From 456e42b035e53e72e1aebd4689fa1a230fb49226 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Mon, 4 Oct 2010 22:03:49 +0200 Subject: Simplify by using the config_file definition. --- manifests/client/base.pp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'manifests') diff --git a/manifests/client/base.pp b/manifests/client/base.pp index 33d9f9e..64d4f6f 100644 --- a/manifests/client/base.pp +++ b/manifests/client/base.pp @@ -1,7 +1,6 @@ class sshd::client::base { # this is needed because the gid might have changed - file { '/etc/ssh/ssh_known_hosts': - owner => root, group => 0, mode => 0644; + config_file { '/etc/ssh/ssh_known_hosts': } # Now collect all server keys -- cgit v1.2.3 From 060703f6a2c40e3fc6d16c1df16be6c307c60340 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 13 Oct 2010 23:48:39 +0200 Subject: sshd service has status and restart commands in post-etch Debian releases. --- manifests/debian.pp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'manifests') diff --git a/manifests/debian.pp b/manifests/debian.pp index 0cc4ede..43dc26c 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -9,8 +9,7 @@ class sshd::debian inherits sshd::linux { $sshd_restartandstatus = $lsbdistcodename ? { etch => false, - lenny => true, - default => false + default => true } Service[sshd]{ -- cgit v1.2.3 From a643172a794c9a1ff7602e9b4d3b220867684f54 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Sat, 16 Oct 2010 16:05:00 +0200 Subject: New option sshd_ports that obsoletes sshd_port. Backward compatibility is preserved. --- manifests/init.pp | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 4f82542..abb1490 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -118,8 +118,11 @@ # Valid Values: yes or no # Default: no # -# sshd_port: If you want to specify a different port than the default 22 -# Default: 22 +# sshd_port: Deprecated, use sshd_ports instead. +# +# sshd_ports: If you want to specify a list of ports other than the default 22 +# Default: [22] +# # # sshd_authorized_keys_file: Set this to the location of the AuthorizedKeysFile (e.g. /etc/ssh/authorized_keys/%u) # Default: AuthorizedKeysFile %h/.ssh/authorized_keys @@ -193,8 +196,14 @@ class sshd { case $sshd_permit_empty_passwords { '': { $sshd_permit_empty_passwords = 'no' } } - case $sshd_port { - '': { $sshd_port = 22 } + if ( $sshd_port != '' ) && ( $sshd_ports != []) { + err("Cannot use sshd_port and sshd_ports at the same time.") + } + if $sshd_port != '' { + $sshd_ports = [ $sshd_port ] + } + elsif $sshd_port == [] { + $sshd_ports = [ 22 ] } case $sshd_authorized_keys_file { '': { $sshd_authorized_keys_file = "%h/.ssh/authorized_keys" } @@ -224,9 +233,12 @@ class sshd { } if $use_nagios { + define sshd::nagios { + nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } + } case $nagios_check_ssh { false: { info("We don't do nagioschecks for ssh on ${fqdn}" ) } - default: { nagios::service{ "ssh_port_${sshd_port}": check_command => "check_ssh_port!$sshd_port" } } + default: { sshd::nagios($sshd_ports:) } } } -- cgit v1.2.3 From ef093cafffb764fbedb26f7b8ce84c75329b1b7b Mon Sep 17 00:00:00 2001 From: intrigeri Date: Sat, 16 Oct 2010 21:54:24 +0200 Subject: bugfix --- manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index abb1490..33c40e9 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -196,7 +196,7 @@ class sshd { case $sshd_permit_empty_passwords { '': { $sshd_permit_empty_passwords = 'no' } } - if ( $sshd_port != '' ) && ( $sshd_ports != []) { + if ( $sshd_port != '' ) and ( $sshd_ports != []) { err("Cannot use sshd_port and sshd_ports at the same time.") } if $sshd_port != '' { -- cgit v1.2.3 From 5fb8eb969bc4edb2524ff868a2b7a9bf5259c247 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Sat, 16 Oct 2010 21:55:44 +0200 Subject: bugfix --- manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 33c40e9..64d1be4 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -238,7 +238,7 @@ class sshd { } case $nagios_check_ssh { false: { info("We don't do nagioschecks for ssh on ${fqdn}" ) } - default: { sshd::nagios($sshd_ports:) } + default: { sshd::nagios{$sshd_ports:} } } } -- cgit v1.2.3 From ceb1280177cf28edbe5a60cd4169a43870cd192f Mon Sep 17 00:00:00 2001 From: intrigeri Date: Mon, 18 Oct 2010 19:13:59 +0200 Subject: Bugfix --- manifests/init.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 64d1be4..13cb359 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -202,7 +202,7 @@ class sshd { if $sshd_port != '' { $sshd_ports = [ $sshd_port ] } - elsif $sshd_port == [] { + elsif ! $sshd_ports { $sshd_ports = [ 22 ] } case $sshd_authorized_keys_file { -- cgit v1.2.3 From 988a88f4e62065b45c8e32f6f915e052ff394003 Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 20 Oct 2010 20:56:15 +0200 Subject: move define to own class --- manifests/init.pp | 3 --- manifests/nagios.pp | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) create mode 100644 manifests/nagios.pp (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 13cb359..449f09f 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -233,9 +233,6 @@ class sshd { } if $use_nagios { - define sshd::nagios { - nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } - } case $nagios_check_ssh { false: { info("We don't do nagioschecks for ssh on ${fqdn}" ) } default: { sshd::nagios{$sshd_ports:} } diff --git a/manifests/nagios.pp b/manifests/nagios.pp new file mode 100644 index 0000000..5a5a5ed --- /dev/null +++ b/manifests/nagios.pp @@ -0,0 +1,3 @@ +define sshd::nagios { + nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } +} -- cgit v1.2.3 From d0d3d20e1411511cccdf6fa3ae63164f2868221d Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 20 Oct 2010 21:17:16 +0200 Subject: add nagios_check_ssh_hostname to tweak the hostname which whould be monitored, as this one might actually differ --- manifests/init.pp | 13 ++++++++++--- manifests/nagios.pp | 9 +++++++-- 2 files changed, 17 insertions(+), 5 deletions(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 449f09f..54f822a 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -201,8 +201,7 @@ class sshd { } if $sshd_port != '' { $sshd_ports = [ $sshd_port ] - } - elsif ! $sshd_ports { + } elsif ! $sshd_ports { $sshd_ports = [ 22 ] } case $sshd_authorized_keys_file { @@ -235,7 +234,15 @@ class sshd { if $use_nagios { case $nagios_check_ssh { false: { info("We don't do nagioschecks for ssh on ${fqdn}" ) } - default: { sshd::nagios{$sshd_ports:} } + default: { + sshd::nagios{$sshd_ports: + check_hostname => $nagios_check_ssh_hostname ? { + '' => 'absent', + undef => 'absent', + default => $nagios_check_ssh_hostname + } + } + } } } diff --git a/manifests/nagios.pp b/manifests/nagios.pp index 5a5a5ed..890810e 100644 --- a/manifests/nagios.pp +++ b/manifests/nagios.pp @@ -1,3 +1,8 @@ -define sshd::nagios { - nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } +define sshd::nagios( + $check_hostname = 'absent' +) { + case $check_hostname { + 'absent': { nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } } + default: { nagios::service{"ssh_port_host_${name}_${check_hostname}": check_command => "check_ssh_port_host!${name}!${check_hostname}" } } + } } -- cgit v1.2.3 From eec9e7242525cd9909c0c54cdb7515047bac4407 Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 20 Oct 2010 22:57:15 +0200 Subject: extend sshd::nagios with ensure param --- manifests/nagios.pp | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'manifests') diff --git a/manifests/nagios.pp b/manifests/nagios.pp index 890810e..1500a09 100644 --- a/manifests/nagios.pp +++ b/manifests/nagios.pp @@ -1,8 +1,19 @@ define sshd::nagios( + $ensure = 'present', $check_hostname = 'absent' ) { case $check_hostname { - 'absent': { nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" } } - default: { nagios::service{"ssh_port_host_${name}_${check_hostname}": check_command => "check_ssh_port_host!${name}!${check_hostname}" } } + 'absent': { + nagios::service{"ssh_port_${name}": + ensure => $esnure, + check_command => "check_ssh_port!$name" + } + } + default: { + nagios::service{"ssh_port_host_${name}_${check_hostname}": + ensure => $esnure, + check_command => "check_ssh_port_host!${name}!${check_hostname}" + } + } } } -- cgit v1.2.3 From 28342ba418ede266526aaaad5c89834883b4b16e Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 20 Oct 2010 23:12:43 +0200 Subject: introduce that port also can't be the name, fix ensure problem --- manifests/nagios.pp | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'manifests') diff --git a/manifests/nagios.pp b/manifests/nagios.pp index 1500a09..4971f65 100644 --- a/manifests/nagios.pp +++ b/manifests/nagios.pp @@ -1,18 +1,23 @@ define sshd::nagios( + $port = 'absent', $ensure = 'present', $check_hostname = 'absent' ) { + $real_port = $port ? { + 'absent' => $name, + default => $port, + } case $check_hostname { 'absent': { nagios::service{"ssh_port_${name}": - ensure => $esnure, - check_command => "check_ssh_port!$name" + ensure => $ensure, + check_command => "check_ssh_port!$port" } } default: { - nagios::service{"ssh_port_host_${name}_${check_hostname}": - ensure => $esnure, - check_command => "check_ssh_port_host!${name}!${check_hostname}" + nagios::service{"ssh_port_host_${name}": + ensure => $ensure, + check_command => "check_ssh_port_host!${port}!${check_hostname}" } } } -- cgit v1.2.3 From 8f918b0e7358013e4b2d16759a73b401ab386358 Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 20 Oct 2010 23:46:14 +0200 Subject: use parametrized class to pass ssh_ports to open up things --- manifests/init.pp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 54f822a..06290a8 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -247,6 +247,8 @@ class sshd { } if $use_shorewall{ - include shorewall::rules::ssh + class{'shorewall::rules::ssh': + ports => $sshd_ports, + } } } -- cgit v1.2.3 From 3200c182e1e272d49b1b3347c544a94e655e1142 Mon Sep 17 00:00:00 2001 From: mh Date: Thu, 21 Oct 2010 02:49:11 +0200 Subject: use realport --- manifests/nagios.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'manifests') diff --git a/manifests/nagios.pp b/manifests/nagios.pp index 4971f65..7742cdb 100644 --- a/manifests/nagios.pp +++ b/manifests/nagios.pp @@ -11,13 +11,13 @@ define sshd::nagios( 'absent': { nagios::service{"ssh_port_${name}": ensure => $ensure, - check_command => "check_ssh_port!$port" + check_command => "check_ssh_port!$real_port" } } default: { nagios::service{"ssh_port_host_${name}": ensure => $ensure, - check_command => "check_ssh_port_host!${port}!${check_hostname}" + check_command => "check_ssh_port_host!${real_port}!${check_hostname}" } } } -- cgit v1.2.3 From 86f31fcff9dd7ea91707f1760ef3f2000e3dd802 Mon Sep 17 00:00:00 2001 From: Micah Anderson Date: Sat, 19 Feb 2011 14:12:04 -0500 Subject: Pull together a more comprehensive README, moving the configurable variables from init.pp into the README, and detailing the other features, and requirements, of the module --- manifests/init.pp | 169 ------------------------------------------------------ 1 file changed, 169 deletions(-) (limited to 'manifests') diff --git a/manifests/init.pp b/manifests/init.pp index 76ee107..991fbba 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,172 +1,3 @@ -# -# ssh module -# -# Copyright 2008-2009, micah@riseup.net -# Copyright 2008, admin(at)immerda.ch -# Copyright 2008, Puzzle ITC GmbH -# Marcel Härry haerry+puppet(at)puzzle.ch -# Simon Josi josi+puppet(at)puzzle.ch -# -# This program is free software; you can redistribute -# it and/or modify it under the terms of the GNU -# General Public License version 3 as published by -# the Free Software Foundation. -# -# Deploy authorized_keys file with the define -# sshd::ssh_authorized_key -# -# sshd-config: -# -# The configuration of the sshd is rather strict and might not fit all -# needs. However there are a bunch of variables, which you might -# consider configuring. -# -# To set any of the following, simply set them as variables in your manifests -# before the class is included, for example: -# -# $sshd_listen_address = ['10.0.0.1 192.168.0.1'] -# $sshd_use_pam = yes -# include sshd -# -# If you need to install a version of the ssh daemon or client package other than -# the default one that would be installed by 'ensure => installed', then you can -# set the following variables: -# -# $sshd_ensure_version = "1:5.2p2-6" -# $ssh_ensure_version = "1:5.2p2-6" -# -# To have nagios checks setup automatically for sshd services, simply -# set $use_nagios = true before the class is included. If you want to -# disable ssh nagios checking for a particular node (such as when ssh -# is firewalled), then you can set $nagios_check_ssh to false and that -# node will not be monitored. -# NOTE: this requires that you are using the nagios puppet module -# which supports the nagios native types via nagios::service -# -# The following is a list of the currently available variables: -# -# sshd_listen_address: specify the addresses sshd should listen on -# set this to ['10.0.0.1 192.168.0.1'] to have it listen on both -# addresses, or leave it unset to listen on all -# Default: empty -> results in listening on 0.0.0.0 -# -# sshd_allowed_users: list of usernames separated by spaces. -# set this for example to "foobar root" -# to ensure that only user foobar and root -# might login. -# Default: empty -> no restriction is set -# -# sshd_allowed_groups list of groups separated by spaces. -# set this for example to "wheel sftponly" -# to ensure that only users in the groups -# wheel and sftponly might login. -# Default: empty -> no restriction is set -# Note: This is set after sshd_allowed_users, -# take care of the behaviour if you use -# these 2 options together. -# -# sshd_use_pam: if you want to use pam or not for authenticaton -# Values: no or yes. -# Default: no -# -# sshd_permit_root_login: If you want to allow root logins or not. -# Valid values: yes, no, without-password, forced-commands-only -# Default: without-password -# -# sshd_password_authentication: If you want to enable password authentication or not -# Valid values: yes or no -# Default: no -# -# sshd_kerberos_authentication: If you want the password that is provided by the user to be -# validated through the Kerberos KDC. To use this option the -# server needs a Kerberos servtab which allows the verification of -# the KDC's identity. -# Valid values: yes or no -# Default: no -# -# sshd_kerberos_orlocalpasswd: If password authentication through Kerberos fails, then the password -# will be validated via any additional local mechanism. -# Valid values: yes or no -# Default: yes -# -# sshd_kerberos_ticketcleanup: Destroy the user's ticket cache file on logout? -# Valid values: yes or no -# Default: yes -# -# sshd_gssapi_authentication: Authenticate users based on GSSAPI? -# Valid values: yes or no -# Default: no -# -# sshd_gssapi_cleanupcredentials: Destroy user's credential cache on logout? -# Valid values: yes or no -# Default: yes -# -# sshd_challenge_response_authentication: If you want to enable ChallengeResponseAuthentication or not -# When disabled, s/key passowords are disabled -# Valid values: yes or no -# Default: no -# -# sshd_tcp_forwarding: If you want to enable TcpForwarding -# Valid Values: yes or no -# Default: no -# -# sshd_x11_forwarding: If you want to enable x11 forwarding -# Valid Values: yes or no -# Default: no -# -# sshd_agent_forwarding: If you want to allow ssh-agent forwarding -# Valid Values: yes or no -# Default: no -# -# sshd_pubkey_authentication: If you want to enable public key authentication -# Valid Values: yes or no -# Default: yes -# -# sshd_rsa_authentication: If you want to enable RSA Authentication -# Valid Values: yes or no -# Default: no -# -# sshd_rhosts_rsa_authentication: If you want to enable rhosts RSA Authentication -# Valid Values: yes or no -# Default: no -# -# sshd_hostbased_authentication: If you want to enable HostbasedAuthentication -# Valid Values: yes or no -# Default: no -# -# sshd_strict_modes: If you want to set StrictModes (check file modes/ownership before accepting login) -# Valid Values: yes or no -# Default: yes -# -# sshd_permit_empty_passwords: If you want enable PermitEmptyPasswords to allow empty passwords -# Valid Values: yes or no -# Default: no -# -# sshd_port: Deprecated, use sshd_ports instead. -# -# sshd_ports: If you want to specify a list of ports other than the default 22 -# Default: [22] -# -# -# sshd_authorized_keys_file: Set this to the location of the AuthorizedKeysFile (e.g. /etc/ssh/authorized_keys/%u) -# Default: AuthorizedKeysFile %h/.ssh/authorized_keys -# -# sshd_sftp_subsystem: Set a different sftp-subystem than the default one. -# Might be interesting for sftponly usage -# Default: empty -> no change of the default -# -# sshd_head_additional_options: Set this to any additional sshd_options which aren't listed above. -# Anything set here will be added to the beginning of the sshd_config file. -# This option might be useful to define complicated Match Blocks -# This string is going to be included, like it is defined. So take care! -# Default: empty -> not added. -# -# sshd_tail_additional_options: Set this to any additional sshd_options which aren't listed above. -# Anything set here will be added to the end of the sshd_config file. -# This option might be useful to define complicated Match Blocks -# This string is going to be included, like it is defined. So take care! -# Default: empty -> not added. - class sshd { # prepare variables to use in templates case $sshd_listen_address { -- cgit v1.2.3