saltstack-formulas/openssh-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e6603ae62a
openssh-formula/pillar.example

175 lines
6.5 KiB
Plaintext
Raw Normal View History

Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
sshd_config:
Port: 22
Protocol: 2
HostKey:
- /etc/ssh/ssh_host_rsa_key
- /etc/ssh/ssh_host_dsa_key
- /etc/ssh/ssh_host_ecdsa_key
add ed25519 host key type; add AuthenticationMethods option
2015-01-16 18:21:10 +01:00
- /etc/ssh/ssh_host_ed25519_key
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
UsePrivilegeSeparation: 'yes'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
KeyRegenerationInterval: 3600
ServerKeyBits: 768
SyslogFacility: AUTH
LogLevel: INFO
Implement Session idle time out
2016-05-25 00:06:45 +02:00
ClientAliveInterval: 0
ClientAliveCountMax: 3
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
LoginGraceTime: 120
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
PermitRootLogin: 'yes'
PasswordAuthentication: 'no'
StrictModes: 'yes'
add more authentication options
2016-05-26 21:57:02 +02:00
MaxAuthTries: 6
MaxSessions: 10
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
RSAAuthentication: 'yes'
PubkeyAuthentication: 'yes'
IgnoreRhosts: 'yes'
RhostsRSAAuthentication: 'no'
HostbasedAuthentication: 'no'
PermitEmptyPasswords: 'no'
ChallengeResponseAuthentication: 'no'
added the missing ":" and delete the redundant lines
2015-05-28 07:36:11 +02:00
AuthenticationMethods: 'publickey,keyboard-interactive'
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
X11Forwarding: 'yes'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
X11DisplayOffset: 10
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
PrintMotd: 'no'
PrintLastLog: 'yes'
TCPKeepAlive: 'yes'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
AcceptEnv: "LANG LC_*"
Subsystem: "sftp /usr/lib/openssh/sftp-server"
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
UsePAM: 'yes'
Add a UseDNS option to pillar.example
2014-07-22 07:37:41 +02:00
UseDNS: 'yes'
Added AllowUsers,AllowGroups,DenyUsers,DenyGroups This will add more options to set to secure openssh - AllowUsers - AllowGroups - DenyUsers - DenyGroups
2015-01-16 22:56:59 +01:00
AllowUsers: 'vader@10.0.0.1 maul@evil.com sidious luke'
add DenyUsers and DenyGroups example
2015-01-17 20:04:03 +01:00
DenyUsers: 'yoda chewbaca@112.10.21.1'
AllowGroups: 'wheel staff imperial'
DenyGroups: 'rebel'
add pillar example
2014-09-19 18:42:17 +02:00
matches:
sftp_chroot:
type:
Group: sftpusers
options:
ChrootDirectory: /sftp-chroot/%u
X11Forwarding: no
AllowTcpForwarding: no
ForceCommand: internal-sftp
adds support to harden sshd_config (KeyExchange, Ciphers, MACs)
2015-06-30 14:33:57 +02:00
# Check `man sshd_config` for supported KexAlgorithms, Ciphers and MACs first.
KexAlgorithms: 'diffie-hellman-group14-sha1,diffie-hellman-group1-sha1'
Ciphers: 'aes128-ctr,aes256-ctr'
MACs: 'hmac-sha1'
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
Added configuration options for ssh_config Made a small change to reflect the default sshd_config
2015-10-01 17:21:16 +02:00
ssh_config:
StrictHostKeyChecking: no
ForwardAgent: no
ForwardX11: no
RhostsRSAAuthentication: no
RSAAuthentication: yes
PasswordAuthentication: yes
HostbasedAuthentication: no
GSSAPIAuthentication: no
GSSAPIDelegateCredentials: no
BatchMode: 'yes'
CheckHostIP: 'yes'
AddressFamily: 'any'
ConnectTimeout: 0
IdentityFile: '~/.ssh/id_rsa'
Port: 22
Protocol: 2
Cipher: '3des'
Tunnel: 'no'
TunnelDevice: 'any:any'
PermitLocalCommand: 'no'
VisualHostKey: 'no'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
openssh:
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
auth:
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
joe-valid-ssh-key-desktop:
- user: joe
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
present: True
enc: ssh-rsa
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
comment: main key - desktop
joe-valid-ssh-key-notebook:
- user: joe
present: True
enc: ssh-rsa
comment: main key - notebook
joe-non-valid-ssh-key:
- user: joe
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
present: False
enc: ssh-rsa
comment: obsolete key - removed
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
generate_dsa_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_dsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_dsa_keys: False
Modifying OpenSSH formula state to populate public/private DSA and RSA keys based on pillar data
2014-01-03 05:34:48 +01:00
dsa:
private_key: |
-----BEGIN DSA PRIVATE KEY-----
NOT_DEFINED
-----END DSA PRIVATE KEY-----
public_key: |
ssh-dss NOT_DEFINED
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
generate_ecdsa_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_ecdsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_ecdsa_keys: False
Update pillar.example
2014-08-24 13:18:37 +02:00
ecdsa:
private_key: |
-----BEGIN EC PRIVATE KEY-----
NOT_DEFINED
-----END EC PRIVATE KEY-----
public_key: |
ecdsa-sha2-nistp256 NOT_DEFINED
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
Update pillar example
2014-08-24 17:44:33 +02:00
generate_rsa_keys: False
add options to give a key size to generate_key
2015-07-12 18:09:26 +02:00
generate_rsa_size: 4096
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_rsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_rsa_keys: False
Modifying OpenSSH formula state to populate public/private DSA and RSA keys based on pillar data
2014-01-03 05:34:48 +01:00
rsa:
private_key: |
-----BEGIN RSA PRIVATE KEY-----
NOT_DEFINED
-----END RSA PRIVATE KEY-----
public_key: |
ssh-rsa NOT_DEFINED
Add support for ED25519 host keys
2014-12-15 07:00:17 +01:00
generate_ed25519_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_ed25519_keys: False
Add support for ED25519 host keys
2014-12-15 07:00:17 +01:00
provide_ed25519_keys: False
ed25519:
private_key: |
-----BEGIN OPENSSH PRIVATE KEY-----
NOT_DEFINED
-----END OPENSSH PRIVATE KEY-----
public_key: |
ssh-ed25519 NOT_DEFINED
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
known_hosts:
# The next 2 settings restrict the set of minions that will be added in
# the generated ssh_known_hosts files (the default is to match all minions)
target: '*'
expr_form: 'glob'
# Name of mining functions used to gather public keys and hostnames
# (the default values are shown here)
mine_keys_function: public_ssh_host_keys
mine_hostname_function: public_ssh_hostname
# List of DNS entries also pointing to our managed machines and that we want
# to inject in our generated ssh_known_hosts file
aliases:
- cname-to-minion.example.org
- alias.example.org
Adds support to customize /etc/ssh/moduli file
2015-07-01 22:42:48 +02:00
# specify DH parameters (see /etc/ssh/moduli)
moduli: |
# Time Type Tests Tries Size Generator Modulus
20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
# Required for openssh.known_hosts
mine_functions:
public_ssh_host_keys:
mine_function: cmd.run
cmd: cat /etc/ssh/ssh_host_*_key.pub
Fix mine_function example in pillar.example This fixes #34, salt version 2015.5.x needs an extra argument for shell routines.
2015-05-28 23:00:27 +02:00
python_shell: True
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
public_ssh_hostname:
mine_function: grains.get
key: id
Reference in New Issue Copy Permalink