From 4cf16192a5c69e11ad53a78763eae2315696620e Mon Sep 17 00:00:00 2001
From: Martin Narkiewicz <mnarkiewicz@YVR-NB857.local>
Date: Tue, 24 Jan 2017 14:20:09 -0800
Subject: [PATCH] Add support for PubkeyAcceptedKeyTypes option to sshd_config

---
 README.md                 |  6 ++++++
 manifests/init.pp         |  5 +++++
 spec/classes/init_spec.rb | 19 +++++++++++++++++++
 templates/sshd_config.erb |  3 +++
 4 files changed, 33 insertions(+)

diff --git a/README.md b/README.md
index 160668a..1d229dd 100644
--- a/README.md
+++ b/README.md
@@ -642,6 +642,12 @@ String for HostbasedAuthentication option in sshd_config. Valid values are 'yes'
 
 - *Default*: 'no'
 
+sshd_pubkeyacceptedkeytypes
+-------------------------
+Array of public key types to be used with the PubkeyAcceptedKeyTypes option in sshd_config.
+
+- *Default*: undef
+
 sshd_pubkeyauthentication
 -------------------------
 String for PubkeyAuthentication option in sshd_config. Valid values are 'yes' and 'no'.
diff --git a/manifests/init.pp b/manifests/init.pp
index a10df3f..3e8667b 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -87,6 +87,7 @@ class ssh (
   $sshd_config_hostkey                 = 'USE_DEFAULTS',
   $sshd_listen_address                 = undef,
   $sshd_hostbasedauthentication        = 'no',
+  $sshd_pubkeyacceptedkeytypes         = undef,
   $sshd_pubkeyauthentication           = 'yes',
   $sshd_ignoreuserknownhosts           = 'no',
   $sshd_ignorerhosts                   = 'yes',
@@ -636,6 +637,10 @@ class ssh (
 
   validate_re($sshd_hostbasedauthentication, '^(yes|no)$', "ssh::sshd_hostbasedauthentication may be either 'yes' or 'no' and is set to <${sshd_hostbasedauthentication}>.")
 
+  if $sshd_pubkeyacceptedkeytypes != undef {
+    validate_array($sshd_pubkeyacceptedkeytypes)
+  }
+
   validate_re($sshd_pubkeyauthentication, '^(yes|no)$', "ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to <${sshd_pubkeyauthentication}>.")
 
   validate_re($sshd_ignoreuserknownhosts, '^(yes|no)$', "ssh::sshd_ignoreuserknownhosts may be either 'yes' or 'no' and is set to <${sshd_ignoreuserknownhosts}>.")
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index a6f305e..53b48b1 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -403,6 +403,12 @@ describe 'ssh' do
         :sshd_password_authentication      => 'no',
         :sshd_config_permitemptypasswords  => 'no',
         :sshd_config_permituserenvironment => 'no',
+        :sshd_pubkeyacceptedkeytypes       => [ 'ecdsa-sha2-nistp256',
+                                                'ecdsa-sha2-nistp384',
+                                                'ecdsa-sha2-nistp521',
+                                                'ssh-ed25519',
+                                                'ssh-rsa',
+        ],
         :sshd_pubkeyauthentication         => 'no',
         :sshd_allow_tcp_forwarding         => 'no',
         :sshd_x11_forwarding               => 'no',
@@ -506,6 +512,7 @@ describe 'ssh' do
     it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommand \/path\/to\/command$/) }
     it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommandUser asdf$/) }
     it { should contain_file('sshd_config').with_content(/^HostbasedAuthentication no$/) }
+    it { should contain_file('sshd_config').with_content(/^PubkeyAcceptedKeyTypes ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa$/) }
     it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication no$/) }
     it { should contain_file('sshd_config').with_content(/^IgnoreUserKnownHosts no$/) }
     it { should contain_file('sshd_config').with_content(/^IgnoreRhosts yes$/) }
@@ -2188,6 +2195,18 @@ describe 'ssh' do
     end
   end
 
+  [true,'invalid'].each do |pubkeyacceptedkeytypes|
+    context "with sshd_pubkeyacceptedkeytypes set to invalid value #{pubkeyacceptedkeytypes}" do
+      let(:params) { { :sshd_pubkeyacceptedkeytypes => pubkeyacceptedkeytypes } }
+
+      it 'should fail' do
+        expect {
+          should contain_class('ssh')
+        }.to raise_error(Puppet::Error,/is not/)
+      end
+    end
+  end
+
   describe 'with parameter sshd_pubkeyauthentication' do
     ['yes','no'].each do |value|
       context "specified as valid #{value} (as #{value.class})" do
diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb
index 51c3196..1a1c9fe 100644
--- a/templates/sshd_config.erb
+++ b/templates/sshd_config.erb
@@ -69,6 +69,9 @@ MaxAuthTries <%= @sshd_config_maxauthtries %>
 <% end -%>
 
 #RSAAuthentication yes
+<% if @sshd_pubkeyacceptedkeytypes -%>
+PubkeyAcceptedKeyTypes <%= @sshd_pubkeyacceptedkeytypes.join(',') %>
+<% end -%>
 #PubkeyAuthentication yes
 PubkeyAuthentication <%= @sshd_pubkeyauthentication %>
 #AuthorizedKeysFile .ssh/authorized_keys