sftp Match Group settings overriding global sshd_config settings

[kekumu]

ansible-ssh-hardening/templates/opensshd.conf.j2

Lines 240 to 247 in f9b0c2e

	Match Group sftponly
	ForceCommand internal-sftp -l INFO -f LOCAL6
	ChrootDirectory {{ sftp_chroot_dir }}
	AllowTcpForwarding no
	AllowAgentForwarding no
	PasswordAuthentication no
	PermitRootLogin no
	X11Forwarding no

Lines 241-247 should be indented in order to apply to only the Match Group. Right now they are overriding the global settings higher up in the config file.

[rndmh3ro]

Just as I said in the PR, indentation is not required here.
The manpage for sshd_config describes this better than I could:

Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file. If a keyword appears in multiple Match blocks that are satisfied, only the first instance of the keyword is applied.

[kekumu]

Thanks for the clarification.

[kiwivogel]

Question: Does this block need to be here in the first place as these are mostly covered in the global settings mentioned above. Keeping this in breaks the associated inspec ssh-baseline tests because of duplicate values.

[rndmh3ro]

With this block you can enable sftp and set different options for it than in the global settings so yes, this block has a right to exist. :)

I guess the inspec tests fail, because you have sftp enabled?

[kiwivogel]

Yeah, somehow ansible refuses to pick up scp_if_ssh = True so I'm stuck on using SFTP. The question was mainly if it's safe to delete these settings (assuming they are duplicates of global settings). The alternative is that I skip them in a child profile and add matchers that are ok with the duplication but that's a bit ugly.

[rndmh3ro]

The question was mainly if it's safe to delete these settings

Yes that should be safe.