From a927107b2806c6e294cd8417f21940bc00ed5807 Mon Sep 17 00:00:00 2001 From: Ingo Bente Date: Wed, 1 Jul 2015 22:42:48 +0200 Subject: [PATCH] Adds support to customize /etc/ssh/moduli file --- README.rst | 5 +++++ openssh/defaults.yaml | 1 + openssh/moduli.sls | 8 ++++++++ pillar.example | 8 ++++++++ 4 files changed, 22 insertions(+) create mode 100644 openssh/moduli.sls diff --git a/README.rst b/README.rst index d33b9ab..f45634b 100644 --- a/README.rst +++ b/README.rst @@ -80,3 +80,8 @@ list in the ``openssh:known_hosts:aliases`` pillar key. Whenever the IPv4 or IPv6 behind one of those DNS entries matches an IPv4 or IPv6 behind the official hostname of a minion, the alternate DNS name will be associated to the minion's public SSH host key. + +``openssh.moduli`` +----------------------- + +Manages the system wide ``/etc/ssh/moduli`` file. diff --git a/openssh/defaults.yaml b/openssh/defaults.yaml index 07fad2f..3c1b379 100644 --- a/openssh/defaults.yaml +++ b/openssh/defaults.yaml @@ -5,3 +5,4 @@ openssh: banner_src: salt://openssh/files/banner ssh_known_hosts: /etc/ssh/ssh_known_hosts dig_pkg: dnsutils + ssh_moduli: /etc/ssh/moduli diff --git a/openssh/moduli.sls b/openssh/moduli.sls new file mode 100644 index 0000000..d871006 --- /dev/null +++ b/openssh/moduli.sls @@ -0,0 +1,8 @@ +{% from "openssh/map.jinja" import openssh with context %} + +{% if salt['pillar.get']('openssh:moduli', False) %} +ssh_moduli: + file.managed: + - name: {{ openssh.ssh_moduli }} + - contents_pillar: openssh:moduli +{% endif %} diff --git a/pillar.example b/pillar.example index 079ae7b..e7d1575 100644 --- a/pillar.example +++ b/pillar.example @@ -127,6 +127,14 @@ openssh: - cname-to-minion.example.org - alias.example.org +# specify DH parameters (see /etc/ssh/moduli) + moduli: | + # Time Type Tests Tries Size Generator Modulus + 20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63 + 20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB + 20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53 + 20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F + # Required for openssh.known_hosts mine_functions: public_ssh_host_keys: