Merge pull request #367 from lsst-it/IT-1657/no_authorized_keys

disable .ssh/authorized_keys by default; whitelist root & foreman users

hieradata/org/lsst.yaml

@@ -36,6 +36,9 @@ lookup_options:
   sssd::domains:
     merge:
       strategy: "deep"
+  ssh::server::match_block:
+    merge:
+      strategy: "deep"
   profile::core::systemd::tmpfile:
     merge:
       strategy: "deep"
@@ -88,6 +91,16 @@ ssh::server_options:
   KerberosAuthentication: "no"
   AuthorizedKeysCommand: "/usr/bin/sss_ssh_authorizedkeys"
   AuthorizedKeysCommandUser: "nobody"
+  AuthorizedKeysFile: "none"
+ssh::server::match_block:
+  root: &authorized_keys
+    type: "user"
+    options:
+      AuthorizedKeysFile: ".ssh/authorized_keys"
+  hreinking_b:
+    <<: *authorized_keys
+  jhoblitt_b:
+    <<: *authorized_keys
 
 # easy_ipa server options
 # defines the uid/gid of the admin user

hieradata/org/lsst/role/hypervisor.yaml

@@ -40,3 +40,8 @@ files:
     owner: "root"
     group: "root"
     mode: "0644"
+ssh::server::match_block:
+  foreman:
+    type: "user"
+    options:
+      AuthorizedKeysFile: ".ssh/authorized_keys"

site/profile/manifests/ccs/common.pp

@@ -22,4 +22,11 @@
 
   Class['java_artisanal']
   -> Class['ccs_software']
+
+  ssh::server::match_block { 'ccs':
+    type    => 'User',
+    options => {
+      'AuthorizedKeysFile' => '.ssh/authorized_keys',
+    }
+  }
 }