Go to file
Niels Abspoel b93448b5e6
Merge pull request #124 from arthurlogilab/123-add-ini-version-of-config
[openssh/config_ini] initial version of config_ini which uses ini state
2018-03-17 21:35:30 +01:00
openssh Merge pull request #124 from arthurlogilab/123-add-ini-version-of-config 2018-03-17 21:35:30 +01:00
test/integration/default/serverspec Add kitchen tests for FreeBSD 2017-04-21 12:00:22 -06:00
.gitignore Add test-kitchen configuration 2017-02-23 14:04:27 -07:00
.kitchen.yml Add kitchen tests for FreeBSD 2017-04-21 12:00:22 -06:00
LICENSE Added support to manage ssh certificates 2014-02-09 23:38:30 +01:00
pillar.example Changed expr_form to tgt_type for deprecation reasons. (#122) 2017-12-23 00:11:24 +01:00
README.rst [openssh/config_ini] initial version of config_ini which uses ini state 2018-02-15 17:43:13 +01:00

openssh

Install and configure an openssh server.

Available states

openssh

Installs the openssh server package and service.

openssh.auth -----------

Manages SSH certificates for users.

openssh.auth_map -----------

Same functionality as openssh.auth but with a simplified Pillar syntax. Plays nicely with Pillarstack.

openssh.banner

Installs a banner that users see when SSH-ing in.

openssh.client

Installs the openssh client package.

openssh.config

Installs the ssh daemon configuration file included in this formula (under "openssh/files"). This configuration file is populated by values from pillar. pillar.example results in the generation of the default sshd_config file on Debian Wheezy.

It is highly recommended PermitRootLogin is added to pillar so root login will be disabled.

openssh.config_ini

Version of managing sshd_config that uses the ini_managed.option_present state module, so it enables to override only one or multiple values and keeping the defaults shipped by your distribution.

openssh.known_hosts

Manages the site-wide ssh_known_hosts file and fills it with the public SSH host keys of all minions. You can restrict the set of minions whose keys are listed by using the pillar data openssh:known_hosts:target and openssh:known_hosts:tgt_type (those fields map directly to the corresponding attributes of the mine.get function).

The Salt mine is used to share the public SSH host keys, you must thus configure it accordingly on all hosts that must export their keys. Two mine functions are required, one that exports the keys (one key per line, as they are stored in /etc/ssh/ssh_host_*_key.pub) and one that defines the public hostname that the keys are associated to. Here's the way to setup those functions through pillar:

# Required for openssh.known_hosts
mine_functions:
  public_ssh_host_keys:
    mine_function: cmd.run
    cmd: cat /etc/ssh/ssh_host_*_key.pub
    python_shell: True
  public_ssh_hostname:
    mine_function: grains.get
    key: id

The above example assumes that the minion identifier is a valid DNS name that can be used to connect to the host. If that's not the case, you might want to use the fqdn grain instead of the id one. The above example also uses the default mine function names used by this formula. If you have to use other names, then you should indicate the names to use in pillar keys openssh:known_hosts:mine_keys_function and openssh:known_hosts:mine_hostname_function.

You can also integrate alternate DNS names of the various hosts in the ssh_known_hosts files. You just have to list all the alternate DNS names as a list in the openssh:known_hosts:aliases pillar key. Whenever the IPv4 or IPv6 behind one of those DNS entries matches an IPv4 or IPv6 behind the official hostname of a minion, the alternate DNS name will be associated to the minion's public SSH host key.

openssh.moduli

Manages the system wide /etc/ssh/moduli file.