Showing with 66 additions and 7 deletions.
  1. +1 −1 Modulefile
  2. +6 −0 README.md
  3. +16 −3 manifests/init.pp
  4. +1 −1 metadata.json
  5. +38 −1 spec/classes/init_spec.rb
  6. +4 −1 templates/sshd_config.erb
2 changes: 1 addition & 1 deletion Modulefile
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
name 'ghoneycutt-ssh'
version '3.20.0'
version '3.21.0'
source 'git://github.com/ghoneycutt/puppet-module-ssh.git'
author 'ghoneycutt'
license 'Apache License, Version 2.0'
Expand Down
6 changes: 6 additions & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,12 @@ Specify location of authorized_keys file. Default is to not specify.

- *Default*: undef

sshd_config_hostkey
----------------------------
Specify an array of server side HostKey files to use. Default is to use only /etc/ssh/ssh_host_rsa_key

- *Default*: /etc/ssh/ssh_host_rsa_key

sshd_config_strictmodes
----------------------------
Specifies whether sshd should check file modes and ownership of the user's files and home directory before accepting login. Valid values are yes and no.
Expand Down
19 changes: 16 additions & 3 deletions manifests/init.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@
$sshd_pamauthenticationviakbdint = 'USE_DEFAULTS',
$sshd_gssapicleanupcredentials = 'USE_DEFAULTS',
$sshd_acceptenv = 'USE_DEFAULTS',
$sshd_config_hostkey = 'USE_DEFAULTS',
$service_ensure = 'running',
$service_name = 'USE_DEFAULTS',
$service_enable = 'true',
Expand Down Expand Up @@ -98,6 +99,7 @@
$default_sshd_acceptenv = true
$default_service_hasstatus = true
$default_sshd_config_serverkeybits = '1024'
$default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key' ]
}
'Suse': {
$default_packages = 'openssh'
Expand All @@ -117,6 +119,7 @@
$default_sshd_acceptenv = true
$default_service_hasstatus = true
$default_sshd_config_serverkeybits = '1024'
$default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key' ]
case $::architecture {
'x86_64': {
$default_sshd_config_subsystem_sftp = '/usr/lib64/ssh/sftp-server'
Expand Down Expand Up @@ -149,6 +152,7 @@
$default_sshd_acceptenv = true
$default_service_hasstatus = true
$default_sshd_config_serverkeybits = '1024'
$default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key' ]
}
'Solaris': {
$default_ssh_config_hash_known_hosts = undef
Expand All @@ -165,6 +169,7 @@
$default_sshd_acceptenv = false
$default_sshd_config_serverkeybits = '768'
$default_ssh_package_adminfile = undef
$default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key' ]
case $::kernelrelease {
'5.11': {
$default_packages = ['network/ssh',
Expand Down Expand Up @@ -335,6 +340,14 @@
}
}

if $sshd_config_hostkey == 'USE_DEFAULTS' {
$sshd_config_hostkey_real = $default_sshd_config_hostkey
} else {
validate_array($sshd_config_hostkey)
validate_absolute_path(join($sshd_config_hostkey))
$sshd_config_hostkey_real = $sshd_config_hostkey
}

if $service_hasstatus == 'USE_DEFAULTS' {
$service_hasstatus_real = $default_service_hasstatus
} else {
Expand Down Expand Up @@ -618,9 +631,9 @@

# export each node's ssh key
@@sshkey { $::fqdn :
ensure => $ssh_key_ensure,
type => $ssh_key_type,
key => $key,
ensure => $ssh_key_ensure,
type => $ssh_key_type,
key => $key,
}

if $ssh_key_import_real == true {
Expand Down
2 changes: 1 addition & 1 deletion metadata.json
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "ghoneycutt-ssh",
"version": "3.20.0",
"version": "3.21.0",
"author": "ghoneycutt",
"summary": "Manages SSH",
"license": "Apache License, Version 2.0",
Expand Down
39 changes: 38 additions & 1 deletion spec/classes/init_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -855,6 +855,9 @@
:sshd_config_serverkeybits => '1024',
:sshd_client_alive_count_max => '0',
:sshd_config_authkey_location => '.ssh/authorized_keys',
:sshd_config_hostkey => [ '/etc/ssh/ssh_host_rsa_key',
'/etc/ssh/ssh_host_dsa_key',
],
:sshd_config_strictmodes => 'yes',
:sshd_config_ciphers => [ 'aes128-cbc',
'3des-cbc',
Expand Down Expand Up @@ -915,11 +918,12 @@
it { should contain_file('sshd_config').with_content(/^ClientAliveCountMax 0$/) }
it { should contain_file('sshd_config').with_content(/^GSSAPIAuthentication yes$/) }
it { should contain_file('sshd_config').with_content(/^GSSAPICleanupCredentials yes$/) }
it { should contain_file('sshd_config').with_content(/^HostKey \/etc\/ssh\/ssh_host_rsa_key$/) }
it { should_not contain_file('sshd_config').with_content(/^\s*PAMAuthenticationViaKBDInt yes$/) }
it { should_not contain_file('sshd_config').with_content(/^\s*GSSAPIKeyExchange yes$/) }
it { should contain_file('sshd_config').with_content(/^AcceptEnv L.*$/) }
it { should contain_file('sshd_config').with_content(/^AuthorizedKeysFile .ssh\/authorized_keys/) }
it { should contain_file('sshd_config').with_content(/^HostKey \/etc\/ssh\/ssh_host_rsa_key/) }
it { should contain_file('sshd_config').with_content(/^HostKey \/etc\/ssh\/ssh_host_dsa_key/) }
it { should contain_file('sshd_config').with_content(/^StrictModes yes$/) }
it { should contain_file('sshd_config').with_content(/^\s*Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc$/) }
it { should contain_file('sshd_config').with_content(/^\s*MACs hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com$/) }
Expand Down Expand Up @@ -1459,6 +1463,39 @@
end
end

context 'with sshd_config_hostkey set to invalid value on valid osfamily' do
let(:params) { { :sshd_config_hostkey => false } }
let(:facts) do
{ :fqdn => 'monkey.example.com',
:osfamily => 'RedHat',
:sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ=='
}
end

it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error,/is not an Array/)
end
end

context 'with sshd_config_hostkey set to invalid path on valid osfamily' do
let(:params) { { :sshd_config_hostkey => ['not_a_path'] } }
let(:facts) do
{ :fqdn => 'monkey.example.com',
:osfamily => 'RedHat',
:sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ=='
}
end

it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error,/is not an absolute path./)
end
end


context 'with sshd_config_strictmodes set to invalid value on valid osfamily' do
let :facts do
{
Expand Down
5 changes: 4 additions & 1 deletion templates/sshd_config.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,11 @@ Protocol 2
# HostKey for protocol version 1
#HostKey /etc/ssh/ssh_host_key
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_dsa_key
<% @sshd_config_hostkey_real.each do |hostkey| -%>
HostKey <%= hostkey %>
<% end -%>

# Lifetime and size of ephemeral version 1 server key
#KeyRegenerationInterval 1h
Expand Down