From e6bd481933bd4104fb7839703c88de971559d3db Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 27 Jun 2013 10:52:54 +0200
Subject: added site_sshd::authorized_keys

---
 puppet/modules/site_sshd/manifests/authorized_keys.pp | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 puppet/modules/site_sshd/manifests/authorized_keys.pp

(limited to 'puppet/modules/site_sshd/manifests/authorized_keys.pp')

diff --git a/puppet/modules/site_sshd/manifests/authorized_keys.pp b/puppet/modules/site_sshd/manifests/authorized_keys.pp
new file mode 100644
index 00000000..edd6e3c4
--- /dev/null
+++ b/puppet/modules/site_sshd/manifests/authorized_keys.pp
@@ -0,0 +1,6 @@
+class site_sshd::authorized_keys {
+  tag 'leap_authorized_keys'
+
+  create_resources(site_sshd::authorized_keys::key, $site_sshd::ssh_authorized_keys)
+
+}
-- 
cgit v1.2.3


From 3b6f11a60778d5cb3ae265980e4e4870bf065de2 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Fri, 28 Jun 2013 12:11:32 -0400
Subject: modularize and standardize site_sshd:

 . move the setting of the xterm title to site_config::shell

 . change the xterm file resource to use standard source lines, switch to single
 quotes, quote mode, and line up parameters

 . move the mosh pieces into a site_ssh::mosh class and only include it if the
 right mosh variable is enabled, passing into the class the necessary hiera parameters

 . lint the site_ssh::mosh resources

 . change the authorized_keys class to accept the key parameter which is passed
 in from the main ssh class (but allow for out of scope variable lookup when the
 tag is passed)

Change-Id: Ieec5a3932de9bad1b98633032b28f88e91e46604
---
 puppet/modules/site_sshd/manifests/authorized_keys.pp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'puppet/modules/site_sshd/manifests/authorized_keys.pp')

diff --git a/puppet/modules/site_sshd/manifests/authorized_keys.pp b/puppet/modules/site_sshd/manifests/authorized_keys.pp
index edd6e3c4..8e0c15ac 100644
--- a/puppet/modules/site_sshd/manifests/authorized_keys.pp
+++ b/puppet/modules/site_sshd/manifests/authorized_keys.pp
@@ -1,6 +1,6 @@
-class site_sshd::authorized_keys {
+class site_sshd::authorized_keys ( $keys = $site_sshd::authorized_keys ) {
   tag 'leap_authorized_keys'
 
-  create_resources(site_sshd::authorized_keys::key, $site_sshd::ssh_authorized_keys)
+  create_resources(site_sshd::authorized_keys::key, $keys)
 
 }
-- 
cgit v1.2.3


From 6c34c73f7e4c5203321547b699c6eaba9de8e2fe Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 27 Jun 2013 10:52:54 +0200
Subject: switch to own define for managing ssh keys

The problem with puppet's built-in ssh_authorized_key is that you can
purge unmanaged keys in a authorized_keys file. see
https://leap.se/code/issues/3010 for details.

Conflicts:
	puppet/modules/site_sshd/manifests/authorized_keys.pp

Change-Id: I640bf7ebc0f0f7fb19cc46feb4cb2702d6561a9b
---
 .../modules/site_sshd/manifests/authorized_keys.pp | 23 +++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

(limited to 'puppet/modules/site_sshd/manifests/authorized_keys.pp')

diff --git a/puppet/modules/site_sshd/manifests/authorized_keys.pp b/puppet/modules/site_sshd/manifests/authorized_keys.pp
index 8e0c15ac..c18f691c 100644
--- a/puppet/modules/site_sshd/manifests/authorized_keys.pp
+++ b/puppet/modules/site_sshd/manifests/authorized_keys.pp
@@ -1,6 +1,19 @@
-class site_sshd::authorized_keys ( $keys = $site_sshd::authorized_keys ) {
-  tag 'leap_authorized_keys'
-
-  create_resources(site_sshd::authorized_keys::key, $keys)
-
+define site_sshd::authorized_keys ($keys, $ensure = 'present', $home = '') {
+  # This line allows default homedir based on $title variable.
+  # If $home is empty, the default is used.
+  $homedir = $home ? {'' => "/home/${title}", default => $home}
+  file {
+    "${homedir}/.ssh":
+      ensure  => 'directory',
+      owner   => $title,
+      group   => $title,
+      mode    => '0700';
+    "${homedir}/.ssh/authorized_keys":
+      ensure  => $ensure,
+      owner   => $ensure ? {'present' => $title, default => undef },
+      group   => $ensure ? {'present' => $title, default => undef },
+      mode    => '0600',
+      require => File["${homedir}/.ssh"],
+      content => template('site_sshd/authorized_keys.erb');
+  }
 }
-- 
cgit v1.2.3