From 7181e04c5783d3f679029d0f4d883f080f86c7e2 Mon Sep 17 00:00:00 2001 From: sivel / Matt Martz Date: Fri, 5 Jun 2026 08:09:10 -0500 Subject: [PATCH] ssh - document concerns with `LocalForward` (#87035) * Add docs indicating that LocalFoward along with the defaults can lead to an insecure config --- lib/ansible/plugins/connection/ssh.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/ansible/plugins/connection/ssh.py b/lib/ansible/plugins/connection/ssh.py index 3fa2a1b2357..1171324365d 100644 --- a/lib/ansible/plugins/connection/ssh.py +++ b/lib/ansible/plugins/connection/ssh.py @@ -19,8 +19,9 @@ DOCUMENTATION = """ - connection_pipelining version_added: historical notes: - - This plugin is mostly a wrapper to the ``ssh`` CLI utility and the exact behavior of the options depends on this tool. - This means that the documentation provided here is subject to be overridden by the CLI tool itself. + - This plugin is mostly a wrapper to the C(ssh) CLI utility and the exact behavior of the options depends on this tool. + - The documentation provided here is subject to be overridden by configurations of C(ssh) itself. + - External configurations of the C(ssh) client CLI can lead to insecure configurations. - Many options default to V(None) here but that only means we do not override the SSH tool's defaults and/or configuration. For example, if you specify the port in this plugin it will override any C(Port) entry in your C(.ssh/config). - The ssh CLI tool uses return code 255 as a 'connection error', this can conflict with commands/tools that @@ -92,7 +93,9 @@ DOCUMENTATION = """ - name: ansible_sshpass_prompt version_added: '2.10' ssh_args: - description: Arguments to pass to all SSH CLI tools. + description: Arguments to pass to all SSH CLI tools. The use of C(LocalForward)/C(-L) + along with the default C(-C) can lead to an insecure configuration. Ensure + these options are not used in combination. default: '-C -o ControlMaster=auto -o ControlPersist=60s' type: string ini: