From 445981f9afecebb50e6bee35ca33f49386cfdaea Mon Sep 17 00:00:00 2001
From: Markus Frosch <markus.frosch@netways.de>
Date: Thu, 11 Sep 2014 11:50:14 +0200
Subject: [PATCH] Add sshd_listen parameter for ListenAddress

---
 manifests/init.pp         | 5 +++++
 spec/classes/init_spec.rb | 6 ++++++
 templates/sshd_config.erb | 7 +++++--
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/manifests/init.pp b/manifests/init.pp
index adc783d..6830edc 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -65,6 +65,7 @@ class ssh (
   $sshd_gssapicleanupcredentials    = 'USE_DEFAULTS',
   $sshd_acceptenv                   = 'USE_DEFAULTS',
   $sshd_config_hostkey              = 'USE_DEFAULTS',
+  $sshd_listen                      = undef,
   $service_ensure                   = 'running',
   $service_name                     = 'USE_DEFAULTS',
   $service_enable                   = 'true',
@@ -348,6 +349,10 @@ class ssh (
     $sshd_config_hostkey_real = $sshd_config_hostkey
   }
 
+  if $sshd_listen {
+    validate_array($sshd_listen)
+  }
+
   if $service_hasstatus == 'USE_DEFAULTS' {
     $service_hasstatus_real = $default_service_hasstatus
   } else {
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index f5a8efa..0977062 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -81,6 +81,7 @@ describe 'ssh' do
         it { should contain_file('sshd_config').with_content(/^GSSAPIAuthentication yes$/) }
         it { should contain_file('sshd_config').with_content(/^GSSAPICleanupCredentials yes$/) }
         it { should contain_file('sshd_config').with_content(/^HostKey \/etc\/ssh\/ssh_host_rsa_key$/) }
+        it { should contain_file('sshd_config').without_content(/^ListenAddress/) }
         it { should_not contain_file('sshd_config').with_content(/^\s*PAMAuthenticationViaKBDInt yes$/) }
         it { should_not contain_file('sshd_config').with_content(/^\s*GSSAPIKeyExchange no$/) }
         it { should_not contain_file('sshd_config').with_content(/^AuthorizedKeysFile/) }
@@ -882,6 +883,9 @@ describe 'ssh' do
         :sshd_config_allowgroups         => [ 'ssh',
                                               'security',
         ],
+        :sshd_listen                     => [ '192.168.1.1',
+                                              '2001:db8::dead:f00d',
+        ],
       }
     end
 
@@ -931,6 +935,8 @@ describe 'ssh' do
     it { should contain_file('sshd_config').with_content(/^\s*DenyGroups nossh wheel$/) }
     it { should contain_file('sshd_config').with_content(/^\s*AllowUsers foo bar$/) }
     it { should contain_file('sshd_config').with_content(/^\s*AllowGroups ssh security$/) }
+    it { should contain_file('sshd_config').with_content(/^ListenAddress 192.168.1.1$/) }
+    it { should contain_file('sshd_config').with_content(/^ListenAddress 2001:db8::dead:f00d$/) }
 
     it {
       should contain_file('sshd_banner').with({
diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb
index 0acebdd..e6f9958 100644
--- a/templates/sshd_config.erb
+++ b/templates/sshd_config.erb
@@ -18,8 +18,11 @@ Port <%= @sshd_config_port %>
 #Protocol 2,1
 Protocol 2
 #AddressFamily any
-#ListenAddress 0.0.0.0
-#ListenAddress ::
+<% if @sshd_listen -%>
+<% @sshd_listen.each do |val| -%>
+ListenAddress <%= val %>
+<% end -%>
+<% end -%>
 
 # HostKey for protocol version 1
 #HostKey /etc/ssh/ssh_host_key