From 665db30f37838bcebbfdc368f65ed369282c31b8 Mon Sep 17 00:00:00 2001 From: elijah Date: Sun, 9 Feb 2014 17:04:58 -0800 Subject: deploy a valid /etc/ssh/ssh_known_hosts for all nodes (requires new leap_cli) --- puppet/modules/site_sshd/manifests/init.pp | 9 +++++++++ puppet/modules/site_sshd/manifests/known_hosts.pp | 11 +++++++++++ puppet/modules/site_sshd/templates/ssh_known_hosts.erb | 5 +++++ 3 files changed, 25 insertions(+) create mode 100644 puppet/modules/site_sshd/manifests/known_hosts.pp create mode 100644 puppet/modules/site_sshd/templates/ssh_known_hosts.erb (limited to 'puppet') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index 90dd2d0e..d2b13822 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -1,5 +1,6 @@ class site_sshd { $ssh = hiera_hash('ssh') + $hosts = hiera_hash('hosts') ## ## SETUP AUTHORIZED KEYS @@ -11,6 +12,14 @@ class site_sshd { keys => $authorized_keys } + ## + ## SETUP KNOWN HOSTS + ## + + class { 'site_sshd::known_hosts': + hosts => $hosts + } + ## ## OPTIONAL MOSH SUPPORT ## diff --git a/puppet/modules/site_sshd/manifests/known_hosts.pp b/puppet/modules/site_sshd/manifests/known_hosts.pp new file mode 100644 index 00000000..290ffd0b --- /dev/null +++ b/puppet/modules/site_sshd/manifests/known_hosts.pp @@ -0,0 +1,11 @@ +class site_sshd::known_hosts ($hosts) { + # these owner and permissions seem odd to me, but it is what is defined + # in modules/sshd/manifests/client/base.pp, so we are going to stick with it. + file { '/etc/ssh/ssh_known_hosts': + ensure => present, + owner => root, + group => 0, + mode => '0644', + content => template('site_sshd/ssh_known_hosts.erb'); + } +} diff --git a/puppet/modules/site_sshd/templates/ssh_known_hosts.erb b/puppet/modules/site_sshd/templates/ssh_known_hosts.erb new file mode 100644 index 00000000..c5a71378 --- /dev/null +++ b/puppet/modules/site_sshd/templates/ssh_known_hosts.erb @@ -0,0 +1,5 @@ +# This file is generated by Puppet + +<% hosts.sort.each do |name, hash| -%> +<%=name%>,<%=hash['domain_full']%>,<%=hash['domain_internal']%>,<%=hash['ip_address']%> <%=hash['host_pub_key']%> +<% end -%> -- cgit v1.2.3 From 0b3e87cd6916d4ca4404fd2b375d21468d17f343 Mon Sep 17 00:00:00 2001 From: elijah Date: Mon, 10 Feb 2014 15:43:39 -0800 Subject: turn off StrictHostKeyChecking for vagrant ssh clients --- puppet/modules/site_sshd/manifests/init.pp | 15 +++++++++++--- puppet/modules/site_sshd/manifests/known_hosts.pp | 11 ----------- puppet/modules/site_sshd/templates/ssh_config.erb | 23 ++++++++++++++++++++++ .../site_sshd/templates/ssh_known_hosts.erb | 6 ++++-- 4 files changed, 39 insertions(+), 16 deletions(-) delete mode 100644 puppet/modules/site_sshd/manifests/known_hosts.pp create mode 100644 puppet/modules/site_sshd/templates/ssh_config.erb (limited to 'puppet') diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp index d2b13822..2bcde603 100644 --- a/puppet/modules/site_sshd/manifests/init.pp +++ b/puppet/modules/site_sshd/manifests/init.pp @@ -13,11 +13,20 @@ class site_sshd { } ## - ## SETUP KNOWN HOSTS + ## SETUP KNOWN HOSTS and SSH_CONFIG ## - class { 'site_sshd::known_hosts': - hosts => $hosts + file { + '/etc/ssh/ssh_known_hosts': + owner => root, + group => root, + mode => '0644', + content => template('site_sshd/ssh_known_hosts.erb'); + '/etc/ssh/ssh_config': + owner => root, + group => root, + mode => '0644', + content => template('site_sshd/ssh_config.erb'); } ## diff --git a/puppet/modules/site_sshd/manifests/known_hosts.pp b/puppet/modules/site_sshd/manifests/known_hosts.pp deleted file mode 100644 index 290ffd0b..00000000 --- a/puppet/modules/site_sshd/manifests/known_hosts.pp +++ /dev/null @@ -1,11 +0,0 @@ -class site_sshd::known_hosts ($hosts) { - # these owner and permissions seem odd to me, but it is what is defined - # in modules/sshd/manifests/client/base.pp, so we are going to stick with it. - file { '/etc/ssh/ssh_known_hosts': - ensure => present, - owner => root, - group => 0, - mode => '0644', - content => template('site_sshd/ssh_known_hosts.erb'); - } -} diff --git a/puppet/modules/site_sshd/templates/ssh_config.erb b/puppet/modules/site_sshd/templates/ssh_config.erb new file mode 100644 index 00000000..7e967413 --- /dev/null +++ b/puppet/modules/site_sshd/templates/ssh_config.erb @@ -0,0 +1,23 @@ +# This file is generated by Puppet +# This is the ssh client system-wide configuration file. See +# ssh_config(5) for more information. This file provides defaults for +# users, and the values can be changed in per-user configuration files +# or on the command line. + +Host * + SendEnv LANG LC_* + HashKnownHosts yes + GSSAPIAuthentication yes + GSSAPIDelegateCredentials no +<% if scope.lookupvar('::site_config::params::environment') == 'local' -%> + # + # Vagrant nodes should have strict host key checking + # turned off. The problem is that the host key for a vagrant + # node is specific to the particular instance of the vagrant + # node you have running locally. For this reason, we can't + # track the host keys, or your host key for vpn1 would conflict + # with my host key for vpn1. + # + StrictHostKeyChecking no +<% end -%> + diff --git a/puppet/modules/site_sshd/templates/ssh_known_hosts.erb b/puppet/modules/site_sshd/templates/ssh_known_hosts.erb index c5a71378..002ab732 100644 --- a/puppet/modules/site_sshd/templates/ssh_known_hosts.erb +++ b/puppet/modules/site_sshd/templates/ssh_known_hosts.erb @@ -1,5 +1,7 @@ # This file is generated by Puppet -<% hosts.sort.each do |name, hash| -%> -<%=name%>,<%=hash['domain_full']%>,<%=hash['domain_internal']%>,<%=hash['ip_address']%> <%=hash['host_pub_key']%> +<% @hosts.sort.each do |name, hash| -%> +<% if hash['host_pub_key'] -%> +<%= name%>,<%=hash['domain_full']%>,<%=hash['domain_internal']%>,<%=hash['ip_address']%> <%=hash['host_pub_key']%> +<% end -%> <% end -%> -- cgit v1.2.3