we should allow all signature algorithms as admins can choose the specific algorithm on their signing CA * Update models/ssh_key.go Co-authored-by: Lauris BH <lauris@nix.lv> * Fix linting issue Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
4 years ago
AuthorizedPrincipalsFile .ssh/authorized_principals
TrustedUserCAKeys /data/git/.ssh/gitea-trusted-user-ca-keys.pem
CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
UseDNS no
AllowAgentForwarding no
AllowTcpForwarding no
PrintMotd no
PermitUserEnvironment yes
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
PermitRootLogin no
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
ChallengeResponseAuthentication no
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
9 years ago
PasswordAuthentication no
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
PermitEmptyPasswords no
Make AllowedUsers configurable in sshd_config (#8094) docker/root/usr/bin/entrypoint already allows for the specification of USER, USER_UID, USER_GID. But since AllowedUsers is hardcoded in sshd_config, one cannot log in as a user different ftom git. This change substitutes ${USER} for git in the sshd_config template. Signed-off-by: Jeronimo Pellegrini <j_p@aleph0.info>
5 years ago
AllowUsers ${USER}
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
7 years ago
Banner none
Subsystem sftp /usr/lib/ssh/sftp-server
add git protocol v2 support via SSH on Docker image (#5520) * add git protocol v2 support via SSH on Docker image * remove new layer on dockerfile
5 years ago
Fix #8453 by making openssh listen on SSH_LISTEN_PORT not SSH_PORT (#8477)
5 years ago
AcceptEnv GIT_PROTOCOL