From 49c799afb33d947e233593f8371c80058c15bcd7 Mon Sep 17 00:00:00 2001 From: Florian Faltermeier Date: Tue, 7 Jun 2016 15:52:42 +0200 Subject: [PATCH] add support for PubkeyAuthentication in sshd_config --- README.md | 6 +++++ manifests/init.pp | 3 +++ spec/classes/init_spec.rb | 34 ++++++++++++++++++++++++ spec/fixtures/sshd_config_debian | 1 + spec/fixtures/sshd_config_rhel | 1 + spec/fixtures/sshd_config_sles_12_x86_64 | 1 + spec/fixtures/sshd_config_solaris | 1 + spec/fixtures/sshd_config_suse_i386 | 1 + spec/fixtures/sshd_config_suse_x86_64 | 1 + templates/sshd_config.erb | 1 + 10 files changed, 50 insertions(+) diff --git a/README.md b/README.md index 8150ab4..8512070 100644 --- a/README.md +++ b/README.md @@ -556,6 +556,12 @@ String for HostbasedAuthentication option in sshd_config. Valid values are 'yes' - *Default*: 'no' +sshd_pubkeyauthentication +------------------------- +String for PubkeyAuthentication option in sshd_config. Valid values are 'yes' and 'no'. + +- *Default*: 'yes' + sshd_ignoreuserknownhosts ------------------------- String for IgnoreUserKnownHosts option in sshd_config. Valid values are 'yes' and 'no'. Specifies whether sshd(8) should ignore the user's ~/.ssh/known_hosts during RhostsRSAAuthentication or HostbasedAuthentication. diff --git a/manifests/init.pp b/manifests/init.pp index 20ffc4c..57b26f2 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -81,6 +81,7 @@ class ssh ( $sshd_config_hostkey = 'USE_DEFAULTS', $sshd_listen_address = undef, $sshd_hostbasedauthentication = 'no', + $sshd_pubkeyauthentication = 'yes', $sshd_ignoreuserknownhosts = 'no', $sshd_ignorerhosts = 'yes', $manage_service = true, @@ -561,6 +562,8 @@ class ssh ( validate_re($sshd_hostbasedauthentication, '^(yes|no)$', "ssh::sshd_hostbasedauthentication may be either 'yes' or 'no' and is set to <${sshd_hostbasedauthentication}>.") + validate_re($sshd_pubkeyauthentication, '^(yes|no)$', "ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to <${sshd_pubkeyauthentication}>.") + validate_re($sshd_ignoreuserknownhosts, '^(yes|no)$', "ssh::sshd_ignoreuserknownhosts may be either 'yes' or 'no' and is set to <${sshd_ignoreuserknownhosts}>.") validate_re($sshd_ignorerhosts, '^(yes|no)$', "ssh::sshd_ignorerhosts may be either 'yes' or 'no' and is set to <${sshd_ignorerhosts}>.") diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index f0b59ce..c38a380 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -391,6 +391,7 @@ describe 'ssh' do :sshd_config_subsystem_sftp => '/opt/ssh/bin/sftp', :sshd_kerberos_authentication => 'no', :sshd_password_authentication => 'no', + :sshd_pubkeyauthentication => 'no', :sshd_allow_tcp_forwarding => 'no', :sshd_x11_forwarding => 'no', :sshd_use_pam => 'no', @@ -478,6 +479,7 @@ describe 'ssh' do it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommand \/path\/to\/command$/) } it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommandUser asdf$/) } it { should contain_file('sshd_config').with_content(/^HostbasedAuthentication no$/) } + it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication no$/) } it { should contain_file('sshd_config').with_content(/^IgnoreUserKnownHosts no$/) } it { should contain_file('sshd_config').with_content(/^IgnoreRhosts yes$/) } it { should contain_file('sshd_config').with_content(/^ChrootDirectory \/chrootdir$/) } @@ -2468,6 +2470,38 @@ describe 'ssh' do end end + describe 'with parameter sshd_pubkeyauthentication' do + let :facts do + default_facts.merge( + { + } + ) + end + + ['yes','no'].each do |value| + context "specified as valid #{value} (as #{value.class})" do + let(:params) { { :sshd_pubkeyauthentication => value } } + + it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication #{value}$/) } + end + end + + ['YES',true,2.42,['array'],a = { 'ha' => 'sh' }].each do |value| + context "specified as invalid value #{value} (as #{value.class})" do + let(:params) { { :sshd_pubkeyauthentication => value } } + if value.is_a?(Array) + value = value.join + end + + it do + expect { + should contain_class('ssh') + }.to raise_error(Puppet::Error,/ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to/) + end + end + end + end + describe 'with parameter sshd_ignoreuserknownhosts' do let :facts do default_facts.merge( diff --git a/spec/fixtures/sshd_config_debian b/spec/fixtures/sshd_config_debian index ae66a64..355ce91 100644 --- a/spec/fixtures/sshd_config_debian +++ b/spec/fixtures/sshd_config_debian @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_rhel b/spec/fixtures/sshd_config_rhel index ebc70aa..d73a8a8 100644 --- a/spec/fixtures/sshd_config_rhel +++ b/spec/fixtures/sshd_config_rhel @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_sles_12_x86_64 b/spec/fixtures/sshd_config_sles_12_x86_64 index e2574ec..c56fde8 100644 --- a/spec/fixtures/sshd_config_sles_12_x86_64 +++ b/spec/fixtures/sshd_config_sles_12_x86_64 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_solaris b/spec/fixtures/sshd_config_solaris index 045b680..11b261a 100644 --- a/spec/fixtures/sshd_config_solaris +++ b/spec/fixtures/sshd_config_solaris @@ -47,6 +47,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_suse_i386 b/spec/fixtures/sshd_config_suse_i386 index e2574ec..c56fde8 100644 --- a/spec/fixtures/sshd_config_suse_i386 +++ b/spec/fixtures/sshd_config_suse_i386 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_suse_x86_64 b/spec/fixtures/sshd_config_suse_x86_64 index f4640e0..1a91c74 100644 --- a/spec/fixtures/sshd_config_suse_x86_64 +++ b/spec/fixtures/sshd_config_suse_x86_64 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb index 59b57f4..821feb9 100644 --- a/templates/sshd_config.erb +++ b/templates/sshd_config.erb @@ -68,6 +68,7 @@ MaxAuthTries <%= @sshd_config_maxauthtries %> #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication <%= @sshd_pubkeyauthentication %> #AuthorizedKeysFile .ssh/authorized_keys <% if @sshd_config_authkey_location -%> AuthorizedKeysFile <%= @sshd_config_authkey_location %>