Defined Type: ssh::sftp::user

Defined in:
manifests/sftp/user.pp

Overview

Define: ssh::s:user

Setup Linux user accounts restricted to using SFTP only

Parameters

namevar

The account name

ssh_key

The authorized key; generally a long string of hex digits

ssh_type

The encryption type used. See ssh_authorized_type/type for more details

ssh_options

Key options, see sshd(8) for possible values

password

Set the user’s password

present

Define if this account is present or absent

home

The home directory of the user

manage_home

Select wether to manage the user’s home directory

home_mode

The desired permissions of the user’s home directory, if manage_home is set

basedir

This directory will be used to store files

basedir_mode

The desired permissions for the base directory

manage_basedir

Select wether to manage the directory given in the basedir parameter.

group

The restricted sftp group name. Must be declared outside this definition.

using_ssk_key

Examples

ssh::sftp::user { 'namevar':
  ssh_key => 'AAAAB3NzaC1yc...',
}

Authors

Mathieu Bornoz <mathieu.bornoz@camptocamp.com>

Parameters:

  • ssh_key (Any) (defaults to: false)
  • ssh_type (Any) (defaults to: 'ssh-rsa')
  • ssh_options (Any) (defaults to: [])
  • password (Any) (defaults to: false)
  • ensure (Any) (defaults to: 'present')
  • home (Any) (defaults to: false)
  • home_mode (Any) (defaults to: '0750')
  • basedir (Any) (defaults to: 'uploads')
  • basedir_mode (Any) (defaults to: '2775')
  • manage_home (Any) (defaults to: true)
  • manage_basedir (Any) (defaults to: true)
  • group (Any) (defaults to: 'sftponly')
  • using_ssk_key (Any) (defaults to: false) 


58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
 
# File 'manifests/sftp/user.pp', line 58

define ssh::sftp::user (
  $ssh_key        = false,
  $ssh_type       = 'ssh-rsa',
  $ssh_options    = [],
  $password       = false,
  $ensure         = 'present',
  $home           = false,
  $home_mode      = '0750',
  $basedir        = 'uploads',
  $basedir_mode   = '2775',
  $manage_home    = true,
  $manage_basedir = true,
  $group          = 'sftponly',
  $using_ssk_key  = false,
) {

  $ensure_dir = $ensure ? {
    'absent' => 'absent',
    default  => directory,
  }

  $using_ssh_key = $ssh_key ? {
    false   => false,
    default => true,
  }

  if ($using_ssh_key == false) and ($password == false) {
    fail "Must specify at least one of 'password' or 'ssh_key' in ssh::sftp::user[${name}]"
  }

  $user_home = $home ? {
    false   => "/home/${name}",
    default => $home,
  }

  if $manage_home and $ensure == 'present' {
    file {$user_home:
      ensure => directory,
      owner  => root,
      group  => $group,
      mode   => $home_mode,
    }
  }

  $nologin_path = $::lsbdistid ? {
    /Debian|Ubuntu/ => '/usr/sbin/nologin',
    /RedHat|CentOS/ => '/sbin/nologin',
  }

  $user_password = $password ? {
    false   => undef,
    default => $password,
  }

  user {$name:
    ensure   => $ensure,
    password => $user_password,
    home     => $user_home,
    groups   => $group,
    shell    => $nologin_path,
  }

  if $manage_basedir and $ensure == 'present' {
    file {"${user_home}/${basedir}":
      ensure  => directory,
      mode    => $basedir_mode,
      owner   => $name,
      group   => $group,
      require => [ User[$name], Group[$group] ],
    }
  }

  if $using_ssh_key {
    file {"${user_home}/.ssh":
      ensure => $ensure_dir,
      force  => true,
      mode   => '0700',
      owner  => $name,
      group  => $name,
    }

    ssh_authorized_key {"sftponly_${name}":
      ensure  => $ensure,
      user    => $name,
      key     => $ssh_key,
      type    => $ssh_type,
      options => $ssh_options,
      require => [File["${user_home}/.ssh"],User[$name]],
    }
  }

  sshd_config_subsystem {'sftp':
    ensure  => $ensure,
    command => 'internal-sftp -u 0002',
  }

  sshd_config {'PasswordAuthentication':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => 'yes',
  }

  sshd_config {'KbdInteractiveAuthentication':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => 'yes',
  }

  sshd_config {'ChrootDirectory':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => '%h',
  }

  sshd_config {'X11Forwarding':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => 'no',
  }

  sshd_config {'AllowTcpForwarding':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => 'no',
  }

  sshd_config {'ForceCommand':
    ensure    => $ensure,
    condition => "Group ${group}",
    value     => 'internal-sftp -u 0002',
  }

}