Default SSH Client Configuration¶

The default configuration of the SSH client can be configured as follows:

Allow X-Forwarding¶

Due to security reasons X-Forwarding is disabled by default. But you can enable it with

ssh_client::forward_x11: true

Known Hosts¶

You may configure the public keys of host you often work with:

ssh_client::known_hosts:
  - 'bitbucket.org ecdsa-sha2-nistp256 AAAAE2...'
  - 'bitbucket.org ssh-ed25519 AAAAC3...'

Host Trust (Host-based Authentication)¶

If SSH host trust should be tried by default, enable it with

ssh_client::try_host_trust: true

For details on how to make the target host accept this host trust for root, check out the SSH Host Hopping as Root guide.

Here is a more generic guide on how to allow this on server side. Note that for host-based authentication to work the clients host ssh key must be known/trusted by the server. Our puppet managed RHEL nodes have a certificate for their host key which makes them trust each other automatically.

Hostname Canonicalization¶

This feature automatically turns short hostnames into fully qualified *.psi.ch names. It will then also reapply the configuration again on the fully qualified hostname.

ssh_client::canonicalize_hostname: true

By default this is disabled.