172 lines
3.2 KiB
Markdown
172 lines
3.2 KiB
Markdown
# puppet-module-ssh #
|
|
|
|
Manage ssh client and server.
|
|
|
|
The module uses exported resources to manage ssh keys and removes ssh keys that are not managed by puppet. This behavior is managed by the parameters ssh_key_ensure and purge_keys.
|
|
|
|
===
|
|
|
|
# Compatability #
|
|
|
|
This module has been tested to work on the following systems.
|
|
|
|
* EL 5
|
|
* EL 6
|
|
|
|
===
|
|
|
|
# Parameters #
|
|
|
|
keys
|
|
----
|
|
Hash of keys for user's ~/.ssh/authorized_keys
|
|
|
|
- *Default*: undefined
|
|
|
|
packages
|
|
--------
|
|
Array of package names used for installation.
|
|
|
|
- *Default*: 'openssh-server', 'openssh-server', 'openssh-clients'
|
|
|
|
permit_root_login
|
|
-----------------
|
|
Allow root login. Valid values are 'yes', 'without-password', 'forced-commands-only', 'no'.
|
|
|
|
- *Default*: no
|
|
|
|
purge_keys
|
|
----------
|
|
Remove keys not managed by puppet.
|
|
|
|
- *Default*: 'true'
|
|
|
|
manage_firewall
|
|
---------------
|
|
Open firewall for SSH service.
|
|
|
|
- *Default*: false
|
|
|
|
ssh_config_path
|
|
---------------
|
|
Path to ssh_config.
|
|
|
|
- *Default*: '/etc/ssh/ssh_config'
|
|
|
|
ssh_config_owner
|
|
----------------
|
|
ssh_config's owner.
|
|
|
|
- *Default*: 'root'
|
|
|
|
ssh_config_group
|
|
----------------
|
|
ssh_config's group.
|
|
|
|
- *Default*: 'root'
|
|
|
|
ssh_config_mode
|
|
---------------
|
|
ssh_config's mode.
|
|
|
|
- *Default*: '0644'
|
|
|
|
sshd_config_path
|
|
----------------
|
|
Path to sshd_config.
|
|
|
|
- *Default*: '/etc/ssh/sshd_config
|
|
|
|
sshd_config_owner
|
|
-----------------
|
|
sshd_config's owner.
|
|
|
|
- *Default*: 'root'
|
|
|
|
sshd_config_group
|
|
----------------
|
|
sshd_config's group.
|
|
|
|
- *Default*: 'root'
|
|
|
|
sshd_config_mode
|
|
---------------
|
|
sshd_config's mode.
|
|
|
|
- *Default*: '0600'
|
|
|
|
service_ensure
|
|
--------------
|
|
Ensure SSH service is running. Valid values are 'stopped' and 'running'.
|
|
|
|
- *Default*: 'running'
|
|
|
|
service_name
|
|
------------
|
|
Name of the SSH service.
|
|
|
|
- *Default*: 'sshd'
|
|
|
|
service_enable
|
|
--------------
|
|
Start SSH at boot. Valid values are 'true', 'false' and 'manual'.
|
|
|
|
- *Default*: 'true'
|
|
|
|
service_hasrestart
|
|
------------------
|
|
Specify that the init script has a restart command. Valid values are 'true' and 'false'.
|
|
|
|
- *Default*: 'true'
|
|
|
|
service_hasstatus
|
|
-----------------
|
|
Declare whether the service's init script has a functional status command. Valid values are 'true' and 'false'
|
|
|
|
- *Default*: 'true'
|
|
|
|
ssh_key_ensure
|
|
--------------
|
|
Export node SSH key. Valid values are 'present' and 'absent'.
|
|
|
|
- *Default*: 'present'
|
|
|
|
ssh_key_type
|
|
------------
|
|
Encryption type for SSH key. Valid values are 'rsa', 'dsa', 'ssh-dss' and 'ssh-rsa'
|
|
|
|
- *Default*: 'ssh-rsa'
|
|
|
|
manage_root_ssh_config
|
|
----------------------
|
|
Manage SSH config of root. Valid values are 'true' and 'false'.
|
|
|
|
- *Default*: 'false'
|
|
|
|
root_ssh_config_content
|
|
-----------------------
|
|
Content of root's ~/.ssh/config.
|
|
|
|
- *Default*: "# This file is being maintained by Puppet.\n# DO NOT EDIT\n"
|
|
|
|
===
|
|
|
|
# Manage user's ssh_authorized_keys
|
|
This works by passing the ssh::keys hash to the ssh_authorized_keys type with create_resources(). Because of this, you may specify any valid parameter for ssh_authorized_key. See the [Type Reference](http://docs.puppetlabs.com/references/stable/type.html#ssh_authorized_key) for a complete list.
|
|
|
|
## Sample usage:
|
|
Push authorized key "root_for_userX" and remove key "root_for_userY" through Hiera.
|
|
|
|
<pre>
|
|
ssh::keys:
|
|
root_for_userX:
|
|
ensure: present
|
|
user: root
|
|
type: dsa
|
|
key: AAAA...==
|
|
root_for_userY:
|
|
ensure: absent
|
|
user: root
|
|
</pre>
|
|
|