saltstack-formulas/openssh-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed key generation

Browse Source 
- generate before running check_mk on the sshd_config
- set permissions on private key
- cope with empty keys
This commit is contained in:
Alexander Weidinger 2017-07-31 23:05:14 +02:00
parent 7cd1faac84
commit 7afea021c6
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
openssh/config.sls
View File

@ -42,16 +42,25 @@ ssh_remove_short_{{ keyType }}_key:
{%- endif %} {%- endif %}
ssh_generate_host_{{ keyType }}_key: ssh_generate_host_{{ keyType }}_key:
cmd.run: cmd.run:
{%- if keySize %} {%- set keySizePart = "-b {}".format(keySize) if keySize else "" %}
- name: ssh-keygen -t {{ keyType }} -b {{ keySize }} -N '' -f {{ keyFile }} - name: "rm {{ keyFile }}*; ssh-keygen -t {{ keyType }} {{ keySizePart }} -N '' -f {{ keyFile }}"
{%- else %} - unless: "test -s {{ keyFile }}"
- name: ssh-keygen -t {{ keyType }} -N '' -f {{ keyFile }}
{%- endif %}
- creates: {{ keyFile }}
- user: root - user: root
- require_in:
- file: sshd_config
- watch_in: - watch_in:
- service: {{ openssh.service }} - service: {{ openssh.service }}
ssh_host_{{ keyType }}_key: # set permissions
file.managed:
- name: {{ keyFile }}
- replace: false
- mode: 0600
- require:
- cmd: ssh_generate_host_{{ keyType }}_key
- require_in:
- file: sshd_config
{%- elif salt['pillar.get']('openssh:absent_' ~ keyType ~ '_keys', False) %} {%- elif salt['pillar.get']('openssh:absent_' ~ keyType ~ '_keys', False) %}
ssh_host_{{ keyType }}_key: ssh_host_{{ keyType }}_key:
file.absent: file.absent:
@ -72,6 +81,8 @@ ssh_host_{{ keyType }}_key:
- contents_pillar: 'openssh:{{ keyType }}:private_key' - contents_pillar: 'openssh:{{ keyType }}:private_key'
- user: root - user: root
- mode: 600 - mode: 600
- require_in:
- file: sshd_config
- watch_in: - watch_in:
- service: {{ openssh.service }} - service: {{ openssh.service }}
@ -81,6 +92,8 @@ ssh_host_{{ keyType }}_key.pub:
- contents_pillar: 'openssh:{{ keyType }}:public_key' - contents_pillar: 'openssh:{{ keyType }}:public_key'
- user: root - user: root
- mode: 600 - mode: 600
- require_in:
- file: sshd_config
- watch_in: - watch_in:
- service: {{ openssh.service }} - service: {{ openssh.service }}
{%- endif %} {%- endif %}
@ -91,6 +104,8 @@ ssh_host_{{ keyType }}_key.pub:
file.directory: file.directory:
- user: root - user: root
- mode: 755 - mode: 755
- require_in:
- file: sshd_config
- watch_in: - watch_in:
- service: {{ openssh.service }} - service: {{ openssh.service }}
{% endif %} {% endif %}