Showing with 132 additions and 100 deletions.
  1. +65 −60 manifests/init.pp
  2. +1 −1 metadata.json
  3. +66 −39 spec/classes/init_spec.rb
125 changes: 65 additions & 60 deletions manifests/init.pp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
$hiera_merge = false,
$packages = 'USE_DEFAULTS',
$permit_root_login = 'yes',
$purge_keys = 'true',
$purge_keys = true,
$manage_firewall = false,
$ssh_package_source = 'USE_DEFAULTS',
$ssh_package_adminfile = 'USE_DEFAULTS',
Expand Down Expand Up @@ -76,18 +76,18 @@
$sshd_listen_address = undef,
$service_ensure = 'running',
$service_name = 'USE_DEFAULTS',
$service_enable = 'true',
$service_hasrestart = 'true',
$service_enable = true,
$service_hasrestart = true,
$service_hasstatus = 'USE_DEFAULTS',
$ssh_key_ensure = 'present',
$ssh_key_import = 'true',
$ssh_key_import = true,
$ssh_key_type = 'ssh-rsa',
$ssh_config_global_known_hosts_file = '/etc/ssh/ssh_known_hosts',
$ssh_config_global_known_hosts_owner = 'root',
$ssh_config_global_known_hosts_group = 'root',
$ssh_config_global_known_hosts_mode = '0644',
$keys = undef,
$manage_root_ssh_config = 'false',
$manage_root_ssh_config = false,
$root_ssh_config_content = "# This file is being maintained by Puppet.\n# DO NOT EDIT\n",
) {

Expand Down Expand Up @@ -495,18 +495,12 @@
}
}

case type($ssh_key_import) {
'string': {
validate_re($ssh_key_import, '^(true|false)$', "ssh::ssh_key_import may be either 'true' or 'false' and is set to <${ssh_key_import}>.")
$ssh_key_import_real = str2bool($ssh_key_import)
}
'boolean': {
$ssh_key_import_real = $ssh_key_import
}
default: {
fail('ssh::ssh_key_import type must be true or false.')
}
if type($ssh_key_import) == 'string' {
$ssh_key_import_real = str2bool($ssh_key_import)
} else {
$ssh_key_import_real = $ssh_key_import
}
validate_bool($ssh_key_import_real)

case type($ssh_config_sendenv_xmodifiers) {
'string': {
Expand Down Expand Up @@ -547,14 +541,33 @@
validate_re($ssh_config_global_known_hosts_mode, '^[0-7]{4}$',
"ssh::ssh_config_global_known_hosts_mode must be a valid 4 digit mode in octal notation. Detected value is <${ssh_config_global_known_hosts_mode}>.")

case $purge_keys {
'true','false': {
# noop
}
default: {
fail("ssh::purge_keys must be 'true' or 'false' and is <${purge_keys}>.")
}
if type($purge_keys) == 'string' {
$purge_keys_real = str2bool($purge_keys)
} else {
$purge_keys_real = $purge_keys
}
validate_bool($purge_keys_real)

if type($service_enable) == 'string' {
$service_enable_real = str2bool($service_enable)
} else {
$service_enable_real = $service_enable
}
validate_bool($service_enable_real)

if type($service_hasrestart) == 'string' {
$service_hasrestart_real = str2bool($service_hasrestart)
} else {
$service_hasrestart_real = $service_hasrestart
}
validate_bool($service_hasrestart_real)

if type($manage_root_ssh_config) == 'string' {
$manage_root_ssh_config_real = str2bool($manage_root_ssh_config)
} else {
$manage_root_ssh_config_real = $manage_root_ssh_config
}
validate_bool($manage_root_ssh_config_real)

#ssh_config template
validate_string($ssh_config_template)
Expand All @@ -579,20 +592,20 @@
$sshd_config_allowusers_real = $sshd_config_allowusers
}

if $real_sshd_config_denyusers != undef {
validate_array($real_sshd_config_denyusers)
if $sshd_config_denyusers_real != undef {
validate_array($sshd_config_denyusers_real)
}

if $real_sshd_config_denygroups != undef {
validate_array($real_sshd_config_denygroups)
if $sshd_config_denygroups_real != undef {
validate_array($sshd_config_denygroups_real)
}

if $real_sshd_config_allowusers != undef {
validate_array($real_sshd_config_allowusers)
if $sshd_config_allowusers_real != undef {
validate_array($sshd_config_allowusers_real)
}

if $real_sshd_config_allowgroups != undef {
validate_array($real_sshd_config_allowgroups)
if $sshd_config_allowgroups_real != undef {
validate_array($sshd_config_allowgroups_real)
}

package { $packages_real:
Expand Down Expand Up @@ -633,44 +646,36 @@
}
}

case $manage_root_ssh_config {
'true': {

include common
if $manage_root_ssh_config_real == true {

common::mkdir_p { "${::root_home}/.ssh": }
include common

file { 'root_ssh_dir':
ensure => directory,
path => "${::root_home}/.ssh",
owner => 'root',
group => 'root',
mode => '0700',
require => Common::Mkdir_p["${::root_home}/.ssh"],
}
common::mkdir_p { "${::root_home}/.ssh": }

file { 'root_ssh_config':
ensure => file,
path => "${::root_home}/.ssh/config",
content => $root_ssh_config_content,
owner => 'root',
group => 'root',
mode => '0600',
}
}
'false': {
# noop
file { 'root_ssh_dir':
ensure => directory,
path => "${::root_home}/.ssh",
owner => 'root',
group => 'root',
mode => '0700',
require => Common::Mkdir_p["${::root_home}/.ssh"],
}
default: {
fail("ssh::manage_root_ssh_config is <${manage_root_ssh_config}> and must be \'true\' or \'false\'.")

file { 'root_ssh_config':
ensure => file,
path => "${::root_home}/.ssh/config",
content => $root_ssh_config_content,
owner => 'root',
group => 'root',
mode => '0600',
}
}

service { 'sshd_service' :
ensure => $service_ensure,
name => $service_name_real,
enable => $service_enable,
hasrestart => $service_hasrestart,
enable => $service_enable_real,
hasrestart => $service_hasrestart_real,
hasstatus => $service_hasstatus_real,
subscribe => File['sshd_config'],
}
Expand Down Expand Up @@ -707,7 +712,7 @@

# remove ssh key's not managed by puppet
resources { 'sshkey':
purge => $purge_keys,
purge => $purge_keys_real,
}

# manage users' ssh authorized keys if present
Expand Down
2 changes: 1 addition & 1 deletion metadata.json
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "ghoneycutt-ssh",
"version": "3.27.1",
"version": "3.27.2",
"author": "ghoneycutt",
"summary": "Manages SSH",
"license": "Apache-2.0",
Expand Down
105 changes: 66 additions & 39 deletions spec/classes/init_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1342,45 +1342,73 @@
end
end

context 'with manage_root_ssh_config set to \'true\' on valid osfamily' do
let :facts do
{
:fqdn => 'monkey.example.com',
:osfamily => 'RedHat',
:root_home => '/root',
:sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ=='
['true',true].each do |value|
context "with manage_root_ssh_config set to #{value} on valid osfamily" do
let :facts do
{
:fqdn => 'monkey.example.com',
:osfamily => 'RedHat',
:root_home => '/root',
:sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ=='
}
end
let :params do
{ :manage_root_ssh_config => value }
end

it { should compile.with_all_deps }

it { should contain_class('ssh')}

it { should contain_class('common')}

it {
should contain_file('root_ssh_dir').with({
'ensure' => 'directory',
'path' => '/root/.ssh',
'owner' => 'root',
'group' => 'root',
'mode' => '0700',
'require' => 'Common::Mkdir_p[/root/.ssh]',
})
}

it {
should contain_file('root_ssh_config').with({
'ensure' => 'file',
'path' => '/root/.ssh/config',
'owner' => 'root',
'group' => 'root',
'mode' => '0600',
})
}
end
let :params do
{ :manage_root_ssh_config => 'true' }
end
end

it { should compile.with_all_deps }
['false',false].each do |value|
context "with manage_root_ssh_config set to #{value} on valid osfamily" do
let :facts do
{
:fqdn => 'monkey.example.com',
:osfamily => 'RedHat',
:root_home => '/root',
:sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ=='
}
end
let :params do
{ :manage_root_ssh_config => value }
end

it { should contain_class('ssh')}
it { should compile.with_all_deps }

it { should contain_class('common')}
it { should contain_class('ssh')}

it {
should contain_file('root_ssh_dir').with({
'ensure' => 'directory',
'path' => '/root/.ssh',
'owner' => 'root',
'group' => 'root',
'mode' => '0700',
'require' => 'Common::Mkdir_p[/root/.ssh]',
})
}
it { should_not contain_class('common')}

it {
should contain_file('root_ssh_config').with({
'ensure' => 'file',
'path' => '/root/.ssh/config',
'owner' => 'root',
'group' => 'root',
'mode' => '0600',
})
}
it { should_not contain_file('root_ssh_dir') }

it { should_not contain_file('root_ssh_config') }
end
end

[true,'invalid'].each do |ciphers|
Expand Down Expand Up @@ -1477,7 +1505,7 @@
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error)
}.to raise_error(Puppet::Error,/is not an Array/)
end
end
end
Expand All @@ -1497,7 +1525,7 @@
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error)
}.to raise_error(Puppet::Error,/is not an Array/)
end
end
end
Expand All @@ -1517,7 +1545,7 @@
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error)
}.to raise_error(Puppet::Error,/is not an Array/)
end
end
end
Expand All @@ -1537,7 +1565,7 @@
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error)
}.to raise_error(Puppet::Error,/is not an Array/)
end
end
end
Expand Down Expand Up @@ -1597,7 +1625,7 @@
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error,/^ssh::manage_root_ssh_config is <invalid> and must be \'true\' or \'false\'\./)
}.to raise_error(Puppet::Error,/Unknown type of boolean/)
end
end

Expand Down Expand Up @@ -2930,8 +2958,7 @@
'group' => 'root',
'mode' => '0644',
})
}

}
end
end

Expand Down