diff options
| author | Emil Renner Berthing <esmil@labitat.dk> | 2020-06-01 17:54:08 +0200 |
|---|---|---|
| committer | Emil Renner Berthing <esmil@labitat.dk> | 2020-06-01 17:54:08 +0200 |
| commit | 0fd7afb090e683cf4b219e69d6a9905394621ffe (patch) | |
| tree | b265d46fed5460c071e2c199b5dc35a6fad9dfa4 /roles | |
| parent | fc663113f12a8fa4b419bd71ad3643aad50357cb (diff) | |
| download | labitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.tar.gz labitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.tar.xz labitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.zip | |
users: add support for jumponly users
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/users/templates/authorized_keys.j2 | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/roles/users/templates/authorized_keys.j2 b/roles/users/templates/authorized_keys.j2 index 33a30f2..73315aa 100644 --- a/roles/users/templates/authorized_keys.j2 +++ b/roles/users/templates/authorized_keys.j2 @@ -1,3 +1,9 @@ -{% for key in userdata[item].authorized_keys %} +{% if users[item] == 'jumponly' %} +{% for key in userdata[item].authorized_keys %} +restrict,command="echo 'This account can only be used for ProxyJump (ssh -J)'",port-forwarding {{ key }} +{% endfor %} +{% else %} +{% for key in userdata[item].authorized_keys %} {{ key }} -{% endfor %} +{% endfor %} +{% endif %} |