Puppet Class: openssh::config

Defined in:
manifests/config.pp

Summary

Setup SSHD daemon configuration

Overview

Setup SSHD daemon configuration based on template

Examples:

include openssh::config

Parameters:

  • setup_ed25519_key (Boolean) (defaults to: $openssh::setup_ed25519_key) —

    Whether to generate ed25519 ssh key by default (if absent) or not

  • hostkeyalgorithms (Optional[Variant[String, Array[Openssh::HostKeyAlgorithms]]]) (defaults to: $openssh::hostkeyalgorithms) —

    Specifies the host key signature algorithms that the server offers. The defaults (OpenSSH 7.3) are: ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com, ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, ssh-ed25519, ssh-rsa, ssh-dss.

  • config (Stdlib::Unixpath) (defaults to: $openssh::config)
  • ssh_port (Stdlib::Port) (defaults to: $openssh::ssh_port)
  • protocol (Optional[Integer[1,2]]) (defaults to: $openssh::protocol)
  • config_template (Optional[String]) (defaults to: $openssh::config_template)
  • banner (Variant[Enum['none'], Stdlib::Unixpath]) (defaults to: $openssh::banner)
  • keys_file (Optional[String]) (defaults to: $openssh::keys_file)
  • allow_tcp_forwarding (Enum['yes', 'no', 'all', 'local', 'remote']) (defaults to: $openssh::allow_tcp_forwarding)
  • permit_root_login (Enum['yes', 'no', 'without-password', 'prohibit-password', 'forced-commands-only']) (defaults to: $openssh::permit_root_login)
  • strict_modes (Enum['yes', 'no']) (defaults to: $openssh::strict_modes)
  • gss_api_authentication (Enum['yes', 'no']) (defaults to: $openssh::gss_api_authentication)
  • hostbased_authentication (Enum['yes', 'no']) (defaults to: $openssh::hostbased_authentication)
  • challenge_response_authentication (Openssh::Switch) (defaults to: $openssh::challenge_response_authentication)
  • password_authentication (Openssh::Switch) (defaults to: $openssh::password_authentication)
  • use_privilege_separation (Optional[Enum['yes', 'no', 'sandbox']]) (defaults to: $openssh::use_privilege_separation)
  • permit_tunnel (Enum['yes', 'point-to-point', 'ethernet', 'no']) (defaults to: $openssh::permit_tunnel)
  • macs (Optional[Variant[String, Array[Openssh::MACs]]]) (defaults to: $openssh::macs)
  • ciphers (Optional[Variant[String, Array[Openssh::Ciphers]]]) (defaults to: $openssh::ciphers)
  • kexalgorithms (Optional[Variant[String, Array[Openssh::KexAlgorithms]]]) (defaults to: $openssh::kexalgorithms)
  • max_startups (Optional[Tuple[Integer[0], Integer[0, 100], Integer[0]]]) (defaults to: $openssh::max_startups)
  • max_sessions (Integer[1]) (defaults to: $openssh::max_sessions)
  • use_dns (Openssh::Switch) (defaults to: $openssh::use_dns)
  • setup_host_key (Boolean) (defaults to: $openssh::setup_host_key) 


19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'manifests/config.pp', line 19

class openssh::config (
  Stdlib::Unixpath $config = $openssh::config,
  Stdlib::Port $ssh_port = $openssh::ssh_port,
  Optional[Integer[1,2]] $protocol = $openssh::protocol,
  Optional[String] $config_template = $openssh::config_template,
  Variant[Enum['none'], Stdlib::Unixpath] $banner = $openssh::banner,
  Optional[String] $keys_file = $openssh::keys_file,
  Enum['yes', 'no', 'all', 'local', 'remote']
  $allow_tcp_forwarding = $openssh::allow_tcp_forwarding,
  Enum['yes', 'no', 'without-password', 'prohibit-password', 'forced-commands-only']
  $permit_root_login = $openssh::permit_root_login,
  Enum['yes', 'no'] $strict_modes = $openssh::strict_modes,
  Enum['yes', 'no'] $gss_api_authentication = $openssh::gss_api_authentication,
  Enum['yes', 'no'] $hostbased_authentication = $openssh::hostbased_authentication,
  Openssh::Switch $challenge_response_authentication = $openssh::challenge_response_authentication,
  Openssh::Switch $password_authentication = $openssh::password_authentication,
  Optional[Enum['yes', 'no', 'sandbox']]
  $use_privilege_separation = $openssh::use_privilege_separation,
  Enum['yes', 'point-to-point', 'ethernet', 'no']
  $permit_tunnel = $openssh::permit_tunnel,
  Optional[Variant[String, Array[Openssh::MACs]]] $macs = $openssh::macs,
  Optional[Variant[String, Array[Openssh::Ciphers]]] $ciphers = $openssh::ciphers,
  Optional[Variant[String, Array[Openssh::KexAlgorithms]]] $kexalgorithms = $openssh::kexalgorithms,
  Optional[Variant[String, Array[Openssh::HostKeyAlgorithms]]] $hostkeyalgorithms = $openssh::hostkeyalgorithms,
  Optional[Tuple[Integer[0], Integer[0, 100], Integer[0]]] $max_startups = $openssh::max_startups,
  Integer[1] $max_sessions = $openssh::max_sessions,
  Openssh::Switch $use_dns = $openssh::use_dns,
  # whether to add HostKey directives into sshd_config or not
  Boolean $setup_host_key = $openssh::setup_host_key,
  Boolean $setup_ed25519_key = $openssh::setup_ed25519_key,
) {
  if $max_startups {
    if $max_startups[2] < $max_startups[0] {
      fail("MaxStartups: 'full' value (${max_startups[2]}) must be >= 'start' value (${max_startups[0]})")
    }
  }

  if $facts['os']['name'] in ['RedHat', 'CentOS'] and $facts['os']['release']['major'] in ['5', '6'] {
    $ed25519_key_generate = false
  }
  else {
    $ed25519_key_generate = $setup_ed25519_key
  }

  if $config_template {
    file { $config:
      ensure  => file,
      owner   => 'root',
      group   => 'root',
      mode    => '0640',
      content => template($config_template),
    }
  }
  else {
    file { $config:
      ensure => file,
      owner  => 'root',
      group  => 'root',
      mode   => '0640',
    }
  }

  if $setup_host_key {
    # https://access.redhat.com/solutions/1486393
    exec {
      default:
        path => '/bin:/usr/bin',
        ;
      'ssh-keygen -t rsa -P "" -f /etc/ssh/ssh_host_rsa_key':
        creates => '/etc/ssh/ssh_host_rsa_key',
        ;
      'ssh-keygen -t ecdsa -P "" -f /etc/ssh/ssh_host_ecdsa_key':
        creates => '/etc/ssh/ssh_host_ecdsa_key',
        ;
    }

    if $ed25519_key_generate {
      exec { 'ssh-keygen -t ed25519 -P "" -f /etc/ssh/ssh_host_ed25519_key':
        creates => '/etc/ssh/ssh_host_ed25519_key',
        path    => '/bin:/usr/bin',
      }
    }
  }
}