diff --git a/.travis.yml b/.travis.yml index 9750670..0e44a4a 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,7 +1,7 @@ --- env: - PUPPET_VERSION=2.7.23 -- PUPPET_VERSION=3.2.4 +- PUPPET_VERSION=3.3.2 notifications: email: false rvm: diff --git a/Modulefile b/Modulefile index 18b9b57..82a0029 100644 --- a/Modulefile +++ b/Modulefile @@ -1,5 +1,5 @@ name 'ghoneycutt-ssh' -version '3.3.0' +version '3.4.0' source 'git://github.com/ghoneycutt/puppet-module-ssh.git' author 'ghoneycutt' license 'Apache License, Version 2.0' diff --git a/README.md b/README.md index b0fe70c..c73ae9b 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,19 @@ This module has been tested to work on the following systems with Puppet v3. # Parameters # +ssh_config_hash_known_hosts +--------------------------- +HashKnownHosts in ssh_config. +Indicates that ssh should hash host names and addresses when they are added to ~/.ssh/known_hosts. +These hashed names may be used normally by ssh and sshd, but they do not reveal identifying +information should the file's contents be disclosed. The default is 'no'. + +Note that existing names and addresses in known hosts files will not be converted automatically, +but may be manually hashed using ssh-keygen. Use of this option may break facilities such as +tab-completion that rely on being able to read unhashed host names from ~/.ssh/known_hosts. + +- *Default*: 'no' + ssh_config_path --------------- Path to ssh_config. diff --git a/Rakefile b/Rakefile index 55b411f..0a28d84 100644 --- a/Rakefile +++ b/Rakefile @@ -2,11 +2,17 @@ require 'rubygems' require 'puppetlabs_spec_helper/rake_tasks' require 'puppet-lint/tasks/puppet-lint' PuppetLint.configuration.send('disable_80chars') -PuppetLint.configuration.ignore_paths = ["spec/**/*.pp"] +PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"] desc "Run puppet in noop mode and check for syntax errors." task :validate do - Dir['manifests/**/*.pp'].each do |path| - sh "puppet parser validate --noop #{path}" - end + Dir['manifests/**/*.pp'].each do |manifest| + sh "puppet parser validate --noop #{manifest}" + end + Dir['spec/**/*.rb','lib/**/*.rb'].each do |ruby_file| + sh "ruby -c #{ruby_file}" unless ruby_file =~ /spec\/fixtures/ + end + Dir['templates/**/*.erb'].each do |template| + sh "erb -P -x -T '-' #{template} | ruby -c" + end end diff --git a/manifests/init.pp b/manifests/init.pp index fa40f78..6ca47d8 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -7,6 +7,7 @@ class ssh ( $permit_root_login = 'yes', $purge_keys = 'true', $manage_firewall = false, + $ssh_config_hash_known_hosts = 'no', $ssh_config_path = '/etc/ssh/ssh_config', $ssh_config_owner = 'root', $ssh_config_group = 'root', @@ -50,6 +51,7 @@ class ssh ( ) { # validate params + validate_re($ssh_config_hash_known_hosts, '^(yes|no)$', "ssh_config_hash_known_hosts may be either 'yes' or 'no' and is set to <${ssh_config_hash_known_hosts}>.") validate_re($sshd_config_port, '^\d+$', "ssh::sshd_config_port must be a valid number and is set to <${sshd_config_port}>.") validate_re($sshd_password_authentication, '^(yes|no)$', "ssh::sshd_password_authentication may be either 'yes' or 'no' and is set to <${sshd_password_authentication}>.") validate_re($sshd_allow_tcp_forwarding, '^(yes|no)$', "ssh::sshd_allow_tcp_forwarding may be either 'yes' or 'no' and is set to <${sshd_allow_tcp_forwarding}>.") @@ -61,7 +63,7 @@ class ssh ( validate_absolute_path($sshd_config_banner) } if $sshd_banner_content != undef and $sshd_config_banner == 'none' { - fail("ssh::sshd_config_banner must be set to be able to use sshd_banner_content.") + fail('ssh::sshd_config_banner must be set to be able to use sshd_banner_content.') } case type($ssh_config_sendenv_xmodifiers) { @@ -72,7 +74,7 @@ class ssh ( $ssh_config_sendenv_xmodifiers_real = $ssh_config_sendenv_xmodifiers } default: { - fail("ssh::ssh_config_sendenv_xmodifiers type must be true or false.") + fail('ssh::ssh_config_sendenv_xmodifiers type must be true or false.') } } @@ -184,7 +186,7 @@ class ssh ( if $sshd_config_banner != 'none' and $sshd_banner_content != undef { file { 'sshd_banner' : - ensure => file, + ensure => file, path => $sshd_config_banner, owner => $sshd_banner_owner, group => $sshd_banner_group, diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index c4393b0..e4c8dab 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -36,6 +36,7 @@ describe 'ssh' do it { should contain_file('ssh_config').with_content(/^# This file is being maintained by Puppet.\n# DO NOT EDIT\n\n# \$OpenBSD: ssh_config,v 1.21 2005\/12\/06 22:38:27 reyk Exp \$/) } it { should contain_file('ssh_config').with_content(/^ Protocol 2$/) } + it { should contain_file('ssh_config').with_content(/^ HashKnownHosts no$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardAgent$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardX11$/) } @@ -120,6 +121,7 @@ describe 'ssh' do it { should contain_file('ssh_config').with_content(/^# This file is being maintained by Puppet.\n# DO NOT EDIT\n\n# \$OpenBSD: ssh_config,v 1.21 2005\/12\/06 22:38:27 reyk Exp \$/) } it { should contain_file('ssh_config').with_content(/^ Protocol 2$/) } + it { should contain_file('ssh_config').with_content(/^ HashKnownHosts no$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardAgent$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardX11$/) } @@ -179,6 +181,7 @@ describe 'ssh' do :sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ==' } end + it { should compile.with_all_deps } it { should contain_class('ssh')} @@ -205,6 +208,7 @@ describe 'ssh' do it { should contain_file('ssh_config').with_content(/^# This file is being maintained by Puppet.\n# DO NOT EDIT\n\n# \$OpenBSD: ssh_config,v 1.21 2005\/12\/06 22:38:27 reyk Exp \$/) } it { should contain_file('ssh_config').with_content(/^ Protocol 2$/) } + it { should contain_file('ssh_config').with_content(/^ HashKnownHosts no$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardAgent$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardX11$/) } @@ -264,6 +268,7 @@ describe 'ssh' do :sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ==' } end + it { should compile.with_all_deps } it { should contain_class('ssh')} @@ -290,6 +295,7 @@ describe 'ssh' do it { should contain_file('ssh_config').with_content(/^# This file is being maintained by Puppet.\n# DO NOT EDIT\n\n# \$OpenBSD: ssh_config,v 1.21 2005\/12\/06 22:38:27 reyk Exp \$/) } it { should contain_file('ssh_config').with_content(/^ Protocol 2$/) } + it { should contain_file('ssh_config').with_content(/^ HashKnownHosts no$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardAgent$/) } it { should_not contain_file('ssh_config').with_content(/^\s*ForwardX11$/) } @@ -370,6 +376,7 @@ describe 'ssh' do end let :params do { + :ssh_config_hash_known_hosts => 'yes', :ssh_config_forward_agent => 'yes', :ssh_config_forward_x11 => 'yes', :ssh_config_server_alive_interval => '300', @@ -392,6 +399,7 @@ describe 'ssh' do it { should contain_file('ssh_config').with_content(/^# This file is being maintained by Puppet.\n# DO NOT EDIT\n\n# \$OpenBSD: ssh_config,v 1.21 2005\/12\/06 22:38:27 reyk Exp \$/) } it { should contain_file('ssh_config').with_content(/^ Protocol 2$/) } + it { should contain_file('ssh_config').with_content(/^ HashKnownHosts yes$/) } it { should contain_file('ssh_config').with_content(/^ ForwardAgent yes$/) } it { should contain_file('ssh_config').with_content(/^ ForwardX11 yes$/) } it { should contain_file('ssh_config').with_content(/^ ServerAliveInterval 300$/) } @@ -510,6 +518,25 @@ describe 'ssh' do } end + context 'with ssh_config_hash_known_hosts set to invalid value on valid osfamily' do + let :facts do + { + :fqdn => 'monkey.example.com', + :osfamily => 'RedHat', + :sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ==' + } + end + let :params do + { :ssh_config_hash_known_hosts => 'invalid' } + end + + it 'should fail' do + expect { + should include_class('ssh') + }.to raise_error(Puppet::Error,/ssh_config_hash_known_hosts may be either \'yes\' or \'no\' and is set to ./) + end + end + context 'with sshd_config_port not being a valid number' do let :facts do { diff --git a/templates/ssh_config.erb b/templates/ssh_config.erb index 03ede72..5b6d3b9 100644 --- a/templates/ssh_config.erb +++ b/templates/ssh_config.erb @@ -44,6 +44,8 @@ # Tunnel no # TunnelDevice any:any # PermitLocalCommand no +# HashKnownHosts no + HashKnownHosts <%= @ssh_config_hash_known_hosts %> Host * GSSAPIAuthentication yes # If this option is set to yes then remote X11 clients will have full access