From ce46343562a89ea5b8b1b5bc8ae75d1859507965 Mon Sep 17 00:00:00 2001
From: Alan Pearce <ap@studio-40.com>
Date: Sun, 24 Aug 2014 11:50:36 +0100
Subject: [PATCH 1/3] Config: Refactor host key provisioning into loop

---
 openssh/config.sls | 36 +++++++++---------------------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/openssh/config.sls b/openssh/config.sls
index 857eecd..a42fcd1 100644
--- a/openssh/config.sls
+++ b/openssh/config.sls
@@ -13,42 +13,24 @@ sshd_config:
     - watch_in:
       - service: openssh
 
-{% if salt['pillar.get']('openssh:provide_dsa_keys', False) %}
-ssh_host_dsa_key:
+{% for keyType in ['dsa', 'rsa'] %}
+{% if salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %}
+ssh_host_{{ keyType }}_key:
   file.managed:
-    - name: /etc/ssh/ssh_host_dsa_key
-    - contents_pillar: 'openssh:dsa:private_key'
+    - name: /etc/ssh/ssh_host_{{ keyType }}_key
+    - contents_pillar: 'openssh:{{ keyType }}:private_key'
     - user: root
     - mode: 600
     - require_in:
       - service: {{ openssh.service }}
 
-ssh_host_dsa_key.pub:
+ssh_host_{{ keyType }}_key.pub:
   file.managed:
-    - name: /etc/ssh/ssh_host_dsa_key.pub
-    - contents_pillar: 'openssh:dsa:public_key'
-    - user: root
-    - mode: 600
-    - require_in:
-      - service: {{ openssh.service }}
-{% endif %}
-
-{% if salt['pillar.get']('openssh:provide_rsa_keys', False) %}
-ssh_host_rsa_key:
-  file.managed:
-    - name: /etc/ssh/ssh_host_rsa_key
-    - contents_pillar: 'openssh:rsa:private_key'
-    - user: root
-    - mode: 600
-    - require_in:
-      - service: {{ openssh.service }}
-
-ssh_host_rsa_key.pub:
-  file.managed:
-    - name: /etc/ssh/ssh_host_rsa_key.pub
-    - contents_pillar: 'openssh:rsa:public_key'
+    - name: /etc/ssh/ssh_host_{{ keyType }}_key.pub
+    - contents_pillar: 'openssh:{{ keyType }}:public_key'
     - user: root
     - mode: 600
     - require_in:
       - service: {{ openssh.service }}
 {% endif %}
+{% endfor %}
\ No newline at end of file

From 73eaef4ea0811962d1b360837365b439f9612e54 Mon Sep 17 00:00:00 2001
From: Alan Pearce <ap@studio-40.com>
Date: Sun, 24 Aug 2014 11:51:06 +0100
Subject: [PATCH 2/3] Config: Add support for ECDSA host keys

---
 openssh/config.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/openssh/config.sls b/openssh/config.sls
index a42fcd1..3cf3376 100644
--- a/openssh/config.sls
+++ b/openssh/config.sls
@@ -13,7 +13,7 @@ sshd_config:
     - watch_in:
       - service: openssh
 
-{% for keyType in ['dsa', 'rsa'] %}
+{% for keyType in ['ecdsa', 'dsa', 'rsa'] %}
 {% if salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %}
 ssh_host_{{ keyType }}_key:
   file.managed:

From 25aa1a6733ea6927e2d14edff20469807c645131 Mon Sep 17 00:00:00 2001
From: Alan Pearce <ap@studio-40.com>
Date: Sun, 24 Aug 2014 12:18:37 +0100
Subject: [PATCH 3/3] Update pillar.example

---
 pillar.example | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pillar.example b/pillar.example
index 4edbbd3..678e2f3 100644
--- a/pillar.example
+++ b/pillar.example
@@ -49,7 +49,15 @@ openssh:
       -----END DSA PRIVATE KEY-----
     public_key: |
       ssh-dss NOT_DEFINED
+  ecdsa:
+    private_key: |
+      -----BEGIN EC PRIVATE KEY-----
+      NOT_DEFINED
+      -----END EC PRIVATE KEY-----
+    public_key: |
+      ecdsa-sha2-nistp256 NOT_DEFINED
   provide_dsa_keys: False
+  provide_ecdsa_keys: False
   provide_rsa_keys: False
   rsa:
     private_key: |