From a7a15c203e4d53d84b9ca6df880569f577ae9d2a Mon Sep 17 00:00:00 2001 From: Florian Faltermeier Date: Tue, 7 Jun 2016 09:15:06 +0200 Subject: [PATCH 1/3] allow ecdsa-sha2-nistp256 hostkeys --- README.md | 2 +- manifests/init.pp | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1875739..8150ab4 100644 --- a/README.md +++ b/README.md @@ -624,7 +624,7 @@ Import all exported node SSH keys. Valid values are 'true' and 'false'. ssh_key_type ------------ -Encryption type for SSH key. Valid values are 'rsa', 'dsa', 'ssh-dss' and 'ssh-rsa' +Encryption type for SSH key. Valid values are 'ecdsa-sha2-nistp256', 'rsa', 'dsa', 'ssh-dss' and 'ssh-rsa' - *Default*: 'ssh-rsa' diff --git a/manifests/init.pp b/manifests/init.pp index 8627d26..55aa04c 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -620,8 +620,11 @@ class ssh ( 'ssh-dsa','dsa': { $key = $::sshdsakey } + 'ecdsa-sha2-nistp256': { + $key = $::sshecdsakey + } default: { - fail("ssh::ssh_key_type must be 'ssh-rsa', 'rsa', 'ssh-dsa', or 'dsa' and is <${ssh_key_type}>.") + fail("ssh::ssh_key_type must be 'ecdsa-sha2-nistp256', 'ssh-rsa', 'rsa', 'ssh-dsa', or 'dsa' and is <${ssh_key_type}>.") } } From b0b245e2ed82c14b465dcf9dda5419eb7d7ab704 Mon Sep 17 00:00:00 2001 From: Florian Faltermeier Date: Tue, 7 Jun 2016 09:16:39 +0200 Subject: [PATCH 2/3] add host_aliases attribute to sshkey resource --- manifests/init.pp | 7 ++++--- spec/classes/init_spec.rb | 6 ++++++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/manifests/init.pp b/manifests/init.pp index 55aa04c..20ffc4c 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -792,9 +792,10 @@ class ssh ( # export each node's ssh key @@sshkey { $::fqdn : - ensure => $ssh_key_ensure, - type => $ssh_key_type, - key => $key, + ensure => $ssh_key_ensure, + host_aliases => [$::hostname, $::ipaddress], + type => $ssh_key_type, + key => $key, } file { 'ssh_known_hosts': diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index fac2447..f0b59ce 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -4,6 +4,8 @@ describe 'ssh' do default_facts = { :fqdn => 'monkey.example.com', + :hostname => 'monkey', + :ipaddress => '127.0.0.1', :osfamily => 'RedHat', :ssh_version => 'OpenSSH_6.6p1', :ssh_version_numeric => '6.6', @@ -12,6 +14,8 @@ describe 'ssh' do default_solaris_facts = { :fqdn => 'monkey.example.com', + :hostname => 'monkey', + :ipaddress => '127.0.0.1', :osfamily => 'Solaris', :ssh_version => 'Sun_SSH_2.2', :ssh_version_numeric => '2.2', @@ -188,6 +192,8 @@ describe 'ssh' do facts.merge( { :fqdn => 'monkey.example.com', + :hostname => 'monkey', + :ipaddress => '127.0.0.1', :sshrsakey => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArGElx46pD6NNnlxVaTbp0ZJMgBKCmbTCT3RaeCk0ZUJtQ8wkcwTtqIXmmiuFsynUT0DFSd8UIodnBOPqitimmooAVAiAi30TtJVzADfPScMiUnBJKZajIBkEMkwUcqsfh630jyBvLPE/kyQcxbEeGtbu1DG3monkeymanOBW1AKc5o+cJLXcInLnbowMG7NXzujT3BRYn/9s5vtT1V9cuZJs4XLRXQ50NluxJI7sVfRPVvQI9EMbTS4AFBXUej3yfgaLSV+nPZC/lmJ2gR4t/tKvMFF9m16f8IcZKK7o0rK7v81G/tREbOT5YhcKLK+0wBfR6RsmHzwy4EddZloyLQ==', } ) From 49c799afb33d947e233593f8371c80058c15bcd7 Mon Sep 17 00:00:00 2001 From: Florian Faltermeier Date: Tue, 7 Jun 2016 15:52:42 +0200 Subject: [PATCH 3/3] add support for PubkeyAuthentication in sshd_config --- README.md | 6 +++++ manifests/init.pp | 3 +++ spec/classes/init_spec.rb | 34 ++++++++++++++++++++++++ spec/fixtures/sshd_config_debian | 1 + spec/fixtures/sshd_config_rhel | 1 + spec/fixtures/sshd_config_sles_12_x86_64 | 1 + spec/fixtures/sshd_config_solaris | 1 + spec/fixtures/sshd_config_suse_i386 | 1 + spec/fixtures/sshd_config_suse_x86_64 | 1 + templates/sshd_config.erb | 1 + 10 files changed, 50 insertions(+) diff --git a/README.md b/README.md index 8150ab4..8512070 100644 --- a/README.md +++ b/README.md @@ -556,6 +556,12 @@ String for HostbasedAuthentication option in sshd_config. Valid values are 'yes' - *Default*: 'no' +sshd_pubkeyauthentication +------------------------- +String for PubkeyAuthentication option in sshd_config. Valid values are 'yes' and 'no'. + +- *Default*: 'yes' + sshd_ignoreuserknownhosts ------------------------- String for IgnoreUserKnownHosts option in sshd_config. Valid values are 'yes' and 'no'. Specifies whether sshd(8) should ignore the user's ~/.ssh/known_hosts during RhostsRSAAuthentication or HostbasedAuthentication. diff --git a/manifests/init.pp b/manifests/init.pp index 20ffc4c..57b26f2 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -81,6 +81,7 @@ class ssh ( $sshd_config_hostkey = 'USE_DEFAULTS', $sshd_listen_address = undef, $sshd_hostbasedauthentication = 'no', + $sshd_pubkeyauthentication = 'yes', $sshd_ignoreuserknownhosts = 'no', $sshd_ignorerhosts = 'yes', $manage_service = true, @@ -561,6 +562,8 @@ class ssh ( validate_re($sshd_hostbasedauthentication, '^(yes|no)$', "ssh::sshd_hostbasedauthentication may be either 'yes' or 'no' and is set to <${sshd_hostbasedauthentication}>.") + validate_re($sshd_pubkeyauthentication, '^(yes|no)$', "ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to <${sshd_pubkeyauthentication}>.") + validate_re($sshd_ignoreuserknownhosts, '^(yes|no)$', "ssh::sshd_ignoreuserknownhosts may be either 'yes' or 'no' and is set to <${sshd_ignoreuserknownhosts}>.") validate_re($sshd_ignorerhosts, '^(yes|no)$', "ssh::sshd_ignorerhosts may be either 'yes' or 'no' and is set to <${sshd_ignorerhosts}>.") diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index f0b59ce..c38a380 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -391,6 +391,7 @@ describe 'ssh' do :sshd_config_subsystem_sftp => '/opt/ssh/bin/sftp', :sshd_kerberos_authentication => 'no', :sshd_password_authentication => 'no', + :sshd_pubkeyauthentication => 'no', :sshd_allow_tcp_forwarding => 'no', :sshd_x11_forwarding => 'no', :sshd_use_pam => 'no', @@ -478,6 +479,7 @@ describe 'ssh' do it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommand \/path\/to\/command$/) } it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommandUser asdf$/) } it { should contain_file('sshd_config').with_content(/^HostbasedAuthentication no$/) } + it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication no$/) } it { should contain_file('sshd_config').with_content(/^IgnoreUserKnownHosts no$/) } it { should contain_file('sshd_config').with_content(/^IgnoreRhosts yes$/) } it { should contain_file('sshd_config').with_content(/^ChrootDirectory \/chrootdir$/) } @@ -2468,6 +2470,38 @@ describe 'ssh' do end end + describe 'with parameter sshd_pubkeyauthentication' do + let :facts do + default_facts.merge( + { + } + ) + end + + ['yes','no'].each do |value| + context "specified as valid #{value} (as #{value.class})" do + let(:params) { { :sshd_pubkeyauthentication => value } } + + it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication #{value}$/) } + end + end + + ['YES',true,2.42,['array'],a = { 'ha' => 'sh' }].each do |value| + context "specified as invalid value #{value} (as #{value.class})" do + let(:params) { { :sshd_pubkeyauthentication => value } } + if value.is_a?(Array) + value = value.join + end + + it do + expect { + should contain_class('ssh') + }.to raise_error(Puppet::Error,/ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to/) + end + end + end + end + describe 'with parameter sshd_ignoreuserknownhosts' do let :facts do default_facts.merge( diff --git a/spec/fixtures/sshd_config_debian b/spec/fixtures/sshd_config_debian index ae66a64..355ce91 100644 --- a/spec/fixtures/sshd_config_debian +++ b/spec/fixtures/sshd_config_debian @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_rhel b/spec/fixtures/sshd_config_rhel index ebc70aa..d73a8a8 100644 --- a/spec/fixtures/sshd_config_rhel +++ b/spec/fixtures/sshd_config_rhel @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_sles_12_x86_64 b/spec/fixtures/sshd_config_sles_12_x86_64 index e2574ec..c56fde8 100644 --- a/spec/fixtures/sshd_config_sles_12_x86_64 +++ b/spec/fixtures/sshd_config_sles_12_x86_64 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_solaris b/spec/fixtures/sshd_config_solaris index 045b680..11b261a 100644 --- a/spec/fixtures/sshd_config_solaris +++ b/spec/fixtures/sshd_config_solaris @@ -47,6 +47,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_suse_i386 b/spec/fixtures/sshd_config_suse_i386 index e2574ec..c56fde8 100644 --- a/spec/fixtures/sshd_config_suse_i386 +++ b/spec/fixtures/sshd_config_suse_i386 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/spec/fixtures/sshd_config_suse_x86_64 b/spec/fixtures/sshd_config_suse_x86_64 index f4640e0..1a91c74 100644 --- a/spec/fixtures/sshd_config_suse_x86_64 +++ b/spec/fixtures/sshd_config_suse_x86_64 @@ -49,6 +49,7 @@ PermitRootLogin yes #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb index 59b57f4..821feb9 100644 --- a/templates/sshd_config.erb +++ b/templates/sshd_config.erb @@ -68,6 +68,7 @@ MaxAuthTries <%= @sshd_config_maxauthtries %> #RSAAuthentication yes #PubkeyAuthentication yes +PubkeyAuthentication <%= @sshd_pubkeyauthentication %> #AuthorizedKeysFile .ssh/authorized_keys <% if @sshd_config_authkey_location -%> AuthorizedKeysFile <%= @sshd_config_authkey_location %>