Add parameters to ssh_config and sshd_config

README.md

@@ -61,6 +61,24 @@ ssh_config's mode.
 
 - *Default*: '0644'
 
+ssh_config_forward_x11
+----------------------
+ForwardX11 option in ssh_config. Not set by default.
+
+- *Default*: undef
+
+ssh_config_forward_agent
+------------------------
+ForwardAgent option in ssh_config. Not set by default.
+
+- *Default*: undef
+
+ssh_config_server_alive_interval
+--------------------------------
+ServerAliveInterval option in ssh_config. Not set by default.
+
+- *Default*: undef
+
 sshd_config_path
 ----------------
 Path to sshd_config.
@@ -85,6 +103,54 @@ sshd_config's mode.
 
 - *Default*: '0600'
 
+sshd_config_syslog_facility
+---------------------------
+SyslogFacility option in sshd_config.
+
+- *Default*: 'AUTH'
+
+sshd_config_login_grace_time
+----------------------------
+LoginGraceTime option in sshd_config.
+
+- *Default*: '120'
+
+sshd_config_challenge_resp_auth
+-------------------------------
+ChallengeResponseAuthentication option in sshd_config.
+
+- *Default*: 'no'
+
+sshd_config_print_motd
+----------------------
+PrintMotd option in sshd_config.
+
+- *Default*: 'yes'
+
+sshd_config_use_dns
+-------------------
+UseDNS option in sshd_config.
+
+- *Default*: 'yes'
+
+sshd_config_banner
+------------------
+Banner option in sshd_config.
+
+- *Default*: 'none'
+
+sshd_config_xauth_location
+--------------------------
+XAuthLocation option in sshd_config.
+
+- *Default*: '/usr/bin/xauth'
+
+sshd_config_subsystem_sftp
+--------------------------
+Path to sftp file transfer subsystem in sshd_config.
+
+- *Default*: '/usr/libexec/openssh/sftp-server'
+
 service_ensure
 --------------
 Ensure SSH service is running. Valid values are 'stopped' and 'running'.

manifests/init.pp

@@ -141,10 +141,21 @@ class ssh (
   $ssh_config_owner                 = 'root',
   $ssh_config_group                 = 'root',
   $ssh_config_mode                  = '0644',
+  $ssh_config_forward_x11           = undef,
+  $ssh_config_forward_agent         = undef,
+  $ssh_config_server_alive_interval = undef,
   $sshd_config_path                 = '/etc/ssh/sshd_config',
   $sshd_config_owner                = 'root',
   $sshd_config_group                = 'root',
   $sshd_config_mode                 = '0600',
+  $sshd_config_syslog_facility      = 'AUTH',
+  $sshd_config_login_grace_time     = '120',
+  $sshd_config_challenge_resp_auth  = 'no',
+  $sshd_config_print_motd           = 'yes',
+  $sshd_config_use_dns              = 'yes',
+  $sshd_config_banner               = 'none',
+  $sshd_config_xauth_location       = '/usr/bin/xauth',
+  $sshd_config_subsystem_sftp       = '/usr/libexec/openssh/sftp-server',
   $service_ensure                   = 'running',
   $service_name                     = 'sshd',
   $service_enable                   = 'true',

templates/ssh_config.erb

@@ -50,6 +50,15 @@ Host *
 # to the original X11 display. As virtually no X11 client supports the untrusted
 # mode correctly we set this to yes.
   ForwardX11Trusted yes
+<% if @ssh_config_forward_agent -%>
+  ForwardAgent <%= @ssh_config_forward_agent %>
+<% end -%>
+<% if @ssh_config_forward_x11 -%>
+  ForwardX11 <%= @ssh_config_forward_x11 %>
+<% end -%>
+<% if @ssh_config_server_alive_interval -%>
+  ServerAliveInterval <%= @ssh_config_server_alive_interval %>
+<% end -%>
 # Send locale-related environment variables
   SendEnv LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
   SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT

templates/sshd_config.erb

@@ -33,12 +33,13 @@ Protocol 2
 # Logging
 # obsoletes QuietMode and FascistLogging
 #SyslogFacility AUTH
-SyslogFacility AUTHPRIV
+SyslogFacility <%= @sshd_config_syslog_facility %>
 #LogLevel INFO
 
 # Authentication:
 
-#LoginGraceTime 2m
+#LoginGraceTime 120
+LoginGraceTime <%= @sshd_config_login_grace_time %>
 PermitRootLogin <%= @permit_root_login %>
 #StrictModes yes
 #MaxAuthTries 6
@@ -64,7 +65,7 @@ PasswordAuthentication yes
 
 # Change to no to disable s/key passwords
 #ChallengeResponseAuthentication yes
-ChallengeResponseAuthentication no
+ChallengeResponseAuthentication <%= @sshd_config_challenge_resp_auth %>
 
 # Kerberos options
 #KerberosAuthentication no
@@ -100,6 +101,7 @@ X11Forwarding yes
 #X11DisplayOffset 10
 #X11UseLocalhost yes
 #PrintMotd yes
+PrintMotd <%= @sshd_config_print_motd %>
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
@@ -110,13 +112,18 @@ X11Forwarding yes
 #ClientAliveCountMax 3
 #ShowPatchLevel no
 #UseDNS yes
+UseDNS <%= @sshd_config_use_dns %>
 #PidFile /var/run/sshd.pid
 #MaxStartups 10
 #PermitTunnel no
 #ChrootDirectory none
 
 # no default banner path
-##Banner /etc/motd
+#Banner none
+Banner <%= @sshd_config_banner %>
+
+#XAuthLocation /usr/bin/xauth
+XAuthLocation <%= @sshd_config_xauth_location %>
 
 # override default of no subsystems
-Subsystem	sftp	/usr/libexec/openssh/sftp-server
+Subsystem	sftp	<%= @sshd_config_subsystem_sftp %>