opendev/system-config
Code Issues Proposed changes

Merge "bridge: Disable writing known_hosts files"

Browse Source
This commit is contained in:
Zuul 2022-12-01 22:54:43 +00:00 committed by Gerrit Code Review
commit 76fc51c3b0
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
playbooks/roles/add-inventory-known-hosts/tasks/main.yaml
View File

@ -29,3 +29,12 @@
group: root group: root
mode: 0644 mode: 0644
create: yes create: yes
# Disable writing out known_hosts globally on the bastion host.
# Nothing on this host should be connecting to somewhere not codified
# above; this prevents us possibly hiding that by caching values.
- name: Disable known_hosts caching
lineinfile:
path: /etc/ssh/ssh_config
regexp: 'UserKnownHostsFile'
line: ' UserKnownHostsFile /dev/null'