wangwei
/
aiforge
Not watched
1
0
Fork 0
Code
Releases 128 Wiki Activity
Issues 0 Pull Requests 0 Datasets Model Cloudbrain
You can not select more than 25 topics Topics must start with a chinese character,a letter or number, can include dashes ('-') and can be up to 35 characters long.
10283 Commits
197 Branches
346 MB
257 Download
Tree: 3c1ba3a973
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '3c1ba3a973'
${ noResults }
aiforge/docker/root/etc/templates/sshd_config

sshd_config 1.1 kB
Raw Normal View History

Fix #8453 by making openssh listen on SSH_LISTEN_PORT not SSH_PORT (#8477)
6 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
​
​
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
Update sshd_config (#13143) Afaik, adding these lines does nothing unless the file(s) are present. Having them in let's admins supply certs instead of relying on TOFU. Co-authored-by: zeripath <art27@cantab.net>
4 years ago
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
Update sshd_config (#13143) Afaik, adding these lines does nothing unless the file(s) are present. Having them in let's admins supply certs instead of relying on TOFU. Co-authored-by: zeripath <art27@cantab.net>
4 years ago
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
Update sshd_config (#13143) Afaik, adding these lines does nothing unless the file(s) are present. Having them in let's admins supply certs instead of relying on TOFU. Co-authored-by: zeripath <art27@cantab.net>
4 years ago
Disable DSA ssh keys by default (#13056) * Disable DSA ssh keys by default OpenSSH has disabled DSA keys since version 7.0 As the docker runs openssh > v7.0 we should just disable DSA keys by default. Refers to #11417 Signed-off-by: Andrew Thornton <art27@cantab.net> * Just disable DSA keys by default Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove DSA type * Fix Tests Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
5 years ago
Update sshd_config (#13143) Afaik, adding these lines does nothing unless the file(s) are present. Having them in let's admins supply certs instead of relying on TOFU. Co-authored-by: zeripath <art27@cantab.net>
4 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
Add ssh certificate support (#12281) * Add ssh certificate support * Add ssh certificate support to builtin ssh * Write trusted-user-ca-keys.pem based on configuration * Update app.example.ini * Update templates/user/settings/keys_principal.tmpl Co-authored-by: silverwind <me@silverwind.io> * Remove unused locale string * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * Add missing creation of SSH.Rootpath * Update cheatsheet, example and locale strings * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go * Optimizations based on feedback * Validate CA keys for external sshd * Add filename option and change default filename Add a SSH_TRUSTED_USER_CA_KEYS_FILENAME option which default is RUN_USER/.ssh/gitea-trusted-user-ca-keys.pem Do not write a file when SSH_TRUSTED_USER_CA_KEYS is empty. Add some more documentation. * Remove unneeded principalkey functions * Add blank line * Apply suggestions from code review Co-authored-by: zeripath <art27@cantab.net> * Add SSH_AUTHORIZED_PRINCIPALS_ALLOW option This adds a SSH_AUTHORIZED_PRINCIPALS_ALLOW which is default email,username this means that users only can add the principals that match their email or username. To allow anything the admin need to set the option anything. This allows for a safe default in gitea which protects against malicious users using other user's prinicipals. (before that user could set it). This commit also has some small other fixes from the last code review. * Rewrite principal keys file on user deletion * Use correct rewrite method * Set correct AuthorizedPrincipalsBackup default setting * Rewrite principalsfile when adding principals * Add update authorized_principals option to admin dashboard * Handle non-primary emails Signed-off-by: Andrew Thornton <art27@cantab.net> * Add the command actually to the dashboard template * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * By default do not show principal options unless there are CA keys set or they are explicitly set Signed-off-by: Andrew Thornton <art27@cantab.net> * allow settings when enabled * Fix typos in TrustedUserCAKeys path * Allow every CASignatureAlgorithms algorithm As this depends on the content of TrustedUserCAKeys we should allow all signature algorithms as admins can choose the specific algorithm on their signing CA * Update models/ssh_key.go Co-authored-by: Lauris BH <lauris@nix.lv> * Fix linting issue Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
5 years ago
​
​
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
​
​
​
​
​
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
New approach to Gogs Docker Container - VOLUME for ‘/data’ - Usage of S6 as PID 1 Process - Usage of ‘socat’ so linked container (like databases) are binded to localhost - OpenSSH, Socat Link and Gogs are supervised using S6 - Size of container reduced to ~75Mo
10 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
Make AllowedUsers configurable in sshd_config (#8094) docker/root/usr/bin/entrypoint already allows for the specification of USER, USER_UID, USER_GID. But since AllowedUsers is hardcoded in sshd_config, one cannot log in as a user different ftom git. This change substitutes ${USER} for git in the sshd_config template. Signed-off-by: Jeronimo Pellegrini <j_p@aleph0.info>
6 years ago
Restructured docker building I have restructured the docker build process entirely, the binary gets built outside of the docker build command, now we are managing all dependencies with real Alpine packages and I have dropped features like socat or the cron daemon. Signed-off-by: Thomas Boerger <tboerger@suse.de>
8 years ago
​
​
add git protocol v2 support via SSH on Docker image (#5520) * add git protocol v2 support via SSH on Docker image * remove new layer on dockerfile
6 years ago
Fix #8453 by making openssh listen on SSH_LISTEN_PORT not SSH_PORT (#8477)
6 years ago
 12345678910111213141516171819202122232425262728293031323334353637383940 
  1. Port ${SSH_LISTEN_PORT}

  2. Protocol 2

  3. 

  4. AddressFamily any

  5. ListenAddress 0.0.0.0

  6. ListenAddress ::

  7. 

  8. LogLevel INFO

  9. 

  10. HostKey /data/ssh/ssh_host_ed25519_key

  11. HostCertificate /data/ssh/ssh_host_ed25519_cert

  12. HostKey /data/ssh/ssh_host_rsa_key

  13. HostCertificate /data/ssh/ssh_host_rsa_cert

  14. HostKey /data/ssh/ssh_host_ecdsa_key

  15. HostCertificate /data/ssh/ssh_host_ecdsa_cert

  16. HostKey /data/ssh/ssh_host_dsa_key

  17. HostCertificate /data/ssh/ssh_host_dsa_cert

  18. 

  19. AuthorizedKeysFile .ssh/authorized_keys

  20. AuthorizedPrincipalsFile .ssh/authorized_principals

  21. TrustedUserCAKeys /data/git/.ssh/gitea-trusted-user-ca-keys.pem

  22. CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa

  23. 

  24. UseDNS no

  25. AllowAgentForwarding no

  26. AllowTcpForwarding no

  27. PrintMotd no

  28. 

  29. PermitUserEnvironment yes

  30. PermitRootLogin no

  31. ChallengeResponseAuthentication no

  32. PasswordAuthentication no

  33. PermitEmptyPasswords no

  34. 

  35. AllowUsers ${USER}

  36. 

  37. Banner none

  38. Subsystem sftp /usr/lib/ssh/sftp-server

  39. 

  40. AcceptEnv GIT_PROTOCOL

No Description