4 files changed, 146 insertions, 0 deletions
diff --git a/puppet/modules/site_sshd/manifests/authorized_keys.pp b/puppet/modules/site_sshd/manifests/authorized_keys.pp
new file mode 100644
index 00000000..a1fde3f6
--- /dev/null
+++ b/puppet/modules/site_sshd/manifests/authorized_keys.pp
@@ -0,0 +1,34 @@
+# We want to purge unmanaged keys from the authorized_keys file so that only
+# keys added in the provider are valid. Any manually added keys will be
+# overridden.
+#
+# In order to do this, we have to use a custom define to deploy the
+# authorized_keys file because puppet's internal resource doesn't allow
+# purging before populating this file.
+#
+# See the following for more information:
+# https://tickets.puppetlabs.com/browse/PUP-1174
+# https://leap.se/code/issues/2990
+# https://leap.se/code/issues/3010
+#
+define site_sshd::authorized_keys ($keys, $ensure = 'present', $home = '') {
+  # This line allows default homedir based on $title variable.
+  # If $home is empty, the default is used.
+  $homedir = $home ? {'' => "/home/${title}", default => $home}
+  $owner   = $ensure ? {'present' => $title, default => undef }
+  $group   = $ensure ? {'present' => $title, default => undef }
+  file {
+    "${homedir}/.ssh":
+      ensure  => 'directory',
+      owner   => $title,
+      group   => $title,
+      mode    => '0700';
+    "${homedir}/.ssh/authorized_keys":
+      ensure  => $ensure,
+      owner   => $owner,
+      group   => $group,
+      mode    => '0600',
+      require => File["${homedir}/.ssh"],
+      content => template('site_sshd/authorized_keys.erb');
+  }
+}
diff --git a/puppet/modules/site_sshd/manifests/deploy_authorized_keys.pp b/puppet/modules/site_sshd/manifests/deploy_authorized_keys.pp
new file mode 100644
index 00000000..97ca058f
--- /dev/null
+++ b/puppet/modules/site_sshd/manifests/deploy_authorized_keys.pp
@@ -0,0 +1,9 @@
+class site_sshd::deploy_authorized_keys ( $keys ) {
+  tag 'leap_authorized_keys'
+
+  site_sshd::authorized_keys {'root':
+    keys => $keys,
+    home => '/root'
+  }
+
+}
diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp
new file mode 100644
index 00000000..a9202da4
--- /dev/null
+++ b/puppet/modules/site_sshd/manifests/init.pp
@@ -0,0 +1,82 @@
+# configures sshd, mosh, authorized keys and known hosts
+class site_sshd {
+  $ssh        = hiera_hash('ssh')
+  $ssh_config = $ssh['config']
+  $hosts      = hiera('hosts', '')
+
+  ##
+  ## SETUP AUTHORIZED KEYS
+  ##
+
+  $authorized_keys = $ssh['authorized_keys']
+
+  class { 'site_sshd::deploy_authorized_keys':
+    keys => $authorized_keys
+  }
+
+  ##
+  ## SETUP KNOWN HOSTS and SSH_CONFIG
+  ##
+
+  file {
+    '/etc/ssh/ssh_known_hosts':
+      owner   => root,
+      group   => root,
+      mode    => '0644',
+      content => template('site_sshd/ssh_known_hosts.erb');
+
+    '/etc/ssh/ssh_config':
+      owner   => root,
+      group   => root,
+      mode    => '0644',
+      content => template('site_sshd/ssh_config.erb');
+  }
+
+  ##
+  ## OPTIONAL MOSH SUPPORT
+  ##
+
+  $mosh = $ssh['mosh']
+
+  if $mosh['enabled'] {
+    class { 'site_sshd::mosh':
+      ensure => present,
+      ports  => $mosh['ports']
+    }
+  }
+  else {
+    class { 'site_sshd::mosh':
+      ensure => absent
+    }
+  }
+
+  # we cannot use the 'hardened' parameter because leap_cli uses an
+  # old net-ssh gem that is incompatible with the included
+  # "KexAlgorithms curve25519-sha256@libssh.org",
+  # see https://leap.se/code/issues/7591
+  # therefore we don't use it here, but include all other options
+  # that would be applied by the 'hardened' parameter
+  # not all options are available on wheezy
+  if ( $::lsbdistcodename == 'wheezy' ) {
+    $tail_additional_options = 'Ciphers aes256-ctr
+MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+  } else {
+    $tail_additional_options = 'Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160'
+  }
+
+  ##
+  ## SSHD SERVER CONFIGURATION
+  ##
+  class { '::sshd':
+    manage_nagios           => false,
+    ports                   => [ $ssh['port'] ],
+    use_pam                 => 'yes',
+    print_motd              => 'no',
+    tcp_forwarding          => $ssh_config['AllowTcpForwarding'],
+    manage_client           => false,
+    use_storedconfigs       => false,
+    tail_additional_options => $tail_additional_options,
+    hostkey_type            => [ 'rsa', 'dsa', 'ecdsa' ]
+  }
+}
diff --git a/puppet/modules/site_sshd/manifests/mosh.pp b/puppet/modules/site_sshd/manifests/mosh.pp
new file mode 100644
index 00000000..49f56ca0
--- /dev/null
+++ b/puppet/modules/site_sshd/manifests/mosh.pp
@@ -0,0 +1,21 @@
+class site_sshd::mosh ( $ensure = present, $ports = '60000-61000' ) {
+
+  package { 'mosh':
+    ensure => $ensure
+  }
+
+  file { '/etc/shorewall/macro.mosh':
+    ensure  => $ensure,
+    content => "PARAM   -       -       udp    ${ports}",
+    notify  => Service['shorewall'],
+    require => Package['shorewall'];
+  }
+
+  shorewall::rule { 'net2fw-mosh':
+    ensure      => $ensure,
+    source      => 'net',
+    destination => '$FW',
+    action      => 'mosh(ACCEPT)',
+    order       => 200;
+  }
+}