diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/base.pp | 35 | ||||
| -rw-r--r-- | manifests/client.pp | 25 | ||||
| -rw-r--r-- | manifests/client/base.pp | 9 | ||||
| -rw-r--r-- | manifests/client/debian.pp | 5 | ||||
| -rw-r--r-- | manifests/client/linux.pp | 6 | ||||
| -rw-r--r-- | manifests/debian.pp | 25 | ||||
| -rw-r--r-- | manifests/gentoo.pp | 5 | ||||
| -rw-r--r-- | manifests/init.pp | 157 | ||||
| -rw-r--r-- | manifests/linux.pp | 8 | ||||
| -rw-r--r-- | manifests/openbsd.pp | 8 | ||||
| -rw-r--r-- | manifests/redhat.pp | 5 | ||||
| -rw-r--r-- | manifests/ssh_authorized_key.pp | 42 |
12 files changed, 161 insertions, 169 deletions
diff --git a/manifests/base.pp b/manifests/base.pp new file mode 100644 index 0000000..2ac2385 --- /dev/null +++ b/manifests/base.pp @@ -0,0 +1,35 @@ +class sshd::base { + file { 'sshd_config': + path => '/etc/ssh/sshd_config', + content => $lsbdistcodename ? { + '' => template("sshd/sshd_config/${operatingsystem}.erb"), + default => template ("sshd/sshd_config/${operatingsystem}_${lsbdistcodename}.erb"), + }, + notify => Service[sshd], + owner => root, group => 0, mode => 600; + } + + # Now add the key, if we've got one + case $sshrsakey_key { + '': { info("no sshrsakey on $fqdn") } + default: { + @@sshkey{"$hostname.$domain": + type => ssh-rsa, + key => $sshrsakey_key, + ensure => present, + } + @@sshkey{"$ipaddress": + type => ssh-rsa, + key => $sshrsakey, + ensure => present, + } + } + } + service{'sshd': + name => 'sshd', + enable => true, + ensure => running, + hasstatus => true, + require => File[sshd_config], + } +} diff --git a/manifests/client.pp b/manifests/client.pp index d473e3c..2fc3a84 100644 --- a/manifests/client.pp +++ b/manifests/client.pp @@ -10,28 +10,7 @@ class sshd::client { } } } -} - -class sshd::client::base { - - # this is needed because the gid might have changed - file { '/etc/ssh/ssh_known_hosts': - mode => 0644, owner => root, group => 0; - } - - # Now collect all server keys - Sshkey <<||>> -} - -class sshd::client::linux inherits sshd::client::base { - if $ssh_ensure_version == '' { $ssh_ensure_version = 'installed' } - package {'openssh-clients': - ensure => $ssh_ensure_version, - } -} - -class sshd::client::debian inherits sshd::client::linux { - Package['openssh-clients']{ - name => 'openssh-client', + if $use_shorewall{ + include shorewall::rules::out::ssh } } diff --git a/manifests/client/base.pp b/manifests/client/base.pp new file mode 100644 index 0000000..33d9f9e --- /dev/null +++ b/manifests/client/base.pp @@ -0,0 +1,9 @@ +class sshd::client::base { + # this is needed because the gid might have changed + file { '/etc/ssh/ssh_known_hosts': + owner => root, group => 0, mode => 0644; + } + + # Now collect all server keys + Sshkey <<||>> +} diff --git a/manifests/client/debian.pp b/manifests/client/debian.pp new file mode 100644 index 0000000..2aaf3fb --- /dev/null +++ b/manifests/client/debian.pp @@ -0,0 +1,5 @@ +class sshd::client::debian inherits sshd::client::linux { + Package['openssh-clients']{ + name => 'openssh-client', + } +} diff --git a/manifests/client/linux.pp b/manifests/client/linux.pp new file mode 100644 index 0000000..8c58ca8 --- /dev/null +++ b/manifests/client/linux.pp @@ -0,0 +1,6 @@ +class sshd::client::linux inherits sshd::client::base { + if $ssh_ensure_version == '' { $ssh_ensure_version = 'installed' } + package {'openssh-clients': + ensure => $ssh_ensure_version, + } +} diff --git a/manifests/debian.pp b/manifests/debian.pp new file mode 100644 index 0000000..849d9f4 --- /dev/null +++ b/manifests/debian.pp @@ -0,0 +1,25 @@ +class sshd::debian inherits sshd::linux { + + # the templates for Debian need lsbdistcodename + include lsb + File['sshd_config']{ + require +> Package['lsb'] + } + + Package[openssh]{ + name => 'openssh-server', + } + + $sshd_restartandstatus = $lsbdistcodename ? { + etch => false, + lenny => true, + default => false + } + + Service[sshd]{ + name => 'ssh', + pattern => 'sshd', + hasstatus => $sshd_restartandstatus, + hasrestart => $sshd_restartandstatus, + } +} diff --git a/manifests/gentoo.pp b/manifests/gentoo.pp new file mode 100644 index 0000000..631f3d1 --- /dev/null +++ b/manifests/gentoo.pp @@ -0,0 +1,5 @@ +class sshd::gentoo inherits sshd::linux { + Package[openssh]{ + category => 'net-misc', + } +} diff --git a/manifests/init.pp b/manifests/init.pp index 386bd77..83b26c1 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -133,22 +133,7 @@ # Default: empty -> not added. class sshd { - include sshd::client - - case $operatingsystem { - gentoo: { include sshd::gentoo } - redhat: { include sshd::redhat } - centos: { include sshd::centos } - openbsd: { include sshd::openbsd } - debian: { include sshd::debian } - ubuntu: { include sshd::ubuntu } - default: { include sshd::default } - } -} - - -class sshd::base { - # prepare variables to use in templates + # prepare variables to use in templates case $sshd_listen_address { '': { $sshd_listen_address = [ '0.0.0.0', '::' ] } } @@ -219,41 +204,17 @@ class sshd::base { '': { $sshd_ensure_version = "present" } } - file { 'sshd_config': - path => '/etc/ssh/sshd_config', - owner => root, - group => 0, - mode => 600, - content => $lsbdistcodename ? { - '' => template("sshd/sshd_config/${operatingsystem}.erb"), - default => template ("sshd/sshd_config/${operatingsystem}_${lsbdistcodename}.erb"), - }, - notify => Service[sshd], - } - # Now add the key, if we've got one - case $sshrsakey { - '': { warning("no sshrsakey on $fqdn") } - default: { - @@sshkey{"$hostname.$domain": - type => ssh-rsa, - key => $sshrsakey, - ensure => present, - } - @@sshkey{"$ipaddress": - type => ssh-rsa, - key => $sshrsakey, - ensure => present, - } - } - } - service{'sshd': - name => 'sshd', - enable => true, - ensure => running, - hasstatus => true, - require => File[sshd_config], + include sshd::client + + case $operatingsystem { + gentoo: { include sshd::gentoo } + redhat,centos: { include sshd::redhat } + centos: { include sshd::centos } + openbsd: { include sshd::openbsd } + debian,ubuntu: { include sshd::debian } + default: { include sshd::default } } - + if $use_nagios { case $nagios_check_ssh { 'false': { info("We don't do nagioschecks for ssh on ${fqdn}" ) } @@ -261,99 +222,3 @@ class sshd::base { } } } - -class sshd::linux inherits sshd::base { - if $sshd_ensure_version == '' { $sshd_ensure_version = 'installed' } - package {'openssh': - ensure => $sshd_ensure_version, - } - File[sshd_config]{ - require +> Package[openssh], - } -} - -class sshd::gentoo inherits sshd::linux { - Package[openssh]{ - category => 'net-misc', - } -} - -class sshd::debian inherits sshd::linux { - - # the templates for Debian need lsbdistcodename - include assert_lsbdistcodename - - Package[openssh]{ - name => 'openssh-server', - } - - $sshd_restartandstatus = $lsbdistcodename ? { - etch => false, - lenny => true, - default => false - } - - Service[sshd]{ - name => 'ssh', - pattern => 'sshd', - hasstatus => $sshd_restartandstatus, - hasrestart => $sshd_restartandstatus, - } -} -class sshd::ubuntu inherits sshd::debian {} - -class sshd::redhat inherits sshd::linux { - Package[openssh]{ - name => 'openssh-server', - } -} -class sshd::centos inherits sshd::redhat {} - -class sshd::openbsd inherits sshd::base { - Service[sshd]{ - restart => '/bin/kill -HUP `/bin/cat /var/run/sshd.pid`', - stop => '/bin/kill `/bin/cat /var/run/sshd.pid`', - start => '/usr/sbin/sshd', - hasstatus => false, - } -} - -### defines -# wrapper to have some defaults. -define sshd::ssh_authorized_key( - $type = 'ssh-dss', - $key, - $user = '', - $target = undef, - $options = 'absent' - ) -{ - $real_user = $user ? { - false => $name, - "" => $name, - default => $user, - } - case $target { - undef: { - $real_target = "/home/$real_user/.ssh/authorized_keys" - } - default: { - $real_target = $target - } - } - ssh_authorized_key{$name: - type => $type, - key => $key, - user => $real_user, - target => $real_target, - } - - case $options { - 'absent': { info("not setting any option for ssh_authorized_key: $name") } - default: { - Ssh_authorized_key[$name]{ - options => $options, - } - } - } -} diff --git a/manifests/linux.pp b/manifests/linux.pp new file mode 100644 index 0000000..a1f4e2a --- /dev/null +++ b/manifests/linux.pp @@ -0,0 +1,8 @@ +class sshd::linux inherits sshd::base { + package{openssh: + ensure => $sshd_ensure_version, + } + File[sshd_config]{ + require +> Package[openssh], + } +} diff --git a/manifests/openbsd.pp b/manifests/openbsd.pp new file mode 100644 index 0000000..f1379d7 --- /dev/null +++ b/manifests/openbsd.pp @@ -0,0 +1,8 @@ +class sshd::openbsd inherits sshd::base { + Service[sshd]{ + restart => '/bin/kill -HUP `/bin/cat /var/run/sshd.pid`', + stop => '/bin/kill `/bin/cat /var/run/sshd.pid`', + start => '/usr/sbin/sshd', + hasstatus => false, + } +} diff --git a/manifests/redhat.pp b/manifests/redhat.pp new file mode 100644 index 0000000..e9bf1d1 --- /dev/null +++ b/manifests/redhat.pp @@ -0,0 +1,5 @@ +class sshd::redhat inherits sshd::linux { + Package[openssh]{ + name => 'openssh-server', + } +} diff --git a/manifests/ssh_authorized_key.pp b/manifests/ssh_authorized_key.pp new file mode 100644 index 0000000..9374e15 --- /dev/null +++ b/manifests/ssh_authorized_key.pp @@ -0,0 +1,42 @@ +# wrapper to have some defaults. +define sshd::ssh_authorized_key( + $type = 'ssh-dss', + $key, + $user = 'root', + $target = undef, + $options = 'absent' +){ + + $real_user = $user ? { + false => $name, + "" => $name, + default => $user, + } + + case $target { + undef: { + case $user { + 'root': { $real_target = '/root/.ssh/authorized_keys' } + default: { $real_target = "/home/${user}/.ssh/authorized_keys" } + } + } + default: { + $real_target = $target + } + } + ssh_authorized_key{$name: + type => $type, + key => $key, + user => $real_user, + target => $real_target, + } + + case $options { + 'absent': { info("not setting any option for ssh_authorized_key: $name") } + default: { + Ssh_authorized_key[$name]{ + options => $options, + } + } + } +} |