- group 'sftpusers' (GID 200 or next free), sshd drop-in
/etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h,
ForceCommand internal-sftp), PasswordAuthentication via
'sftp_password_authentication'
- new sftp users (UID 201 or next free) with root owned chroot home,
upload dir and root owned authorized_keys (always created)
- existing users (e.g. www-data, suexec users) can be added to the group;
chroot requirements of their home are checked, not changed
- passwords: update_password defaults to 'always', password of users with
shell access is never changed
- controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd'
- add empty sftpd section to all host_vars *-common.yml
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All ipt servers are now managed by the role ipt-server (playbook ipt-server.yml):
- roles/firewall: only handles gateways now.
- Remove playbook modify-ipt-server.yml and role modify-ipt-server.
- Remove git_firewall_repository (ipt-server) and the ipt-server entries of
git_{oopen,warenform}_server_repositories, so role common no longer
clones /usr/local/src/ipt-server. Gateways keep ipt-gateway.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- handlers: a firewall restart flushes the DOCKER* chains and docker's NAT
rules; restart docker afterwards if it is running (like fail2ban).
- host_vars: add values missing from host_vars generated by an older
extract-fw-host-vars.py:
- mm-irights, mm-nd, mm-rav: fw_mm_server_ips
- test.mx: fw_mail_client_ips_v6, fw_dovecot_auth_service_v6,
fw_mumble_server_ips_v6
- mm: fw_allow_local_service_v6 uses "<port>,<proto>" (the IPv6 script
splits on ',', the IPv4 script on ':').
Rolled out to a.mx, a.ns, b.mx, b.ns, backup.warenform, cl-01, cl-02,
cl-dissens, cl-flr, cl-irights, cl-nd-test, cl-ndm, mm, mm-irights, mm-nd,
mm-rav, o45, test.mx; second run changed=0 on all of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrisandClaude Opus 5.5