Skip to content

Commit e6d15ee

Browse files
Improve the docs on the attribute overriding
Based on this feedback: #140 (comment)
1 parent 0a81810 commit e6d15ee

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

README.md

+7-2
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ This cookbook provides secure ssh-client and ssh-server configurations. This coo
2929

3030
Below you can find the attribute documentation and their default values.
3131

32+
Notice: Some of attribute defaults of this cookbook are set in the recipes. You should use a higher [attribute precedence](https://docs.chef.io/attributes.html#attribute-precedence) level for overriding of such attributes. Such attributes are flagged with `#override attribute#` in the list below. Example for overriding a such attribute:
33+
34+
```ruby
35+
override['ssh-hardening']['ssh']['server']['listen_to'] = node['ipaddress']
36+
```
37+
3238
* `['ssh-hardening']['network']['ipv6']['enable']` - `false`. Set to true if IPv6 is needed
3339
* `['ssh-hardening']['ssh']['ports']` - `22`. Ports to which ssh-server should listen to and ssh-client should connect to
3440
* `['ssh-hardening']['ssh'][{'client', 'server'}]['kex']` - `nil` to calculate best key-exchange (KEX) based on server version, otherwise specify a string of Kex values
@@ -40,7 +46,7 @@ Below you can find the attribute documentation and their default values.
4046
* `['ssh-hardening']['ssh']['client']['remote_hosts']` - `[]` - one or more hosts, to which ssh-client can connect to.
4147
* `['ssh-hardening']['ssh']['client']['password_authentication']` - `false`. Set to `true` if password authentication should be enabled.
4248
* `['ssh-hardening']['ssh']['client']['roaming']` - `false`. Set to `true` if experimental client roaming should be enabled. This is known to cause potential issues with secrets being disclosed to malicious servers and defaults to being disabled.
43-
* `['ssh-hardening']['ssh']['server']['listen_to']` - one or more ip addresses, to which ssh-server should listen to. Default is to listen on all interfaces. It should be configured for security reasons!
49+
* `['ssh-hardening']['ssh']['server']['listen_to']` `#override attribute#` - one or more ip addresses, to which ssh-server should listen to. Default is to listen on all interfaces. It should be configured for security reasons!
4450
* `['ssh-hardening']['ssh']['server']['allow_root_with_key']` - `false` to disable root login altogether. Set to `true` to allow root to login via key-based mechanism
4551
* `['ssh-hardening']['ssh']['server']['allow_tcp_forwarding']` - `false`. Set to `true` to allow TCP Forwarding
4652
* `['ssh-hardening']['ssh']['server']['allow_agent_forwarding']` - `false`. Set to `true` to allow Agent Forwarding
@@ -65,7 +71,6 @@ Below you can find the attribute documentation and their default values.
6571
* `['ssh-hardening']['ssh']['server']['sftp']['group']` - `sftponly`. Sets the `Match Group` option of SFTP to allow SFTP only for dedicated users
6672
* `['ssh-hardening']['ssh']['server']['sftp']['chroot']` - `/home/%u`. Sets the directory where the SFTP user should be chrooted
6773

68-
Notice: Some of attribute defaults of this cookbook are set in the recipes. Its a good idea to use a higher [attribute precedence](https://docs.chef.io/attributes.html#attribute-precedence) level for attribute overriding. Otherwise you might get unexpected results.
6974

7075
## Usage
7176

0 commit comments

Comments
 (0)