diff --git a/README.md b/README.md index d2b934d..4b58eb7 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ for the exact matrix of supported Puppet and ruby versions. * Debian 7 * Debian 8 * Debian 9 + * Debian 10 * EL 5 * EL 6 * EL 7 @@ -426,7 +427,7 @@ X11Forwarding in sshd_config. Specifies whether X11 forwarding is permitted. sshd_x11_use_localhost ---------------------- -X11UseLocalhost in sshd_config. Specifies if sshd should bind the X11 forwarding server +X11UseLocalhost in sshd_config. Specifies if sshd should bind the X11 forwarding server to the loopback address or to the wildcard address. - *Default*: 'yes' diff --git a/manifests/init.pp b/manifests/init.pp index 66788b9..b996718 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -253,6 +253,32 @@ class ssh ( $default_sshd_config_tcp_keepalive = 'yes' $default_sshd_config_permittunnel = 'no' } + /^10.*/: { + $default_sshd_config_hostkey = [ + '/etc/ssh/ssh_host_rsa_key', + '/etc/ssh/ssh_host_ecdsa_key', + '/etc/ssh/ssh_host_ed25519_key', + ] + $default_sshd_config_mode = '0600' + $default_sshd_use_pam = 'yes' + $default_ssh_config_forward_x11_trusted = 'yes' + $default_sshd_acceptenv = true + $default_sshd_config_subsystem_sftp = '/usr/lib/openssh/sftp-server' + $default_ssh_config_hash_known_hosts = 'yes' + $default_ssh_sendenv = true + $default_sshd_addressfamily = undef + $default_sshd_config_serverkeybits = undef + $default_sshd_gssapicleanupcredentials = undef + $default_sshd_config_use_dns = undef + $default_sshd_config_xauth_location = undef + $default_sshd_config_permittunnel = undef + $default_sshd_config_tcp_keepalive = undef + $default_ssh_package_source = undef + $default_ssh_package_adminfile = undef + $default_sshd_gssapikeyexchange = undef + $default_sshd_pamauthenticationviakbdint = undef + $default_service_hasstatus = true + } /^9.*/: { $default_sshd_config_hostkey = [ '/etc/ssh/ssh_host_rsa_key', diff --git a/metadata.json b/metadata.json index 407ce43..e2d3525 100644 --- a/metadata.json +++ b/metadata.json @@ -19,7 +19,8 @@ "operatingsystemrelease": [ "7", "8", - "9" + "9", + "10" ] }, { diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb index 3b1ebf1..4206840 100644 --- a/spec/classes/init_spec.rb +++ b/spec/classes/init_spec.rb @@ -72,6 +72,19 @@ describe 'ssh' do :sshd_config_fixture => 'sshd_config_debian9', :ssh_config_fixture => 'ssh_config_debian9', }, + 'Debian-10' => { + :architecture => 'x86_64', + :osfamily => 'Debian', + :operatingsystemrelease => '10', + :ssh_version => 'OpenSSH_7.9p1', + :ssh_version_numeric => '7.9', + :ssh_packages => ['openssh-server', 'openssh-client'], + :sshd_config_mode => '0600', + :sshd_service_name => 'ssh', + :sshd_service_hasstatus => true, + :sshd_config_fixture => 'sshd_config_debian10', + :ssh_config_fixture => 'ssh_config_debian10', + }, 'RedHat-5' => { :architecture => 'x86_64', :osfamily => 'RedHat', diff --git a/spec/fixtures/ssh_config_debian10 b/spec/fixtures/ssh_config_debian10 new file mode 100644 index 0000000..d13cc55 --- /dev/null +++ b/spec/fixtures/ssh_config_debian10 @@ -0,0 +1,61 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT + +# $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $ + +# This is the ssh client system-wide configuration file. See +# ssh_config(5) for more information. This file provides defaults for +# users, and the values can be changed in per-user configuration files +# or on the command line. + +# Configuration data is parsed as follows: +# 1. command line options +# 2. user-specific file +# 3. system-wide file +# Any configuration value is only changed the first time it is set. +# Thus, host-specific definitions should be at the beginning of the +# configuration file, and defaults at the end. + +# Site-wide defaults for some commonly used options. For a comprehensive +# list of available options, their meanings and defaults, please see the +# ssh_config(5) man page. + +# Host * +# ForwardAgent no +# ForwardX11 no +# RhostsRSAAuthentication no +# RSAAuthentication yes + PasswordAuthentication yes + PubkeyAuthentication yes +# HostbasedAuthentication no +# BatchMode no +# CheckHostIP yes +# AddressFamily any +# ConnectTimeout 0 +# StrictHostKeyChecking ask +# IdentityFile ~/.ssh/identity + IdentityFile ~/.ssh/id_rsa + IdentityFile ~/.ssh/id_dsa +# Port 22 + Protocol 2 +# Cipher 3des +# Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc +# EscapeChar ~ +# Tunnel no +# TunnelDevice any:any +# PermitLocalCommand no +# HashKnownHosts no + HashKnownHosts yes + GlobalKnownHostsFile /etc/ssh/ssh_known_hosts +Host * +# GSSAPIAuthentication yes + GSSAPIAuthentication yes +# If this option is set to yes then remote X11 clients will have full access +# to the original X11 display. As virtually no X11 client supports the untrusted +# mode correctly we set this to yes. + ForwardX11Trusted yes + UseRoaming no +# Send locale-related environment variables + SendEnv LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES + SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT + SendEnv LC_IDENTIFICATION LC_ALL diff --git a/spec/fixtures/sshd_config_debian10 b/spec/fixtures/sshd_config_debian10 new file mode 100644 index 0000000..0d269e9 --- /dev/null +++ b/spec/fixtures/sshd_config_debian10 @@ -0,0 +1,124 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT + +# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# Expect .ssh/authorized_keys2 to be disregarded by default in future. +#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes +#GSSAPIStrictAcceptorCheck yes +#GSSAPIKeyExchange no + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +X11Forwarding yes +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +PrintMotd no +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +#PidFile /var/run/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +# override default of no subsystems +Subsystem sftp /usr/lib/openssh/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server