aboutsummaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
authorEmil Renner Berthing <esmil@labitat.dk>2020-06-01 17:54:08 +0200
committerEmil Renner Berthing <esmil@labitat.dk>2020-06-01 17:54:08 +0200
commit0fd7afb090e683cf4b219e69d6a9905394621ffe (patch)
treeb265d46fed5460c071e2c199b5dc35a6fad9dfa4 /roles
parentfc663113f12a8fa4b419bd71ad3643aad50357cb (diff)
downloadlabitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.tar.gz
labitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.tar.xz
labitat-ansible-0fd7afb090e683cf4b219e69d6a9905394621ffe.zip
users: add support for jumponly users
Diffstat (limited to 'roles')
-rw-r--r--roles/users/templates/authorized_keys.j210
1 files changed, 8 insertions, 2 deletions
diff --git a/roles/users/templates/authorized_keys.j2 b/roles/users/templates/authorized_keys.j2
index 33a30f2..73315aa 100644
--- a/roles/users/templates/authorized_keys.j2
+++ b/roles/users/templates/authorized_keys.j2
@@ -1,3 +1,9 @@
-{% for key in userdata[item].authorized_keys %}
+{% if users[item] == 'jumponly' %}
+{% for key in userdata[item].authorized_keys %}
+restrict,command="echo 'This account can only be used for ProxyJump (ssh -J)'",port-forwarding {{ key }}
+{% endfor %}
+{% else %}
+{% for key in userdata[item].authorized_keys %}
{{ key }}
-{% endfor %}
+{% endfor %}
+{% endif %}