Allow ssh from all for undercloud
I89cff59947dda3f51482486c41a3d67c4aa36a3e broke SSH access on the Undercloud, we shouldn't be that restrictive by default for the undercloud and standalone (as deployed via tripleo deploy). This change adds a new parameter called SshFirewallAllowAll that can be used to include an allow all for ssh. By default it is disabled when deploying the overcloud but is used by the undercloud and standalone to allow access after installation. Change-Id: Ie548f7216610e15af24c96f65a58cc8de603235c Co-Authored-By: Alex Schultz <aschultz@redhat.com> Related-Bug: #1826829 (cherry picked from commit2b7cb19876
) (cherry picked from commitcba7c22857
)
This commit is contained in:
parent
67ce74ed8b
commit
3c9f7577c4
|
@ -55,3 +55,4 @@ parameter_defaults:
|
|||
NeutronPublicInterface: eth1
|
||||
MistralExecutionFieldSizeLimit: 16384
|
||||
NeutronServicePlugins: ['router']
|
||||
SshFirewallAllowAll: true
|
||||
|
|
|
@ -62,6 +62,10 @@ parameters:
|
|||
Subsystem: 'sftp /usr/libexec/openssh/sftp-server'
|
||||
description: Mapping of sshd_config values
|
||||
type: json
|
||||
SshFirewallAllowAll:
|
||||
default: false
|
||||
description: Set this to true to open up ssh access from all sources.
|
||||
type: boolean
|
||||
|
||||
outputs:
|
||||
role_data:
|
||||
|
@ -69,8 +73,17 @@ outputs:
|
|||
value:
|
||||
service_name: sshd
|
||||
config_settings:
|
||||
tripleo::profile::base::sshd::bannertext: {get_param: BannerText}
|
||||
map_merge:
|
||||
- tripleo::profile::base::sshd::bannertext: {get_param: BannerText}
|
||||
tripleo::profile::base::sshd::motd: {get_param: MessageOfTheDay}
|
||||
tripleo::profile::base::sshd::options: {get_param: SshServerOptions}
|
||||
- if:
|
||||
- {get_param: SshFirewallAllowAll}
|
||||
- tripleo::sshd::firewall_rules:
|
||||
'003 accept ssh from all':
|
||||
proto: 'tcp'
|
||||
dport: 22
|
||||
- null
|
||||
|
||||
step_config: |
|
||||
include ::tripleo::profile::base::sshd
|
||||
|
|
Loading…
Reference in New Issue