saltstack-formulas/openssh-formula
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
281 Commits 3 Branches 27 Tags 875 KiB
a47596f15a
Commit Graph

161 Commits

Author SHA1 Message Date
Michael Mol
6229a6d122 Stabily sort matches 
OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,

We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.

Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.
 2017-06-12 12:08:26 -04:00
Michael Mol
710175799b Support compound matches 
Support complex compound matches in Match criteria. For example, be able
to match against multiple Users for a given Match, or be able to match
against address ranges. Or Groups. Or any combination thereof.

Support for matching users can take one of several different appearances
in pillar data:

sshd_config:
  matches:
    match_1:
      type:
        User: one_user
      options:
        ChrootDirectory: /ex/%u
    match_2:
      type:
        User:
          - jim
          - bob
          - sally
      options:
        ChrootDirectory: /ex/%u
    match_3:
      type:
        User:
          jim: ~
          bob: ~
          sally: ~
      options:
        ChrootDirectory: /ex/%u

Note the syntax of match_3. By using empty dicts for each user, we can
leverage Salt's pillar mergine. If we use simple lists, we cannot do
this; Salt can't merge simple lists, because it doesn't know what order
they ought to be in.
 2017-06-12 11:43:46 -04:00
Michael Mol
345e07c85e Support Match prioritization 
OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,

We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.

Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.
 2017-06-09 15:51:13 -04:00
Adam Mendlik
1284109335 PrintLastLog missing in FreeBSD 11.0 
The fix introduced in 678cc9066c
suppresses the PrintLastLog directive for FreeBSD 10.3.
SSH on FreeBSD 11.0 also does not support PrintLastLog, so this
change suppresses it for any version >= 10.3.
 2017-06-04 10:33:14 -06:00
Alexander Weidinger
162705c7ce Test config before applying it 2017-05-17 13:00:06 +02:00
alxwr
844e96b57b Merge pull request #88 from alxwr/force_key_length 
Opt-in to enforce RSA key length
 2017-03-07 20:24:34 +01:00
Alexander Weidinger
6b23b28f52 Opt-in to enforce RSA key length 2017-03-04 14:21:58 +01:00
Alexander Weidinger
674216d0ad openssh.auth_map 2017-03-04 14:21:53 +01:00
Alexander Weidinger
66c954ed66 Set correct ssh(d)_config_group for *BSD 2017-03-04 14:20:07 +01:00
amendlik
6d6c7a0ead Merge branch 'master' into file-mode 2017-02-25 06:40:30 -07:00
Niels Abspoel
044d4d646b Merge pull request #81 from leansalt/pillar-example-update 
Add secure defaults to pillar.example + secure sshd_config in defaults.yml #66
 2017-02-25 12:30:37 +01:00
ek9
038a51cdc8 manage sshd_config and ssh_config only if pillars are defined 2017-02-24 21:13:52 +01:00
ek9
c03e29a498 remove Kex,MACs,Ciphers from defaults 2017-02-24 21:13:35 +01:00
Adam Mendlik
613bea2cac Add variables for file owner and mode 2017-02-23 14:56:22 -07:00
Alexander Weidinger
70461403cb known_hosts: sort IP addresses 
in order to prevent unnecessary changes due to
random ordering of dig results.
 2017-02-23 03:59:40 +01:00
Alexander Weidinger
678cc9066c PrintLastLog missing in FreeBSD 10.3 2017-02-23 01:19:21 +01:00
ek9
f5a74f3fa0 defaults: enable secure defaults on sshd_config 2017-02-19 14:45:12 +01:00
Javier Bértoli
2db9253c45 Merge pull request #82 from pepoluan/allow_list_or_string 
Allow list or string for some option, and setting of ConfigBanner
 2017-02-07 07:26:44 -03:00
Eric Cook
f4ea96f9c1 setup sftp correctly on RedHat-like machines 2017-01-24 18:17:15 -05:00
Pandu E Poluan
773d9ae092 Apply string-or-list processing to ssh_config 
Now ssh_config also accepts string-or-list options, for serveral
keywords.
 2017-01-24 01:34:24 +07:00
Pandu E Poluan
30648d115e Add macro to handle string or list 
Added a macro to handle multivalue options entered in either string
format or list format (with auto joiner).
 2017-01-24 01:17:51 +07:00
Brian Jackson
b9689cedff Merge pull request #79 from leansalt/server-service-control 
Add ability to control SSH server service status (default: on)
 2017-01-15 21:48:04 -08:00
Eric Cook
686fc2c4ee do not set UsePAM on OpenBSD 
Upstream opensshd does not support PAM
 2017-01-14 18:38:37 -05:00
Simon Pirschel
1b69ecab2c fix issue with stripping new line will result in invalid SLS definition if AuthorizedKeysFile is missing in sshd_config 2016-11-02 15:21:50 +01:00
Simon Pirschel
2a1b8fbc66 fix issue sshd won't start if AddressFamily is specified, because it must be defined before ListenAddress 2016-11-01 13:24:30 +01:00
Forrest
ec663a6f5e Merge pull request #51 from mathieupotier/master 
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile)
 2016-10-31 09:32:50 -07:00
Eric Cook
51fd8b1391 fix Subsystem directive on archlinux 2016-10-30 00:06:02 -04:00
omltorg
de66dbee97 Update name of package containing dig on ArchLinux 2016-10-14 22:25:56 +00:00
Johannes Löthberg
02b52fa7cf Add AuthorizedKeysCommand support 
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
 2016-10-01 20:53:44 +02:00
Mathieu POTIER
760a2ad277 fix the path to authkeys 
Allow user to specify aliased path (with %u)
 2016-08-02 09:54:46 +02:00
Mathieu POTIER
4c814843f8 Merge remote-tracking branch 'refs/remotes/saltstack-formulas/master' 2016-08-02 09:46:08 +02:00
Pandu E Poluan
e6603ae62a Allow moduli to be pulled as file 
Added Jinja logic to allow the option to pull the moduli from an online source.
 2016-08-01 23:59:11 +07:00
Lev Lozhkin
781be61881 Convert dig exist check to unless req 2016-07-19 13:23:48 -07:00
Jonathon Anderson
87057c7c6b Correct openssh-clients package name for Red Hat 2016-07-01 23:53:00 -06:00
Niels Abspoel
641851632f add more authentication options 2016-05-26 21:57:02 +02:00
Matthieu DERASSE
3542a1f534 Implement Session idle time out 2016-05-25 00:06:45 +02:00
Forrest
22037f7b8b Merge pull request #63 from llua/arch_bind_utils 
set dig_pkg on arch linux for issue #59
 2016-05-09 20:52:42 -07:00
Eric Cook
dfb04a43b4 set dig_pkg on arch linux for issue #59 2016-05-09 23:47:57 -04:00
llua
bd8d46d784 add OpenBSD to map.jinja 2016-05-09 23:44:20 -04:00
Forrest
f7c84783f0 Merge pull request #61 from babilen/relax-ssh-defaults 
Drop overly biased ssh_config defaults
 2016-05-04 12:32:48 -07:00
Wolodja Wentland
49923a6371 Drop overly opinionated ssh_config defaults 
This set of options reflect the ssh_config options that are set by
default on Debian. The way this was set before has the potential to
break exisisting setups that rely on "normal" defaults, rather than the
rather opinionated ones that are now being shipped with this formula.
 2016-05-04 18:25:01 +02:00
Simon Lloyd
daed52de19 Add sshd_config to map.jinja and check if dig command is available before installing 'dig' package. 2016-04-19 02:53:14 +02:00
Theo Chatzimichos
0abbaac60d Fix the default Subystem sftp-server path for SLE 2016-03-23 14:41:25 +01:00
Nigel Sim
1e515b0f5d make the host option rendering support lists by refactoring the main option rendering code 
put the ssh_config Host:* options in the defaults file so they can be overridden
 2016-01-14 02:57:45 +00:00
ketzacoatl
143451eb19 Add support for Host definitions in ssh_config 
This gives us the ability to define system-wide definitions for specific Hosts, and their options.

For example, with this in pillar:

```
# this is the place for host-wide SSH config
ssh_config:
  ...
  Hosts:
    # this simplifies cloning with custom params
    # eg: git clone my-git:foo/bar
    my-git:
      User: git
      HostName: git.example.com
      Port: 2222
```

This would add a section in `/etc/ssh/ssh_config`:

```
Host my-git
    User git
    HostName git.example.com
    Port 2222
```
 2016-01-02 18:12:55 -05:00
ek9
33344743b0 Add ability to control SSH server status (default: on) 2015-12-27 18:17:01 +01:00
abednarik
b813b4b52a Replaced iteritems deprecated function with items 2015-11-30 09:25:28 -03:00
abednarik
3791b11380 Added default path for sftp Subsystem in FreeBSD 2015-11-29 15:56:17 -03:00
POTIER Mathieu
f55445211c Specify config clause only if defined in pillar. 
Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
 2015-11-18 20:33:50 +01:00
POTIER Mathieu
dda1fb5128 Put ssh keys on configured path in sshd_config (AuthorizedKeysFile) 
Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
 2015-11-17 11:09:37 +01:00
Bogdan Radulescu
13cf374efe Added configuration options for ssh_config 
Made a small change to reflect the default sshd_config
 2015-10-01 15:21:16 +00:00
Bogdan Radulescu
fd4381b769 The default value for ServerKeyBits is 1024 both upstream and in distros 2015-07-30 12:27:05 +00:00
René Jochum
c27f9a81f3 Use iteritems() instead of items(). 
Signed-off-by: René Jochum <rene@jochums.at>
 2015-07-13 16:00:22 +02:00
René Jochum
064d489f41 Use iteritems() instead of items(). 
Signed-off-by: René Jochum <rene@jochums.at>
 2015-07-13 15:59:44 +02:00
René Jochum
a013b79027 Use iteritems() instead of items(). 
Signed-off-by: René Jochum <rene@jochums.at>
 2015-07-13 15:56:25 +02:00
elfixit
18ba94d0fc add options to give a key size to generate_key 2015-07-12 18:09:26 +02:00
Ingo Bente
a927107b28 Adds support to customize /etc/ssh/moduli file 2015-07-02 19:09:41 +02:00
Ingo Bente
83bb5ac5a0 adds support to harden sshd_config (KeyExchange, Ciphers, MACs) 2015-06-30 14:33:57 +02:00
Thomas Juberg
6b68c44583 Stop messing up the first line in ssh_known_hosts 2015-06-25 14:28:26 +02:00
Imran Haider
4dddff0ccd Fix service name for Arch Linux 2015-06-20 14:24:51 -04:00
Niels Abspoel
2a68ccac1a Add option to remove ssh_host_keys 2015-06-07 20:37:33 +02:00
Niels Abspoel
ca62b7d118 Improve default lookup 
Added defaults.yaml and map.jinja similar to template-formula and salt-formula
 2015-06-02 22:52:59 +02:00
jvblasco
60691ef20d Fix bug that added : at the end of the key 2015-05-22 14:32:57 +02:00
Raphaël Hertzog
1b74efd2d0 Add a new openssh.known_hosts state 
This state manages /etc/ssh/ssh_known_hosts and fills it with
public SSH host keys of other minions.
 2015-03-26 17:50:32 +01:00
Marc Schiffbauer
c6aeaf4dc5 add gentoo support 2015-03-23 14:56:12 +01:00
Marc Schiffbauer
28e0916840 sort distros alphabetically 2015-03-23 14:55:40 +01:00
Bernd Schlapsi
6efc981885 Refactor auth.sls to allow more keys for one user 2015-01-28 22:17:07 +01:00
Niels Abspoel
33ee945557 Added AllowUsers,AllowGroups,DenyUsers,DenyGroups 
This will add more options to set to secure openssh
- AllowUsers
- AllowGroups
- DenyUsers
- DenyGroups
 2015-01-16 22:56:59 +01:00
Bohdan Kmit
b843d8168b add ed25519 host key type; add AuthenticationMethods option 2015-01-16 17:21:10 +00:00
Niels Abspoel
5871efb5bd added archlinux support to openssh map.jinja 2015-01-01 00:44:17 +01:00
Franz Pletz
5d0f69ad2c Cleanups for host key pillar example 2014-12-15 07:00:45 +01:00
Franz Pletz
33f21a0976 Add support for ED25519 host keys 2014-12-15 07:00:17 +01:00
Nitin Madhok
620cc0f199 Update map.jinja 2014-12-08 16:01:00 -05:00
Nitin Madhok
131a5cafcb Update map.jinja 2014-12-08 15:46:30 -05:00
Nitin Madhok
9263857193 Update map.jinja 
Correct indentation
 2014-12-08 15:43:40 -05:00
Niels Abspoel
1efce43d55 Added Opensuse support to map.jinja 2014-12-08 21:38:23 +01:00
Skyler Berg
a83409182f Fix jinja spacing mistake for unknown options 
When specifying multiple unknown ssh options, they would all appear on
the same line.
 2014-11-18 14:58:57 -08:00
Tim Jones
09ca7de060 Allow newline after ListenAddress 2014-10-26 20:27:11 +01:00
Robert Fairburn
8616d3d130 fix comment 2014-09-19 12:01:57 -05:00
Robert Fairburn
b24101264f make sure to match options as the options dict! 2014-09-19 11:26:10 -05:00
Robert Fairburn
1a2de43ed7 defaults do not need a prefix 2014-09-19 11:21:31 -05:00
Robert Fairburn
85c97b450a fix a typo in keywords being sent improperly 2014-09-19 11:19:37 -05:00
Robert Fairburn
abf6e09fbb Fix a typo in the match jinja 2014-09-19 11:16:58 -05:00
Robert Fairburn
ba72c1e8b7 remove prefix when not needed 2014-09-19 10:55:19 -05:00
Robert Fairburn
c100fc88a3 allow for "Match" inside of an sshd_config 2014-09-19 10:47:35 -05:00
Alan Pearce
6fb57f40bc Config: Add support for generating keys 2014-08-24 16:09:12 +01:00
Alan Pearce
73eaef4ea0 Config: Add support for ECDSA host keys 2014-08-24 11:55:38 +01:00
Alan Pearce
ce46343562 Config: Refactor host key provisioning into loop 2014-08-24 11:55:38 +01:00
Alan Pearce
2876a691b0 Remove reference to root group 
By not specifying it, root user's group should be used.
 2014-08-19 21:44:38 +01:00
Alan Pearce
edc208b79b Add FreeBSD compatibility 2014-08-08 13:38:27 +01:00
Wes Turner
970777b9bb Add a UseDNS option to sshd_config 2014-07-22 00:35:11 -05:00
Oleg Tsarev
48ebd1b07b Changed sshd_config generation to more readable scheme. 
Synced file with default from Ubuntu 12.04 latest
 2014-05-05 19:28:13 +04:00
Seth House
cee3f097f0 Merge pull request #12 from z-saltstack/auth-sls-clean-whitespaces 
Removed unneeded whitespace from auth.sls
 2014-04-28 18:03:58 -06:00
matthew-parlette
cdfab3953d Define a line for each option. 
This provides a default option (according to the package-provided config file) for each option in the config.
 2014-04-26 18:22:17 -04:00
Oleg Tsarev
7521398506 Removed unneeded whitespace from auth.sls 2014-04-26 22:40:29 +02:00
matthew-parlette
2f28a008c2 Cleared out static parts of config since it was causing issues 2014-04-25 16:33:07 -04:00
Seth House
b44c26cd13 Moved the rsa/dsa key management to config.sls 2014-03-17 16:17:04 -06:00
Seth House
351a6b81dc Merge remote-tracking branch 'origin/pr/3' 
Conflicts:
	openssh/files/sshd_config
	openssh/init.sls
	pillar.example
 2014-03-17 16:14:17 -06:00
Carlos Perelló Marín
e2cddca13e Reverted the namespace change to avoid conflicts and backward incompatibilities 2014-02-09 23:42:52 +01:00
Carlos Perelló Marín
47211d0648 Added support to manage ssh certificates 2014-02-09 23:38:30 +01:00