saltstack-formulas/openssh-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #2 from Perceptyx/develop

Browse Source 
Add latest changes from upstream
This commit is contained in:
Andres Montalban 2018-04-17 15:28:01 -03:00 committed by GitHub
commit 2a4d07cae1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 211 additions and 202 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
README.rst
View File

@ -51,13 +51,23 @@ of the default ``sshd_config`` file on Debian Wheezy.
It is highly recommended ``PermitRootLogin`` is added to pillar It is highly recommended ``PermitRootLogin`` is added to pillar
so root login will be disabled. so root login will be disabled.
``openssh.config_ini``
----------------------
Version of managing ``sshd_config`` that uses the
`ini_managed.option_present <https://docs.saltstack.com/en/latest/ref/states/all/salt.states.ini_manage.html>`_
state module, so it enables to override only one or
multiple values and keeping the defaults shipped by your
distribution.
``openssh.known_hosts`` ``openssh.known_hosts``
----------------------- -----------------------
Manages the site-wide ssh_known_hosts file and fills it with the Manages the site-wide ssh_known_hosts file and fills it with the
public SSH host keys of all minions. You can restrict the set of minions public SSH host keys of all minions. You can restrict the set of minions
whose keys are listed by using the pillar data ``openssh:known_hosts:target`` whose keys are listed by using the pillar data ``openssh:known_hosts:target``
and ``openssh:known_hosts:expr_form`` (those fields map directly to the and ``openssh:known_hosts:tgt_type`` (those fields map directly to the
corresponding attributes of the ``mine.get`` function). corresponding attributes of the ``mine.get`` function).
The Salt mine is used to share the public SSH host keys, you must thus The Salt mine is used to share the public SSH host keys, you must thus

6
openssh/auth_map.sls
View File

@ -5,11 +5,11 @@ include:
{%- set openssh_pillar = salt["pillar.get"]("openssh", {}) -%} {%- set openssh_pillar = salt["pillar.get"]("openssh", {}) -%}
{%- set authorized_keys_file = salt["pillar.get"]("sshd_config:AuthorizedKeysFile", None) %} {%- set authorized_keys_file = salt["pillar.get"]("sshd_config:AuthorizedKeysFile", None) %}
{%- for store, config in salt["pillar.get"]("openssh:auth_map", {}).iteritems() %} {%- for store, config in salt["pillar.get"]("openssh:auth_map", {}).items() %}
{%- set store_base = config["source"] %} {%- set store_base = config["source"] %}
# SSH store openssh:auth_map:{{ store }} # SSH store openssh:auth_map:{{ store }}
{%- for user, keys in config.get("users", {}).iteritems() %} {%- for user, keys in config.get("users", {}).items() %}
{%- for key, key_cfg in keys.iteritems() %} {%- for key, key_cfg in keys.items() %}
"ssh_auth--{{ store }}--{{ user }}--{{ key }}": "ssh_auth--{{ store }}--{{ user }}--{{ key }}":
{%- set present = key_cfg.get("present", True) %} {%- set present = key_cfg.get("present", True) %}
{%- set options = key_cfg.get("options", []) %} {%- set options = key_cfg.get("options", []) %}

2
openssh/config.sls
View File

@ -67,7 +67,7 @@ ssh_generate_host_{{ keyType }}_key:
{%- set keySizePart = "-b {}".format(keySize) if keySize else "" %} {%- set keySizePart = "-b {}".format(keySize) if keySize else "" %}
- name: "rm {{ keyFile }}*; ssh-keygen -t {{ keyType }} {{ keySizePart }} -N '' -f {{ keyFile }}" - name: "rm {{ keyFile }}*; ssh-keygen -t {{ keyType }} {{ keySizePart }} -N '' -f {{ keyFile }}"
- unless: "test -s {{ keyFile }}" - unless: "test -s {{ keyFile }}"
- user: root - runas: root
- require_in: - require_in:
- file: sshd_config - file: sshd_config
- watch_in: - watch_in:

17
openssh/config_ini.sls Normal file
View File

@ -0,0 +1,17 @@
{% from "openssh/map.jinja" import openssh with context %}
include:
- openssh
{% if salt['pillar.get']('sshd_config', False) %}
sshd_config-with-ini:
ini.options_present:
- name: {{ openssh.sshd_config }}
- separator: ' '
- watch_in:
- service: {{ openssh.service }}
- sections:
{%- for k,v in salt['pillar.get']('sshd_config',{}).items() %}
{{ k }}: '{{ v }}'
{%- endfor %}
{% endif %}

10
openssh/files/ssh_known_hosts
View File

@ -16,7 +16,7 @@
{#- Extract the hostname from the FQDN and add it to the names. #} {#- Extract the hostname from the FQDN and add it to the names. #}
{%- if use_hostnames is iterable -%} {%- if use_hostnames is iterable -%}
{%- for name in names | sort -%} {%- for name in names | sort -%}
{%- if salt["match.{}".format(hostnames_expr_form)](hostnames_target, minion_id=name) -%} {%- if salt["match.{}".format(hostnames_tgt_type)](hostnames_target, minion_id=name) -%}
{%- set hostname = name.split('.')|first -%} {%- set hostname = name.split('.')|first -%}
{%- if hostname not in names -%} {%- if hostname not in names -%}
{%- do names.append(hostname) -%} {%- do names.append(hostname) -%}
@ -45,13 +45,13 @@
{#- Pre-fetch pillar data #} {#- Pre-fetch pillar data #}
{%- set target = salt['pillar.get']('openssh:known_hosts:target', '*') -%} {%- set target = salt['pillar.get']('openssh:known_hosts:target', '*') -%}
{%- set expr_form = salt['pillar.get']('openssh:known_hosts:expr_form', 'glob') -%} {%- set tgt_type = salt['pillar.get']('openssh:known_hosts:tgt_type', 'glob') -%}
{%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%} {%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%}
{%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%} {%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%}
{%- set use_hostnames = salt['pillar.get']('openssh:known_hosts:hostnames', False) -%} {%- set use_hostnames = salt['pillar.get']('openssh:known_hosts:hostnames', False) -%}
{%- set hostnames_target_default = '*' if grains['domain'] == '' else "*.{}".format(grains['domain']) -%} {%- set hostnames_target_default = '*' if grains['domain'] == '' else "*.{}".format(grains['domain']) -%}
{%- set hostnames_target = salt['pillar.get']('openssh:known_hosts:hostnames:target', hostnames_target_default) -%} {%- set hostnames_target = salt['pillar.get']('openssh:known_hosts:hostnames:target', hostnames_target_default) -%}
{%- set hostnames_expr_form = salt['pillar.get']('openssh:known_hosts:hostnames:expr_form', 'glob') -%} {%- set hostnames_tgt_type = salt['pillar.get']('openssh:known_hosts:hostnames:tgt_type', 'glob') -%}
{#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name {#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name
in the SSH known_hosts entry -#} in the SSH known_hosts entry -#}
@ -64,8 +64,8 @@
{%- endfor -%} {%- endfor -%}
{#- Loop over targetted minions -#} {#- Loop over targetted minions -#}
{%- set host_keys = salt['mine.get'](target, keys_function, expr_form=expr_form) -%} {%- set host_keys = salt['mine.get'](target, keys_function, tgt_type=tgt_type) -%}
{%- set host_names = salt['mine.get'](target, hostname_function, expr_form=expr_form) -%} {%- set host_names = salt['mine.get'](target, hostname_function, tgt_type=tgt_type) -%}
{%- for host, keys in host_keys|dictsort -%} {%- for host, keys in host_keys|dictsort -%}
{{ known_host_entry(host, host_names, keys) }} {{ known_host_entry(host, host_names, keys) }}
{%- endfor -%} {%- endfor -%}

317
openssh/files/sshd_config
View File

@ -4,60 +4,44 @@
{#- generic renderer used for sshd matches, known options, -#} {#- generic renderer used for sshd matches, known options, -#}
{#- and unknown options -#} {#- and unknown options -#}
{%- macro render_option(keyword, default, config_dict=sshd_config) -%} {%- macro render_option(keyword, config_dict=sshd_config) -%}
{%- set value = config_dict.get(keyword, default) -%} {%- set value = config_dict.get(keyword) -%}
{%- if value is sameas true -%} {%- if value is sameas true -%}
{{ keyword }} yes {{ keyword }} yes
{%- elif value is sameas false -%} {% elif value is sameas false -%}
{{ keyword }} no {{ keyword }} no
{%- elif value is string or value is number -%} {% elif value is string or value is number -%}
{{ keyword }} {{ value }} {{ keyword }} {{ value }}
{%- else -%} {% else -%}
{%- for single_value in value -%} {%- for single_value in value -%}
{{ keyword }} {{ single_value }} {{ keyword }} {{ single_value }}
{% endfor -%} {% endfor -%}
{%- endif -%} {%- endif -%}
{%- endmacro -%} {%- endmacro -%}
{#- macros for render option according to present -#} {#- macros for render option if present -#}
{%- macro option_impl(keyword, default, present) -%} {%- macro option(keyword, present) -%}
{%- if present -%} {%- if keyword in sshd_config -%}
{%- do processed_options.append(keyword) -%} {%- do processed_options.append(keyword) -%}
{%- set prefix='' -%} {{ render_option(keyword) }}
{%- else -%} {%- endif -%}
{%- set prefix='#' -%}
{%- endif -%}
{#- add prefix to keyword -#}
{%- set keyword = prefix ~ keyword -%}
{{ render_option(keyword, default) }}
{%- endmacro -%}
{#- macros for render option commented by default -#}
{%- macro option(keyword, default, present) -%}
{{ option_impl(keyword, default, keyword in sshd_config) }}
{%- endmacro -%}
{#- macros for render option uncommented by default -#}
{%- macro option_default_uncommented(keyword, default, present) -%}
{{ option_impl(keyword, default, True) }}
{%- endmacro -%} {%- endmacro -%}
{#- macro for collapsing a list into a string -#} {#- macro for collapsing a list into a string -#}
{%- macro option_collapselist(keyword, sep) -%} {%- macro option_collapselist(keyword, sep, config_dict=None) -%}
{%- if config_dict is sameas None -%}
{%- do processed_options.append(keyword) -%} {%- do processed_options.append(keyword) -%}
{{keyword}} {{sshd_config.get(keyword)|join(sep)}} {%- set config_dict = sshd_config -%}
{%- endmacro -%} {%- endif -%}
{{ keyword }} {{ config_dict.get(keyword) | join(sep) }}
{% endmacro -%}
{#- macro for handling an option that can be specified as a list or a string -#} {#- macro for handling an option that can be specified as a list or a string -#}
{%- macro option_string_or_list(keyword, default, default_commented, sep=',') -%} {%- macro option_string_or_list(keyword, sep=',') -%}
{%- if sshd_config.get(keyword, '') is string -%} {%- if sshd_config.get(keyword, '') is string -%}
{%- if default_commented -%} {{ option(keyword) }}
{{ option(keyword, default) }}
{%- else -%}
{{ option_default_uncommented(keyword, default) }}
{%- endif -%}
{%- else -%} {%- else -%}
{{ option_collapselist(keyword, sep) }} {{ option_collapselist(keyword, sep) }}
{%- endif -%} {%- endif -%}
{%- endmacro -%} {%- endmacro -%}
@ -67,17 +51,17 @@
{%- if srcval is string -%} {%- if srcval is string -%}
{{ srcval }} {{ srcval }}
{%- elif srcval is mapping -%} {%- elif srcval is mapping -%}
{{ srcval.keys()|sort|join(sep) }} {{ srcval.keys() | sort | join(sep) }}
{%- else -%} {%- else -%}
{{ srcval|join(sep) }} {{ srcval | join(sep) }}
{%- endif -%} {%- endif -%}
{%- endmacro -%} {%- endmacro -%}
{%- if sshd_config.get('ConfigBanner', False) -%} {%- if sshd_config.get('ConfigBanner', False) -%}
{%- do processed_options.append('ConfigBanner') -%} {%- do processed_options.append('ConfigBanner') -%}
{{ sshd_config['ConfigBanner'] }} {{ sshd_config['ConfigBanner'] }}
{%- else -%} {%- else -%}
# This file is managed by salt. Manual changes risk being overwritten. # This file is managed by salt. Manual changes risk being overwritten.
{%- endif %} {%- endif %}
{%- set global_src_url = salt ['pillar.get']('__formulas:print_template_url', None) %} {%- set global_src_url = salt ['pillar.get']('__formulas:print_template_url', None) %}
{%- set local_src_url = salt ['pillar.get']('openssh-formula:print_template_url', None) %} {%- set local_src_url = salt ['pillar.get']('openssh-formula:print_template_url', None) %}
@ -91,163 +75,166 @@
# quick reference. # quick reference.
# See the sshd_config(5) manpage for details # See the sshd_config(5) manpage for details
# Specifies which address family should be used by sshd(8). {# Specifies which address family should be used by sshd(8). -#}
# Valid arguments are any, inet (use IPv4 only), or inet6 (use IPv6 only) {#- Valid arguments are any, inet (use IPv4 only), or inet6 (use IPv6 only) -#}
{{ option('AddressFamily', 'any') }} {{- option('AddressFamily') -}}
# What ports, IPs and protocols we listen for {#- What ports, IPs and protocols we listen for -#}
{{ option('Port', 22) }} {{- option('Port') -}}
# Use these options to restrict which interfaces/protocols sshd will bind to {#- Use these options to restrict which interfaces/protocols sshd will bind to -#}
{{ option('ListenAddress', ['::', '0.0.0.0']) }} {{- option('ListenAddress') -}}
{{ option_default_uncommented('Protocol', 2) }} {{- option('Protocol') -}}
# HostKeys for protocol version 2 {#- HostKeys for protocol version 2 -#}
{{ option_default_uncommented('HostKey', ['/etc/ssh/ssh_host_rsa_key', '/etc/ssh/ssh_host_dsa_key', '/etc/ssh/ssh_host_ecdsa_key', '/etc/ssh/ssh_host_ed25519_key']) -}} {{- option('HostKey') -}}
#Privilege Separation is turned on for security {#- Privilege Separation is turned on for security -#}
{{ option_default_uncommented('UsePrivilegeSeparation', 'sandbox') }} {{- option('UsePrivilegeSeparation') -}}
# Lifetime and size of ephemeral version 1 server key {#- Lifetime and size of ephemeral version 1 server key -#}
{{ option_default_uncommented('KeyRegenerationInterval', 3600) }} {{- option('KeyRegenerationInterval') -}}
{{ option_default_uncommented('ServerKeyBits', 1024) }} {{- option('ServerKeyBits') -}}
# Logging {#- Logging -#}
{{ option_default_uncommented('SyslogFacility', 'AUTH') }} {{- option('SyslogFacility') -}}
{{ option_default_uncommented('LogLevel', 'INFO') }} {{- option('LogLevel') -}}
# Session idle time out {#- Session idle time out -#}
{{ option_default_uncommented('ClientAliveInterval', 0) }} {{- option('ClientAliveInterval') -}}
{{ option_default_uncommented('ClientAliveCountMax', 3) }} {{- option('ClientAliveCountMax') -}}
# Authentication: {#- Authentication: -#}
{{ option_default_uncommented('LoginGraceTime', 120) }} {{- option('LoginGraceTime') -}}
{{ option_default_uncommented('PermitRootLogin', 'yes') }} {{- option('PermitRootLogin') -}}
{{ option_default_uncommented('StrictModes', 'yes') }} {{- option('StrictModes') -}}
{{ option_default_uncommented('MaxAuthTries', '6') }} {{- option('MaxAuthTries') -}}
{{ option_default_uncommented('MaxSessions', '10') }} {{- option('MaxSessions') -}}
{{ option('DSAAuthentication', 'yes') }} {{- option('DSAAuthentication') -}}
{{ option_default_uncommented('RSAAuthentication', 'yes') }} {{- option('RSAAuthentication') -}}
{{ option_default_uncommented('PubkeyAuthentication', 'yes') }} {{- option('PubkeyAuthentication') -}}
{{ option('AuthorizedKeysFile', '%h/.ssh/authorized_keys') }} {{- option('AuthorizedKeysFile') -}}
{{ option('AuthorizedKeysCommand', 'none') }} {{- option('AuthorizedKeysCommand') -}}
{{ option('AuthorizedKeysCommandUser', 'nobody') }} {{- option('AuthorizedKeysCommandUser') -}}
# Don't read the user's ~/.rhosts and ~/.shosts files {#- Don't read the user's ~/.rhosts and ~/.shosts files -#}
{{ option_default_uncommented('IgnoreRhosts', 'yes') }} {{- option('IgnoreRhosts') -}}
# For this to work you will also need host keys in /etc/ssh_known_hosts {#- For this to work you will also need host keys in /etc/ssh_known_hosts -#}
{{ option_default_uncommented('RhostsRSAAuthentication', 'no') }} {{- option('RhostsRSAAuthentication') -}}
# similar for protocol version 2 {#- similar for protocol version 2 -#}
{{ option_default_uncommented('HostbasedAuthentication', 'no') }} {{- option('HostbasedAuthentication') -}}
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication {#- Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#}
{{ option('IgnoreUserKnownHosts', 'yes') }} {{- option('IgnoreUserKnownHosts') -}}
# To enable empty passwords, change to yes (NOT RECOMMENDED) {#- To enable empty passwords, change to yes (NOT RECOMMENDED) -#}
{{ option_default_uncommented('PermitEmptyPasswords', 'no') }} {{- option('PermitEmptyPasswords') -}}
# Change to yes to enable challenge-response passwords (beware issues with {#- Change to yes to enable challenge-response passwords (beware issues with -#}
# some PAM modules and threads) {#- some PAM modules and threads) -#}
{{ option_default_uncommented('ChallengeResponseAuthentication', 'no') }} {{- option('ChallengeResponseAuthentication') -}}
{{ option('AuthenticationMethods', 'publickey,keyboard-interactive') }} {{- option('AuthenticationMethods') -}}
# Change to no to disable tunnelled clear text passwords {#- Change to no to disable tunnelled clear text passwords -#}
{{ option('PasswordAuthentication', 'yes') }} {{- option('PasswordAuthentication') -}}
# Kerberos options {#- Kerberos options -#}
{{ option('KerberosAuthentication', 'no') }} {{- option('KerberosAuthentication') -}}
{{ option('KerberosGetAFSToken', 'no') }} {{- option('KerberosGetAFSToken') -}}
{{ option('KerberosOrLocalPasswd', 'yes') }} {{- option('KerberosOrLocalPasswd') -}}
{{ option('KerberosTicketCleanup', 'yes') }} {{- option('KerberosTicketCleanup') -}}
# GSSAPI options {#- GSSAPI options -#}
{{ option('GSSAPIAuthentication', 'no') }} {{- option('GSSAPIAuthentication') -}}
{{ option('GSSAPICleanupCredentials', 'yes') }} {{- option('GSSAPICleanupCredentials') -}}
{{ option_default_uncommented('X11Forwarding', 'yes') }} {{- option('X11Forwarding') -}}
{{ option('AllowTcpForwarding', 'yes') }} {{- option('AllowTcpForwarding') -}}
{{ option_default_uncommented('X11DisplayOffset', '10') }} {{- option('X11DisplayOffset') -}}
{{ option_default_uncommented('PrintMotd', 'no') }} {{- option('PrintMotd') -}}
{# Bug in FreeBSD 10.3 (?) See https://lists.freebsd.org/pipermail/freebsd-stable/2016-April/084501.html #} {#- Bug in FreeBSD 10.3 (?) See https://lists.freebsd.org/pipermail/freebsd-stable/2016-April/084501.html -#}
{% if not (salt['grains.get']('os') == 'FreeBSD' and salt['grains.get']('osrelease')|float >= 10.3) -%} {% if not (salt['grains.get']('os') == 'FreeBSD' and salt['grains.get']('osrelease')|float >= 10.3) -%}
{{ option_default_uncommented('PrintLastLog', 'yes') }} {{- option('PrintLastLog') -}}
{% endif -%} {% endif -%}
{{ option_default_uncommented('TCPKeepAlive', 'yes') }} {{- option('TCPKeepAlive') -}}
{{ option('UseLogin', 'no') }} {{- option('UseLogin') -}}
{{ option('MaxStartups', '10:30:60') }} {{- option('MaxStartups') -}}
{{ option('Banner', '/etc/issue.net') }} {{- option('Banner') -}}
# Allow client to pass locale environment variables {#- Allow client to pass locale environment variables -#}
{{ option_default_uncommented('AcceptEnv', 'LANG LC_*') }} {{- option('AcceptEnv') -}}
{{ option_default_uncommented('Subsystem', 'sftp /usr/lib/openssh/sftp-server') }} {{- option('Subsystem') -}}
{% if not salt['grains.get']('os') == 'OpenBSD' -%} {% if not salt['grains.get']('os') == 'OpenBSD' -%}
# Set this to 'yes' to enable PAM authentication, account processing, {#- Set this to 'yes' to enable PAM authentication, account processing, -#}
# and session processing. If this is enabled, PAM authentication will {#- and session processing. If this is enabled, PAM authentication will -#}
# be allowed through the ChallengeResponseAuthentication and {#- be allowed through the ChallengeResponseAuthentication and -#}
# PasswordAuthentication. Depending on your PAM configuration, {#- PasswordAuthentication. Depending on your PAM configuration, -#}
# PAM authentication via ChallengeResponseAuthentication may bypass {#- PAM authentication via ChallengeResponseAuthentication may bypass -#}
# the setting of "PermitRootLogin without-password". {#- the setting of "PermitRootLogin without-password". -#}
# If you just want the PAM account and session checks to run without {#- If you just want the PAM account and session checks to run without -#}
# PAM authentication, then enable this but set PasswordAuthentication {#- PAM authentication, then enable this but set PasswordAuthentication -#}
# and ChallengeResponseAuthentication to 'no'. {#- and ChallengeResponseAuthentication to 'no'. -#}
{{ option_default_uncommented('UsePAM', 'yes') }} {{- option('UsePAM') -}}
{%- endif %} {%- endif %}
# DNS resolve and map remote IP addresses {#- DNS resolve and map remote IP addresses -#}
{{ option('UseDNS', 'yes') }} {{- option('UseDNS') -}}
# Restricting Users and Hosts {#- Restricting Users and Hosts -#}
# example: {#- example: -#}
# AllowUsers vader@10.0.0.1 maul@sproing.evil.com luke {#- AllowUsers vader@10.0.0.1 maul@sproing.evil.com luke -#}
# AllowGroups wheel staff {#- AllowGroups wheel staff -#}
#
# Keep in mind that using AllowUsers or AllowGroups means that anyone {#- Keep in mind that using AllowUsers or AllowGroups means that anyone -#}
# not Matching one of the supplied patterns will be denied access by default. {#- not Matching one of the supplied patterns will be denied access by default. -#}
# Also, in order for sshd to allow access based on full or partial hostnames it {#- Also, in order for sshd to allow access based on full or partial hostnames it -#}
# needs to to a DNS lookup {#- needs to to a DNS lookup -#}
#
# DenyUsers {# DenyUsers -#}
{{ option_string_or_list('DenyUsers', '', True , sep=' ')}} {{- option_string_or_list('DenyUsers', sep=' ') }}
# AllowUsers {# AllowUsers -#}
{{ option_string_or_list('AllowUsers', '', True , sep=' ')}} {{- option_string_or_list('AllowUsers', sep=' ') }}
# DenyGroups {# DenyGroups -#}
{{ option_string_or_list('DenyGroups', '', True , sep=' ')}} {{- option_string_or_list('DenyGroups', sep=' ') }}
# AllowGroups {# AllowGroups -#}
{{ option_string_or_list('AllowGroups', '', True , sep=' ')}} {{- option_string_or_list('AllowGroups', sep=' ') }}{{ "\n" -}}
# Specifies the available KEX (Key Exchange) algorithms. {#- Specifies the available KEX (Key Exchange) algorithms. -#}
{{ option_string_or_list('KexAlgorithms', 'ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1', True) }} {{- option_string_or_list('KexAlgorithms') -}}
# Specifies the ciphers allowed for protocol version 2. {#- Specifies the ciphers allowed for protocol version 2. -#}
{{ option_string_or_list('Ciphers', 'aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se', True) }} {{- option_string_or_list('Ciphers') -}}
# Specifies the available MAC (message authentication code) algorithms. {#- Specifies the available MAC (message authentication code) algorithms. -#}
{{ option_string_or_list('MACs', 'hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96', True) }} {{- option_string_or_list('MACs') -}}
{# Handling unknown in salt template options #} {#- Handling unknown in salt template options -#}
{%- for keyword in sshd_config.keys() %} {%- for keyword in sshd_config.keys() %}
{#- Matches have to be at the bottom and should be handled differently -#} {#- Matches have to be at the bottom and should be handled differently -#}
{%- if not keyword in processed_options and keyword != 'matches' -%} {%- if not keyword in processed_options and keyword != 'matches' -%}
{#- send a blank default as it doesn't matter #} {{- render_option(keyword) -}}
{{ render_option(keyword, '') }} {% endif -%}
{%- endif -%}
{%- endfor %} {%- endfor %}
{# Handle matches last as they need to go at the bottom #} {#- Handle matches last as they need to go at the bottom -#}
{%- if 'matches' in sshd_config %} {%- if 'matches' in sshd_config %}
{%- for name, match in sshd_config['matches']|dictsort(true) %} {%- for name, match in sshd_config['matches']|dictsort(true) %}
Match Match
{#- Set up the match criteria -#} {#- Set up the match criteria -#}
{%- for criteria in match['type'].keys()|sort() -%} {%- for criteria in match['type'].keys()|sort() -%}
{{- ' ' }}{{criteria }} {{ join_to_string(match['type'], criteria) -}} {{ ' ' -}}{{criteria }} {{ join_to_string(match['type'], criteria) }}
{%- endfor %} #{{ name }} {%- endfor %} #{{- name }}
{#- Set up the applied options -#} {# Set up the applied options -#}
{%- for keyword in match['options'].keys()|sort() %} {%- for keyword in match['options'].keys()|sort() -%}
{{ render_option(keyword, '', config_dict=match['options']) }} {%- if keyword in ['AllowUsers', 'DenyUsers', 'AllowGroups', 'DenyGroups'] -%}
{%- endfor %} {{ option_collapselist(keyword, ' ', config_dict=match['options']) | indent(4, true) }}
{% else -%}
{{ render_option(keyword, config_dict=match['options']) | indent(4, true) }}
{% endif -%}
{%- endfor %}
{%- endfor %} {%- endfor %}
{%- endif %} {%- endif %}
{#- vim: set ft=jinja : #} {#- vim: set ft=jinja : -#}

1
openssh/map.jinja
View File

@ -86,7 +86,6 @@ that differ from whats in defaults.yaml
{% set os_finger_map = salt['grains.filter_by']({ {% set os_finger_map = salt['grains.filter_by']({
'CentOS-6': { 'CentOS-6': {
'UsePrivilegeSeparation': 'yes',
}, },
'default': {} 'default': {}
} }

12
pillar.example
View File

@ -118,7 +118,7 @@ sshd_config:
# https://stribika.github.io/2015/01/04/secure-secure-shell.html # https://stribika.github.io/2015/01/04/secure-secure-shell.html
#KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' #KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'
#Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' #Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
#MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' #MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'
KexAlgorithms: KexAlgorithms:
- 'curve25519-sha256@libssh.org' - 'curve25519-sha256@libssh.org'
- 'diffie-hellman-group-exchange-sha256' - 'diffie-hellman-group-exchange-sha256'
@ -132,11 +132,9 @@ sshd_config:
MACs: MACs:
- 'hmac-sha2-512-etm@openssh.com' - 'hmac-sha2-512-etm@openssh.com'
- 'hmac-sha2-256-etm@openssh.com' - 'hmac-sha2-256-etm@openssh.com'
- 'hmac-ripemd160-etm@openssh.com'
- 'umac-128-etm@openssh.com' - 'umac-128-etm@openssh.com'
- 'hmac-sha2-512' - 'hmac-sha2-512'
- 'hmac-sha2-256' - 'hmac-sha2-256'
- 'hmac-ripemd160'
- 'umac-128@openssh.com' - 'umac-128@openssh.com'
# Warning! You should generally NOT NEED to set ssh_config. Setting ssh_config # Warning! You should generally NOT NEED to set ssh_config. Setting ssh_config
@ -175,7 +173,7 @@ ssh_config:
# You can specify KexAlgorithms, Ciphers and MACs as both key or a list. # You can specify KexAlgorithms, Ciphers and MACs as both key or a list.
#KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1' #KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'
#Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr' #Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
#MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com' #MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'
KexAlgorithms: KexAlgorithms:
- 'curve25519-sha256@libssh.org' - 'curve25519-sha256@libssh.org'
- 'diffie-hellman-group-exchange-sha256' - 'diffie-hellman-group-exchange-sha256'
@ -191,11 +189,9 @@ ssh_config:
MACs: MACs:
- 'hmac-sha2-512-etm@openssh.com' - 'hmac-sha2-512-etm@openssh.com'
- 'hmac-sha2-256-etm@openssh.com' - 'hmac-sha2-256-etm@openssh.com'
- 'hmac-ripemd160-etm@openssh.com'
- 'umac-128-etm@openssh.com' - 'umac-128-etm@openssh.com'
- 'hmac-sha2-512' - 'hmac-sha2-512'
- 'hmac-sha2-256' - 'hmac-sha2-256'
- 'hmac-ripemd160'
- 'umac-128@openssh.com' - 'umac-128@openssh.com'
@ -290,7 +286,7 @@ openssh:
# The next 2 settings restrict the set of minions that will be added in # The next 2 settings restrict the set of minions that will be added in
# the generated ssh_known_hosts files (the default is to match all minions) # the generated ssh_known_hosts files (the default is to match all minions)
target: '*' target: '*'
expr_form: 'glob' tgt_type: 'glob'
# Name of mining functions used to gather public keys and hostnames # Name of mining functions used to gather public keys and hostnames
# (the default values are shown here) # (the default values are shown here)
mine_keys_function: public_ssh_host_keys mine_keys_function: public_ssh_host_keys
@ -308,7 +304,7 @@ openssh:
# Restrict wich hosts you want to use via their hostname # Restrict wich hosts you want to use via their hostname
# (i.e. ssh user@host instead of ssh user@host.example.com) # (i.e. ssh user@host instead of ssh user@host.example.com)
# target: '*' # Defaults to "*.{}".format(grains['domain']) with a fallback to '*' # target: '*' # Defaults to "*.{}".format(grains['domain']) with a fallback to '*'
# expr_form: 'glob' # tgt_type: 'glob'
# To activate the defaults you can just set an empty dict. # To activate the defaults you can just set an empty dict.
#hostnames: {} #hostnames: {}