Francisco Trivino
7d54a6daaf
sss_ssh_knownhostsproxy will be deprecated in favor of sss_ssh_knownhosts. With this update, if the file /usr/bin/sss_ssh_knownhosts is present, KnownHostsCommand will be used instead of ProxyCommand. Also, GlobalKnownHostsFile is disabled as it is no longer needed. Fixes: https://pagure.io/freeipa/issue/9536 Signed-off-by: Francisco Trivino <ftrivino@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
17 lines
649 B
Plaintext
17 lines
649 B
Plaintext
# IPA-related configuration changes to ssh_config
|
|
#
|
|
PubkeyAuthentication yes
|
|
${ENABLEPROXY}GlobalKnownHostsFile $KNOWNHOSTS
|
|
${VERIFYHOSTKEYDNS}VerifyHostKeyDNS yes
|
|
|
|
# use sss_ssh_knownhosts if available
|
|
# assumes that if a user does not have shell (/sbin/nologin),
|
|
# this will return nonzero exit code and proxy command will be ignored
|
|
${ENABLEKNOWNHOSTS}Match exec true
|
|
${ENABLEKNOWNHOSTS} KnownHostsCommand $KNOWNHOSTSCOMMAND %H
|
|
|
|
# assumes that if a user does not have shell (/sbin/nologin),
|
|
# this will return nonzero exit code and proxy command will be ignored
|
|
${ENABLEPROXY}Match exec true
|
|
${ENABLEPROXY} ProxyCommand $KNOWNHOSTSPROXY -p %p %h
|