From 3f623d5cb66802167bfcf008c8598c5efa7d281c Mon Sep 17 00:00:00 2001 From: Francisco Calero Date: Wed, 22 Jan 2020 16:08:03 +0100 Subject: [PATCH 1/4] Added sles15 resolved issue #320 --- README.md | 1 + manifests/init.pp | 20 +++++++++++++++----- metadata.json | 3 ++- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index d2b934d..8eab242 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,7 @@ for the exact matrix of supported Puppet and ruby versions. * SLES 10 * SLES 11 * SLES 12 + * SLES 15 * Ubuntu 12.04 LTS * Ubuntu 14.04 LTS * Ubuntu 16.04 LTS diff --git a/manifests/init.pp b/manifests/init.pp index 66788b9..c077a75 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -171,17 +171,27 @@ class ssh ( $default_sshd_gssapicleanupcredentials = 'yes' $default_sshd_acceptenv = true $default_service_hasstatus = true - $default_sshd_config_serverkeybits = '1024' $default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key' ] $default_sshd_addressfamily = 'any' $default_sshd_config_tcp_keepalive = 'yes' $default_sshd_config_permittunnel = 'no' case $::architecture { 'x86_64': { - if ($::operatingsystem == 'SLES') and ($::operatingsystemrelease =~ /^12\./) { - $default_sshd_config_subsystem_sftp = '/usr/lib/ssh/sftp-server' - } else { - $default_sshd_config_subsystem_sftp = '/usr/lib64/ssh/sftp-server' + if ($::operatingsystem == 'SLES') { + case $::operatingsystemrelease { + /12\./: { + $default_sshd_config_subsystem_sftp = '/usr/lib/ssh/sftp-server' + $default_sshd_config_serverkeybits = '1024' + } + /15\./: { + $default_sshd_config_subsystem_sftp = '/usr/lib/ssh/sftp-server' + $default_sshd_config_serverkeybits = undef + } + default: { + $default_sshd_config_subsystem_sftp = '/usr/lib64/ssh/sftp-server' + $default_sshd_config_serverkeybits = '1024' + } + } } } 'i386' : { diff --git a/metadata.json b/metadata.json index 3ca9272..cf2d066 100644 --- a/metadata.json +++ b/metadata.json @@ -67,7 +67,8 @@ "operatingsystemrelease": [ "10", "11", - "12" + "12", + "15" ] }, { From ad7e98e8605e08815b36de59d342cd80b8797c87 Mon Sep 17 00:00:00 2001 From: "Francisco Calero (UNIX)" Date: Thu, 21 Oct 2021 13:05:30 +0200 Subject: [PATCH 2/4] Added spec for sles15sp3 --- spec/classes/init_spec.rb | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index 5ca3914..783902f 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -193,6 +193,20 @@ describe 'ssh' do :sshd_config_fixture => 'sshd_config_sles_12_x86_64', :ssh_config_fixture => 'ssh_config_suse', }, + 'Suse-15-x86_64' => { + :architecture => 'x86_64', + :osfamily => 'Suse', + :operatingsystem => 'SLES', + :operatingsystemrelease => '15.3', + :ssh_version => 'OpenSSH_8.4p1', + :ssh_version_numeric => '8.4', + :ssh_packages => ['openssh'], + :sshd_config_mode => '0600', + :sshd_service_name => 'sshd', + :sshd_service_hasstatus => true, + :sshd_config_fixture => 'sshd_config_sles_15_x86_64', + :ssh_config_fixture => 'ssh_config_suse', + }, 'Solaris-5.11' => { :architecture => 'i86pc', :osfamily => 'Solaris', From 58ea7fe1dc340daac84bf8c5f9eb4f679edb62d6 Mon Sep 17 00:00:00 2001 From: "Francisco Calero (UNIX)" Date: Thu, 21 Oct 2021 13:14:52 +0200 Subject: [PATCH 3/4] Added fixture file for sles15 --- spec/fixtures/sshd_config_sles_15_x86_64 | 143 +++++++++++++++++++++++ 1 file changed, 143 insertions(+) create mode 100644 spec/fixtures/sshd_config_sles_15_x86_64 diff --git a/spec/fixtures/sshd_config_sles_15_x86_64 b/spec/fixtures/sshd_config_sles_15_x86_64 new file mode 100644 index 0000000..f1a3f5a --- /dev/null +++ b/spec/fixtures/sshd_config_sles_15_x86_64 @@ -0,0 +1,143 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT + +# $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options change a +# default value. + +#Port 22 +Port 22 +#Protocol 2,1 +Protocol 2 +#AddressFamily any +AddressFamily any + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_rsa_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 +ServerKeyBits 1024 +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +SyslogFacility AUTH +#LogLevel INFO +LogLevel INFO + +# Authentication: + +#LoginGraceTime 120 +LoginGraceTime 120 +#PermitRootLogin yes +PermitRootLogin yes +#StrictModes yes +#MaxAuthTries 6 + +#RSAAuthentication yes +#PubkeyAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile .ssh/authorized_keys + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes +IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes +ChallengeResponseAuthentication yes + +# Kerberos options +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +GSSAPIAuthentication yes +#GSSAPICleanupCredentials yes +GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication mechanism. +# Depending on your PAM configuration, this may bypass the setting of +# PasswordAuthentication, PermitEmptyPasswords, and +# "PermitRootLogin without-password". If you just want the PAM account and +# session checks to run without PAM authentication, then enable this but set +# ChallengeResponseAuthentication=no +#UsePAM no +UsePAM yes + +# Accept locale-related environment variables +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL +#AllowTcpForwarding yes +AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +X11UseLocalhost yes +#PrintMotd yes +PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +TCPKeepAlive yes +#UseLogin no +#UsePrivilegeSeparation yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +ClientAliveInterval 0 +ClientAliveCountMax 3 +#ShowPatchLevel no +#UseDNS yes +UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#MaxSessions 10 + +#PermitTunnel no +PermitTunnel no +#ChrootDirectory none + +# no default banner path +#Banner none +Banner none + +#XAuthLocation /usr/bin/xauth +XAuthLocation /usr/bin/xauth + +# override default of no subsystems +Subsystem sftp /usr/lib/ssh/sftp-server + From 25f7d44ae4974289d91d28d9102b8047cbd21fa6 Mon Sep 17 00:00:00 2001 From: "Francisco Calero (UNIX)" Date: Thu, 21 Oct 2021 13:30:10 +0200 Subject: [PATCH 4/4] Removed duplicated code --- manifests/init.pp | 4 ---- 1 file changed, 4 deletions(-) diff --git a/manifests/init.pp b/manifests/init.pp index 46dc431..113a6f1 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -185,10 +185,6 @@ class ssh ( 'x86_64': { if ($::operatingsystem == 'SLES') { case $::operatingsystemrelease { - /12\./: { - $default_sshd_config_subsystem_sftp = '/usr/lib/ssh/sftp-server' - $default_sshd_config_serverkeybits = '1024' - } /15\./: { $default_sshd_config_subsystem_sftp = '/usr/lib/ssh/sftp-server' $default_sshd_config_serverkeybits = undef