Add the confine_ssh task

This is required by the drbackup stuff, which is required to migrate
Dist Git to ansible.

files/scripts/confine-ssh.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Confine ssh commands
+case "$SSH_ORIGINAL_COMMAND" in
+*\&*)
+echo "Rejected"
+;;
+*\;*)
+echo "Rejected"
+;;
+rsync\ --server\ --sender*)
+$SSH_ORIGINAL_COMMAND
+;;
+*)
+echo "Rejected"
+;;
+esac

tasks/confine_ssh.yml

@@ -0,0 +1,6 @@
+---
+- name: install the confine-ssh script
+  copy: >
+    src={{files}}/scripts/confine-ssh.sh
+    dest=/usr/local/bin/confine-ssh.sh
+    mode=0755