ssh-server: add option to disable forwarding

ssh-server/defaults/main.yml

@@ -8,3 +8,4 @@ ssh_password_auth: true
 ssh_gssapi: true
 ssh_sftp_options: ""
 ssh_allow_groups: []
+ssh_allow_forwarding: true

ssh-server/templates/sshd_config_stretch.j2

@@ -56,8 +56,16 @@ PasswordAuthentication {{ 'yes' if ssh_password_auth else 'no' }}
 GSSAPIAuthentication {{ 'yes' if ssh_gssapi else 'no' }}
 #GSSAPICleanupCredentials yes
 
+{% if ssh_allow_forwarding %}
 X11Forwarding yes
 X11DisplayOffset 10
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+{% else %}
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+{% endif %}
 PrintMotd no
 PrintLastLog yes
 TCPKeepAlive yes