diff options
| author | Matt Taggart <taggart@riseup.net> | 2014-05-01 14:07:53 -0700 |
|---|---|---|
| committer | Matt Taggart <taggart@riseup.net> | 2015-04-16 21:08:48 +0000 |
| commit | ec8169eadc16fde4a8019b67f4966d2b119cb765 (patch) | |
| tree | efd518f7da5aa2e4a5563ac535571184257965f5 /manifests | |
| parent | 6547ba79591886544af4eaab88b65215d579d857 (diff) | |
create an sshuser parameter, so we can determine when we need to use sudo in the agent authorized_keys command
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/agent.pp | 3 | ||||
| -rw-r--r-- | manifests/agent/config.pp | 11 | ||||
| -rw-r--r-- | manifests/agent/generate_sshkey.pp | 13 |
3 files changed, 21 insertions, 6 deletions
diff --git a/manifests/agent.pp b/manifests/agent.pp index 505db64..9a365a3 100644 --- a/manifests/agent.pp +++ b/manifests/agent.pp @@ -15,6 +15,7 @@ class check_mk::agent ( $agent_logwatch_package_name = 'check_mk-agent-logwatch', $method = 'xinetd', $generate_sshkey = false, + $sshuser = undef, $use_ssh_tag = 'ssh', $register_agent = true ) { @@ -56,6 +57,7 @@ class check_mk::agent ( user => $user, method => $method, generate_sshkey => $generate_sshkey, + sshuser => $sshuser, require => Class['check_mk::agent::install'], } } else { @@ -70,6 +72,7 @@ class check_mk::agent ( user => $user, method => $method, generate_sshkey => $generate_sshkey, + sshuser => $sshuser, require => Class['check_mk::agent::install'], } } diff --git a/manifests/agent/config.pp b/manifests/agent/config.pp index 58e3b1e..b00329b 100644 --- a/manifests/agent/config.pp +++ b/manifests/agent/config.pp @@ -9,6 +9,7 @@ class check_mk::agent::config ( $user, $method = 'xinetd', $generate_sshkey = false, + $sshuser = undef ) { if $use_cache { $server = "${server_dir}/check_mk_caching_agent" @@ -39,15 +40,17 @@ class check_mk::agent::config ( if $authfile { # if authfile is overridden, pass it through check_mk::agent::generate_sshkey { 'check_mk_key': - keydir => $keydir, - authdir => $authdir, - authfile => $authfile + keydir => $keydir, + authdir => $authdir, + authfile => $authfile, + sshuser => $sshuser } } else { # otherwise don't check_mk::agent::generate_sshkey { 'check_mk_key': keydir => $keydir, - authdir => $authdir + authdir => $authdir, + sshuser => $sshuser } } } diff --git a/manifests/agent/generate_sshkey.pp b/manifests/agent/generate_sshkey.pp index 6f88f35..f01d2cf 100644 --- a/manifests/agent/generate_sshkey.pp +++ b/manifests/agent/generate_sshkey.pp @@ -10,6 +10,7 @@ define check_mk::agent::generate_sshkey ( #$ssh_key_basepath = "${common::moduledir::module_dir_path}/check_mk/keys", # for now use a dir we know works $ssh_key_basepath = '/etc/puppet/modules/check_mk/keys', + $sshuser = 'root', $check_mk_tag = 'check_mk_sshkey' ){ @@ -21,7 +22,15 @@ define check_mk::agent::generate_sshkey ( $public_key = $public[1] $secret_key = $ssh_keys[0] + # if we're not root we need to use sudo + if $sshuser != 'root' { + $command = 'sudo /usr/bin/check_mk_agent' + } else { + $command = '/usr/bin/check_mk_agent' + } + # setup the public half of the key in authorized_keys on the agent + # and restrict it to running only the agent if $authdir or $authfile { # if $authkey or $authdir are set, override authorized_keys path and file sshd::ssh_authorized_key { $ssh_key_name: @@ -29,7 +38,7 @@ define check_mk::agent::generate_sshkey ( key => $public_key, user => 'root', target => "${authdir}/${authfile}", - options => 'command="/usr/bin/check_mk_agent"'; + options => "command=\"${command}\""; } } else { # otherwise use the defaults @@ -37,7 +46,7 @@ define check_mk::agent::generate_sshkey ( type => 'ssh-rsa', key => $public_key, user => 'root', - options => 'command="/usr/bin/check_mk_agent"'; + options => "command=\"${command}\""; } } |