Merge pull request #177 from ghoneycutt/hosts_files_array

Add support for UserKnownHostsFile and add multiple files support for GlobalKnownHostsFile
This commit is contained in:
Garrett Honeycutt 2016-06-20 12:40:30 -04:00 committed by GitHub
commit b7f729ae78
4 changed files with 115 additions and 3 deletions

View File

@ -640,6 +640,13 @@ File of the global known_hosts file
- *Default*: '/etc/ssh/ssh_known_hosts' - *Default*: '/etc/ssh/ssh_known_hosts'
ssh_config_global_known_hosts_list
----------------------------------
Array of additional known_hosts files to be added to GlobalKnownHostsFile
option together with `ssh_config_global_known_hosts_file`.
- *Default*: undef
ssh_config_global_known_hosts_owner ssh_config_global_known_hosts_owner
---------------------------------- ----------------------------------
Owner of the global known_hosts file Owner of the global known_hosts file
@ -658,6 +665,13 @@ File mode of the global known_hosts file
- *Default*: '0644' - *Default*: '0644'
ssh_config_user_known_hosts_file
--------------------------------
Array of user's known_hosts files used in the ssh config option
UserKnownHostsFile.
- *Default*: undef
manage_root_ssh_config manage_root_ssh_config
---------------------- ----------------------
Manage SSH config of root. Valid values are 'true' and 'false'. Manage SSH config of root. Valid values are 'true' and 'false'.

View File

@ -95,9 +95,11 @@ class ssh (
$ssh_key_import = true, $ssh_key_import = true,
$ssh_key_type = 'ssh-rsa', $ssh_key_type = 'ssh-rsa',
$ssh_config_global_known_hosts_file = '/etc/ssh/ssh_known_hosts', $ssh_config_global_known_hosts_file = '/etc/ssh/ssh_known_hosts',
$ssh_config_global_known_hosts_list = undef,
$ssh_config_global_known_hosts_owner = 'root', $ssh_config_global_known_hosts_owner = 'root',
$ssh_config_global_known_hosts_group = 'root', $ssh_config_global_known_hosts_group = 'root',
$ssh_config_global_known_hosts_mode = '0644', $ssh_config_global_known_hosts_mode = '0644',
$ssh_config_user_known_hosts_file = undef,
$keys = undef, $keys = undef,
$manage_root_ssh_config = false, $manage_root_ssh_config = false,
$root_ssh_config_content = "# This file is being maintained by Puppet.\n# DO NOT EDIT\n", $root_ssh_config_content = "# This file is being maintained by Puppet.\n# DO NOT EDIT\n",
@ -647,6 +649,20 @@ class ssh (
} }
validate_absolute_path($ssh_config_global_known_hosts_file) validate_absolute_path($ssh_config_global_known_hosts_file)
$ssh_config_global_known_hosts_file_real = any2array($ssh_config_global_known_hosts_file)
if $ssh_config_global_known_hosts_list != undef {
validate_array($ssh_config_global_known_hosts_list)
validate_absolute_path($ssh_config_global_known_hosts_list)
$ssh_config_global_known_hosts_list_real = concat($ssh_config_global_known_hosts_file_real, $ssh_config_global_known_hosts_list)
} else {
$ssh_config_global_known_hosts_list_real = $ssh_config_global_known_hosts_file_real
}
if $ssh_config_user_known_hosts_file != undef {
validate_array($ssh_config_user_known_hosts_file)
}
validate_string($ssh_config_global_known_hosts_owner) validate_string($ssh_config_global_known_hosts_owner)
validate_string($ssh_config_global_known_hosts_group) validate_string($ssh_config_global_known_hosts_group)
validate_re($ssh_config_global_known_hosts_mode, '^[0-7]{4}$', validate_re($ssh_config_global_known_hosts_mode, '^[0-7]{4}$',

View File

@ -327,6 +327,12 @@ describe 'ssh' do
'hmac-sha1-etm@openssh.com', 'hmac-sha1-etm@openssh.com',
], ],
:ssh_config_global_known_hosts_file => '/etc/ssh/ssh_known_hosts2', :ssh_config_global_known_hosts_file => '/etc/ssh/ssh_known_hosts2',
:ssh_config_global_known_hosts_list => [ '/etc/ssh/ssh_known_hosts3',
'/etc/ssh/ssh_known_hosts4',
],
:ssh_config_user_known_hosts_file => [ '.ssh/known_hosts1',
'.ssh/known_hosts2',
],
:ssh_hostbasedauthentication => 'yes', :ssh_hostbasedauthentication => 'yes',
:ssh_strict_host_key_checking => 'ask', :ssh_strict_host_key_checking => 'ask',
:ssh_enable_ssh_keysign => 'yes', :ssh_enable_ssh_keysign => 'yes',
@ -358,7 +364,8 @@ describe 'ssh' do
it { should contain_file('ssh_config').with_content(/^ SendEnv XMODIFIERS$/) } it { should contain_file('ssh_config').with_content(/^ SendEnv XMODIFIERS$/) }
it { should contain_file('ssh_config').with_content(/^\s*Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc$/) } it { should contain_file('ssh_config').with_content(/^\s*Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc$/) }
it { should contain_file('ssh_config').with_content(/^\s*MACs hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com$/) } it { should contain_file('ssh_config').with_content(/^\s*MACs hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com$/) }
it { should contain_file('ssh_config').with_content(/^\s*GlobalKnownHostsFile \/etc\/ssh\/ssh_known_hosts2$/) } it { should contain_file('ssh_config').with_content(/^\s*GlobalKnownHostsFile \/etc\/ssh\/ssh_known_hosts2 \/etc\/ssh\/ssh_known_hosts3 \/etc\/ssh\/ssh_known_hosts4$/) }
it { should contain_file('ssh_config').with_content(/^\s*UserKnownHostsFile \.ssh\/known_hosts1 \.ssh\/known_hosts2$/) }
it { should contain_file('ssh_config').with_content(/^\s*HostbasedAuthentication yes$/) } it { should contain_file('ssh_config').with_content(/^\s*HostbasedAuthentication yes$/) }
it { should contain_file('ssh_config').with_content(/^\s*StrictHostKeyChecking ask$/) } it { should contain_file('ssh_config').with_content(/^\s*StrictHostKeyChecking ask$/) }
it { should contain_file('ssh_config').with_content(/^\s*EnableSSHKeysign yes$/) } it { should contain_file('ssh_config').with_content(/^\s*EnableSSHKeysign yes$/) }
@ -2290,6 +2297,78 @@ describe 'ssh' do
end end
end end
describe 'with parameter ssh_config_global_known_hosts_list' do
let :facts do
default_facts.merge(
{
}
)
end
context 'when set to an array of valid absolute paths' do
let (:params) {{'ssh_config_global_known_hosts_list' => ['/valid/path1','/valid/path2'] }}
it { should contain_file('ssh_config').with_content(/^\s*GlobalKnownHostsFile.*\/valid\/path1 \/valid\/path2$/) }
end
context 'specified as an invalid path' do
let(:params) {{ :ssh_config_global_known_hosts_list => ['/valid/path','invalid/path'] }}
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error,/\"invalid\/path\" is not an absolute path\./)
end
end
['YES',true,2.42,a = { 'ha' => 'sh' }].each do |value|
context "specified as invalid value #{value} (as #{value.class})" do
let(:params) { { :ssh_config_global_known_hosts_list => value } }
if value.is_a?(Hash)
value = '{ha => sh}'
end
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error, /is not an Array/)
end
end
end
end
describe 'with parameter ssh_config_user_known_hosts_file' do
let :facts do
default_facts.merge(
{
}
)
end
context 'when set to an array of paths' do
let (:params) {{'ssh_config_user_known_hosts_file' => ['valid/path1','/valid/path2'] }}
it { should contain_file('ssh_config').with_content(/^\s*UserKnownHostsFile valid\/path1 \/valid\/path2$/) }
end
['YES',true,2.42,a = { 'ha' => 'sh' }].each do |value|
context "specified as invalid value #{value} (as #{value.class})" do
let(:params) { { :ssh_config_user_known_hosts_file => value } }
if value.is_a?(Hash)
value = '{ha => sh}'
end
it 'should fail' do
expect {
should contain_class('ssh')
}.to raise_error(Puppet::Error, /is not an Array/)
end
end
end
end
describe 'with parameter ssh_config_global_known_hosts_owner' do describe 'with parameter ssh_config_global_known_hosts_owner' do
let :facts do let :facts do
default_facts.merge( default_facts.merge(

View File

@ -57,8 +57,8 @@
<% if @ssh_config_hash_known_hosts_real != nil -%> <% if @ssh_config_hash_known_hosts_real != nil -%>
HashKnownHosts <%= @ssh_config_hash_known_hosts_real %> HashKnownHosts <%= @ssh_config_hash_known_hosts_real %>
<% end -%> <% end -%>
<% if @ssh_config_global_known_hosts_file -%> <% if @ssh_config_global_known_hosts_list_real -%>
GlobalKnownHostsFile <%= @ssh_config_global_known_hosts_file %> GlobalKnownHostsFile <%= @ssh_config_global_known_hosts_list_real.join(' ') %>
<% end -%> <% end -%>
Host * Host *
# GSSAPIAuthentication yes # GSSAPIAuthentication yes
@ -100,3 +100,6 @@ GSSAPIDelegateCredentials <%= @ssh_gssapidelegatecredentials %>
# EnableSSHKeysign no # EnableSSHKeysign no
EnableSSHKeysign <%= @ssh_enable_ssh_keysign %> EnableSSHKeysign <%= @ssh_enable_ssh_keysign %>
<% end -%> <% end -%>
<% if @ssh_config_user_known_hosts_file -%>
UserKnownHostsFile <%= @ssh_config_user_known_hosts_file.join(' ') %>
<% end -%>