initial commit

.gitignore

@@ -1,3 +1,4 @@
+# Default .gitignore for Ruby
 *.gem
 *.rbc
 .bundle
@@ -16,3 +17,14 @@ tmp
 .yardoc
 _yardoc
 doc/
+
+# Vim
+*.swp
+
+# OS X
+.DS_Store
+
+# Puppet
+metadata.json
+coverage/
+spec/fixtures/modules/*

CHANGELOG

@@ -0,0 +1,2 @@
+2.0.0 - 2013-05-16 Garrett Honeycutt <code@garretthoneycutt.com>
+* Rebirth

LICENSE

@@ -0,0 +1,13 @@
+Copyright (C) 2010-2013 Garrett Honeycutt <code@garretthoneycutt.com>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

Modulefile

@@ -0,0 +1,12 @@
+name    'ghoneycutt-ssh'
+version '2.0.0'
+source 'git://github.com/ghoneycutt/puppet-module-ssh.git'
+author 'ghoneycutt'
+license 'Apache License, Version 2.0'
+summary 'Manages SSH'
+description 'Manage SSH'
+project_page 'https://github.com/ghoneycutt/puppet-module-ssh'
+
+dependency 'puppetlabs/stdlib',  '3.2.x'
+dependency 'ghoneycutt/common',  '0.0.1'
+dependency 'puppetlabs/firewall', '>= 0.2.1'

Rakefile

@@ -0,0 +1,3 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'

manifests/init.pp

@@ -0,0 +1,156 @@
+# == Class: ssh
+#
+# Manage ssh client and server
+#
+# == Parameters:
+#
+#  $permit_root_login: defaults to 'no',
+#   valid values = yes/without-password/forced-commands-only/no
+#
+class ssh (
+  $packages                = ['openssh-server',
+                              'openssh-server',
+                              'openssh-clients'],
+  $permit_root_login       = 'no',
+  $purge_keys              = 'true',
+  $manage_firewall         = false,
+  $ssh_config_path         = '/etc/ssh/ssh_config',
+  $ssh_config_owner        = 'root',
+  $ssh_config_group        = 'root',
+  $ssh_config_mode         = '0644',
+  $sshd_config_path        = '/etc/ssh/sshd_config',
+  $sshd_config_owner       = 'root',
+  $sshd_config_group       = 'root',
+  $sshd_config_mode        = '0600',
+  $service_ensure          = 'running',
+  $service_name            = 'sshd',
+  $service_enable          = 'true',
+  $service_hasrestart      = 'true',
+  $service_hasstatus       = 'true',
+  $ssh_key_ensure          = 'present',
+  $ssh_key_type            = 'ssh-rsa',
+  $manage_root_ssh_config  = 'false',
+  $root_ssh_config_content = "# This file is being maintained by Puppet.\n# DO NOT EDIT\n",
+) {
+
+  case $permit_root_login {
+    'no', 'yes', 'without-password', 'forced-commands-only': {
+      # noop
+    }
+    default: {
+      fail("permit_root_login may be either 'yes', 'without-password', 'forced-commands-only' or 'no' and is set to ${permit_root_login}")
+    }
+  }
+
+  case $ssh_key_type {
+    'ssh-rsa','rsa': {
+      $key = $::sshrsakey
+    }
+    'ssh-dsa','dsa': {
+      $key = $::sshdsakey
+    }
+    default: {
+      fail("ssh_key_type must be 'ssh-rsa', 'rsa', 'ssh-dsa', or 'dsa' and is ${ssh_key_type}")
+    }
+  }
+
+  case $purge_keys {
+    'true','false': {
+      # noop
+    }
+    default: {
+      fail("purge_keys must be 'true' or 'false' and is ${purge_keys}")
+    }
+  }
+
+  package { 'ssh_packages':
+    ensure => installed,
+    name   => $packages,
+  }
+
+  file  { 'ssh_config' :
+    ensure  => file,
+    path    => $ssh_config_path,
+    owner   => $ssh_config_owner,
+    group   => $ssh_config_group,
+    mode    => $ssh_config_mode,
+    content => template('ssh/ssh_config.erb'),
+    require => Package['ssh_packages'],
+  }
+
+  file  { 'sshd_config' :
+    ensure  => file,
+    path    => $sshd_config_path,
+    mode    => $sshd_config_mode,
+    owner   => $sshd_config_owner,
+    group   => $sshd_config_group,
+    content => template('ssh/sshd_config.erb'),
+    require => Package['ssh_packages'],
+  }
+
+  case $manage_root_ssh_config {
+    'true': {
+
+      include common
+
+      common::mkdir_p { "${::root_home}/.ssh": }
+
+      file { 'root_ssh_dir':
+        ensure  => directory,
+        path    => "${::root_home}/.ssh",
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0700',
+        require => Common::Mkdir_p["${::root_home}/.ssh"],
+      }
+
+      file { 'root_ssh_config':
+        ensure  => file,
+        path    => "${::root_home}/.ssh/config",
+        content => $root_ssh_config_content,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0600',
+      }
+    }
+    'false': {
+      # noop
+    }
+    default: {
+      fail("manage_root_ssh_config is <${manage_root_ssh_config}> and must be \'true\' or \'false\'.")
+    }
+  }
+
+  service { 'sshd_service' :
+    ensure     => $service_ensure,
+    name       => $service_name,
+    enable     => $service_enable,
+    hasrestart => $service_hasrestart,
+    hasstatus  => $service_hasstatus,
+    subscribe  => File['sshd_config'],
+  }
+
+  if $manage_firewall == true {
+    firewall { '22 open port 22 for SSH':
+      action => 'accept',
+      dport  => 22,
+      proto  => 'tcp',
+    }
+  }
+
+  # export each node's ssh key
+  @@sshkey { $::fqdn :
+    ensure  => $ssh_key_ensure,
+    type    => $ssh_key_type,
+    key     => $key,
+    require => Package['ssh_packages'],
+  }
+
+  # import all nodes' ssh keys
+  Sshkey <<||>>
+
+  # remove ssh key's not managed by puppet
+  resources  { 'sshkey':
+    purge => $purge_keys,
+  }
+}

spec/spec_helper.rb

@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/module_spec_helper'

templates/ssh_config.erb

@@ -0,0 +1,56 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+
+#	$OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $
+
+# This is the ssh client system-wide configuration file.  See
+# ssh_config(5) for more information.  This file provides defaults for
+# users, and the values can be changed in per-user configuration files
+# or on the command line.
+
+# Configuration data is parsed as follows:
+#  1. command line options
+#  2. user-specific file
+#  3. system-wide file
+# Any configuration value is only changed the first time it is set.
+# Thus, host-specific definitions should be at the beginning of the
+# configuration file, and defaults at the end.
+
+# Site-wide defaults for some commonly used options.  For a comprehensive
+# list of available options, their meanings and defaults, please see the
+# ssh_config(5) man page.
+
+# Host *
+#   ForwardAgent no
+#   ForwardX11 no
+#   RhostsRSAAuthentication no
+#   RSAAuthentication yes
+   PasswordAuthentication yes
+   PubkeyAuthentication yes
+#   HostbasedAuthentication no
+#   BatchMode no
+#   CheckHostIP yes
+#   AddressFamily any
+#   ConnectTimeout 0
+#   StrictHostKeyChecking ask
+#   IdentityFile ~/.ssh/identity
+   IdentityFile ~/.ssh/id_rsa
+   IdentityFile ~/.ssh/id_dsa
+#   Port 22
+   Protocol 2
+#   Cipher 3des
+#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
+#   EscapeChar ~
+#   Tunnel no
+#   TunnelDevice any:any
+#   PermitLocalCommand no
+Host *
+	GSSAPIAuthentication yes
+# If this option is set to yes then remote X11 clients will have full access
+# to the original X11 display. As virtually no X11 client supports the untrusted
+# mode correctly we set this to yes.
+	ForwardX11Trusted yes
+# Send locale-related environment variables
+	SendEnv LANG LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+	SendEnv LC_IDENTIFICATION LC_ALL

templates/sshd_config.erb

@@ -0,0 +1,122 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+
+#	$OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+#Port 22
+#Protocol 2,1
+Protocol 2
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 768
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin <%= @permit_root_login %>
+#StrictModes yes
+#MaxAuthTries 6
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile	.ssh/authorized_keys
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+PasswordAuthentication yes
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+GSSAPIAuthentication yes
+#GSSAPICleanupCredentials yes
+GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication mechanism.
+# Depending on your PAM configuration, this may bypass the setting of
+# PasswordAuthentication, PermitEmptyPasswords, and
+# "PermitRootLogin without-password". If you just want the PAM account and
+# session checks to run without PAM authentication, then enable this but set
+# ChallengeResponseAuthentication=no
+#UsePAM no
+UsePAM yes
+
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#ShowPatchLevel no
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+##Banner /etc/motd
+
+# override default of no subsystems
+Subsystem	sftp	/usr/libexec/openssh/sftp-server

tests/init.pp

@@ -0,0 +1 @@
+include ssh