From 2f4c088e5d0e3fbc22908ba0265d28d76311e10a Mon Sep 17 00:00:00 2001
From: "Matthew X. Economou" <xenophon@irtnog.org>
Date: Mon, 13 Jul 2015 15:22:45 -0400
Subject: [PATCH] Rework ssh_keys_pillar-related states

SSH key pairs deployed via the user's ssh_keys_pillar dict aren't
handled the same as the user's ssh_keys, e.g., file ownership and
permissions aren't specified, and the keying material gets copied
directly into the SLS file.  This change rewrites the two templated
file.managed states to behave as follows:

  - set the files' owner to be the user

  - set the files' group to be the user's primary group

  - for the public key, set the mode to 644 (u=rw,go=r)

  - for the private key, set the mode to 600 (u=rw,g=)

  - pull the files' contents directly from pillar
---
 users/init.sls | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/users/init.sls b/users/init.sls
index ff1b909..dc23e3f 100644
--- a/users/init.sls
+++ b/users/init.sls
@@ -174,19 +174,33 @@ users_ssh_auth_{{ name }}_{{ loop.index0 }}:
 {% endif %}
 
 {% if 'ssh_keys_pillar' in user %}
-{% for key_name, pillar_name in user['ssh_keys_pillar'].iteritems()  %}
-users_ssh_keys_files_{{ name }}_{{ key_name }}_pub:
+{% for key_name, pillar_name in user['ssh_keys_pillar'].items() %}
+user_ssh_keys_files_{{ name }}_{{ key_name }}_private_key:
   file.managed:
-    - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name
-    }}.pub
-    - contents: |
-        {{ pillar[pillar_name][key_name]['pubkey'] }}
-users_ssh_keys_files_{{ name }}_{{ key_name }}_priv:
+    - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}
+    - user: {{ name }}
+    - group: {{ user_group }}
+    - mode: 600
+    - show_diff: False
+    - contents_pillar: {{ pillar_name }}:{{ key_name }}:privkey
+    - require:
+      - user: users_{{ name }}_user
+      {% for group in user.get('groups', []) %}
+      - group: users_{{ name }}_{{ group }}_group
+      {% endfor %}
+user_ssh_keys_files_{{ name }}_{{ key_name }}_public_key:
   file.managed:
-    - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name
-    }}
-    - contents: |
-        {{ pillar[pillar_name][key_name]['privkey'] | indent(8) }}
+    - name: {{ user.get('home', '/home/{0}'.format(name)) }}/.ssh/{{ key_name }}.pub
+    - user: {{ name }}
+    - group: {{ user_group }}
+    - mode: 644
+    - show_diff: False
+    - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey
+    - require:
+      - user: users_{{ name }}_user
+      {% for group in user.get('groups', []) %}
+      - group: users_{{ name }}_{{ group }}_group
+      {% endfor %}
 {% endfor %}
 {% endif %}