From c92d3ac0780e813a5440c5e475bfdba5de5a0447 Mon Sep 17 00:00:00 2001 From: elijah Date: Thu, 30 May 2013 17:06:14 -0700 Subject: site_sshd -- added xterm title, optional support for mosh --- puppet/modules/site_sshd/manifests/init.pp | 42 +++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) (limited to 'puppet/modules/site_sshd/manifests/init.pp') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index 630e9bdf..c1c4d3b3 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -1 +1,41 @@ -class site_sshd {} +class site_sshd { + $ssh = hiera_hash('ssh') + + ## + ## XTERM TITLE + ## + + file {'/etc/profile.d/xterm-title.sh': + source => "puppet://$server/modules/site_sshd/xterm-title.sh", + owner => root, group => 0, mode => 0644; + } + + ## + ## OPTIONAL MOSH SUPPORT + ## + + $mosh = $ssh['mosh'] + $mosh_ports = $mosh['ports'] + if $ssh['mosh']['enabled'] { + $mosh_ensure = present + } else { + $mosh_ensure = absent + } + + package { 'mosh': + ensure => $mosh_ensure; + } + file { '/etc/shorewall/macro.mosh': + ensure => $mosh_ensure, + content => "PARAM - - udp $mosh_ports", + notify => Service['shorewall'], + require => Package['shorewall']; + } + shorewall::rule { 'net2fw-mosh': + ensure => $mosh_ensure, + source => 'net', + destination => '$FW', + action => 'mosh(ACCEPT)', + order => 200; + } +} -- cgit v1.2.3 From e6bd481933bd4104fb7839703c88de971559d3db Mon Sep 17 00:00:00 2001 From: varac Date: Thu, 27 Jun 2013 10:52:54 +0200 Subject: added site_sshd::authorized_keys --- puppet/modules/site_sshd/manifests/init.pp | 3 +++ 1 file changed, 3 insertions(+) (limited to 'puppet/modules/site_sshd/manifests/init.pp') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index c1c4d3b3..714c0c5a 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -1,5 +1,8 @@ class site_sshd { $ssh = hiera_hash('ssh') + $ssh_authorized_keys = $ssh['authorized_keys'] + + include site_sshd::authorized_keys ## ## XTERM TITLE -- cgit v1.2.3 From 3b6f11a60778d5cb3ae265980e4e4870bf065de2 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Fri, 28 Jun 2013 12:11:32 -0400 Subject: modularize and standardize site_sshd: . move the setting of the xterm title to site_config::shell . change the xterm file resource to use standard source lines, switch to single quotes, quote mode, and line up parameters . move the mosh pieces into a site_ssh::mosh class and only include it if the right mosh variable is enabled, passing into the class the necessary hiera parameters . lint the site_ssh::mosh resources . change the authorized_keys class to accept the key parameter which is passed in from the main ssh class (but allow for out of scope variable lookup when the tag is passed) Change-Id: Ieec5a3932de9bad1b98633032b28f88e91e46604 --- puppet/modules/site_sshd/manifests/init.pp | 41 ++++++++++-------------------- 1 file changed, 14 insertions(+), 27 deletions(-) (limited to 'puppet/modules/site_sshd/manifests/init.pp') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index 714c0c5a..905d5c9b 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -1,16 +1,14 @@ class site_sshd { $ssh = hiera_hash('ssh') - $ssh_authorized_keys = $ssh['authorized_keys'] - - include site_sshd::authorized_keys ## - ## XTERM TITLE + ## SETUP AUTHORIZED KEYS ## - file {'/etc/profile.d/xterm-title.sh': - source => "puppet://$server/modules/site_sshd/xterm-title.sh", - owner => root, group => 0, mode => 0644; + $authorized_keys = $ssh['authorized_keys'] + + class { 'site_sshd::authorized_keys': + keys => $authorized_keys } ## @@ -18,27 +16,16 @@ class site_sshd { ## $mosh = $ssh['mosh'] - $mosh_ports = $mosh['ports'] - if $ssh['mosh']['enabled'] { - $mosh_ensure = present - } else { - $mosh_ensure = absent - } - package { 'mosh': - ensure => $mosh_ensure; - } - file { '/etc/shorewall/macro.mosh': - ensure => $mosh_ensure, - content => "PARAM - - udp $mosh_ports", - notify => Service['shorewall'], - require => Package['shorewall']; + if $mosh['enabled'] { + class { 'site_sshd::mosh': + ensure => present, + ports => $mosh['ports'] + } } - shorewall::rule { 'net2fw-mosh': - ensure => $mosh_ensure, - source => 'net', - destination => '$FW', - action => 'mosh(ACCEPT)', - order => 200; + else { + class { 'site_sshd::mosh': + ensure => absent + } } } -- cgit v1.2.3 From 6c34c73f7e4c5203321547b699c6eaba9de8e2fe Mon Sep 17 00:00:00 2001 From: varac Date: Thu, 27 Jun 2013 10:52:54 +0200 Subject: switch to own define for managing ssh keys The problem with puppet's built-in ssh_authorized_key is that you can purge unmanaged keys in a authorized_keys file. see https://leap.se/code/issues/3010 for details. Conflicts: puppet/modules/site_sshd/manifests/authorized_keys.pp Change-Id: I640bf7ebc0f0f7fb19cc46feb4cb2702d6561a9b --- puppet/modules/site_sshd/manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'puppet/modules/site_sshd/manifests/init.pp') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index 905d5c9b..90dd2d0e 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -7,7 +7,7 @@ class site_sshd { $authorized_keys = $ssh['authorized_keys'] - class { 'site_sshd::authorized_keys': + class { 'site_sshd::deploy_authorized_keys': keys => $authorized_keys } -- cgit v1.2.3