opuppet/module-sshd
5
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

migrate away from hiera stuff

Browse source
This commit is contained in:
mh 2012-06-13 21:52:44 -03:00
parent 8aab254eaa
commit d4db185c3f
3 changed files with 48 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README
View file

@ -24,7 +24,7 @@ Nagios
------ ------
To have nagios checks setup automatically for sshd services, simply set To have nagios checks setup automatically for sshd services, simply set
use_nagios to true in hiera. If you want to disable ssh manage_nagios to true for that class. If you want to disable ssh
nagios checking for a particular node (such as when ssh is firewalled), then you nagios checking for a particular node (such as when ssh is firewalled), then you
can set the class parameter nagios_check_ssh to false and that node will not bei can set the class parameter nagios_check_ssh to false and that node will not bei
monitored. monitored.

7
manifests/client.pp
View file

@ -1,8 +1,9 @@
# manifests/client.pp # manifests/client.pp
class sshd::client( class sshd::client(
$shared_ip = hiera('sshd_shared_ip','no'), $shared_ip = 'no',
$ensure_version = hiera('sshd_ensure_version','installed') $ensure_version = 'installed',
$manage_shorewall = false
) { ) {
case $::operatingsystem { case $::operatingsystem {
@ -15,7 +16,7 @@ class sshd::client(
} }
} }
if hiera('use_shorewall',false) { if $manage_shorewall{
include shorewall::rules::out::ssh include shorewall::rules::out::ssh
} }
} }

82
manifests/init.pp
View file

@ -1,42 +1,45 @@
class sshd( class sshd(
$nagios_check_ssh = hiera('nagios_check_ssh',true), $manage_nagios = true,
$nagios_check_ssh_hostname = hiera('nagios_check_ssh_hostname','absent'), $nagios_check_ssh_hostname = 'absent',
$ports = hiera('sshd_ports',[ 22 ]), $ports = [ 22 ],
$shared_ip = hiera('sshd_shared_ip','no'), $shared_ip = 'no',
$ensure_version = hiera('sshd_ensure_version','installed'), $ensure_version = 'installed',
$listen_address = hiera('sshd_listen_address',[ '0.0.0.0', '::' ]), $listen_address = [ '0.0.0.0', '::' ],
$allowed_users = hiera('sshd_allowed_users',''), $allowed_users = '',
$allowed_groups = hiera('sshd_allowed_groups',''), $allowed_groups = '',
$use_pam = hiera('sshd_use_pam','no'), $use_pam = 'no',
$permit_root_login = hiera('sshd_permit_root_login','without-password'), $permit_root_login = 'without-password',
$password_authentication = hiera('sshd_password_authentication','no'), $password_authentication = 'no',
$kerberos_authentication = hiera('sshd_kerberos_authentication','no'), $kerberos_authentication = 'no',
$kerberos_orlocalpasswd = hiera('sshd_sshd_kerberos_orlocalpasswd','yes'), $kerberos_orlocalpasswd = 'yes',
$kerberos_ticketcleanup = hiera('sshd_kerberos_ticketcleanup','yes'), $kerberos_ticketcleanup = 'yes',
$gssapi_authentication = hiera('sshd_gssapi_authentication','no'), $gssapi_authentication = 'no',
$gssapi_cleanupcredentials = hiera('sshd_gssapi_cleanupcredentials','yes'), $gssapi_cleanupcredentials = 'yes',
$tcp_forwarding = hiera('sshd_tcp_forwarding','no'), $tcp_forwarding = 'no',
$x11_forwarding = hiera('sshd_x11_forwarding','no'), $x11_forwarding = 'no',
$agent_forwarding = hiera('sshd_agent_forwarding','no'), $agent_forwarding = 'no',
$challenge_response_authentication = hiera('sshd_challenge_response_authentication','no'), $challenge_response_authentication = 'no',
$pubkey_authentication = hiera('sshd_pubkey_authentication','yes'), $pubkey_authentication = 'yes',
$rsa_authentication = hiera('rsa_authentication','no'), $rsa_authentication = 'no',
$strict_modes = hiera('sshd_strict_modes','yes'), $strict_modes = 'yes',
$ignore_rhosts = hiera('sshd_ignore_rhosts','yes'), $ignore_rhosts = 'yes',
$rhosts_rsa_authentication = hiera('sshd_rhosts_rsa_authentication','no'), $rhosts_rsa_authentication = 'no',
$hostbased_authentication = hiera('sshd_hostbased_authentication','no'), $hostbased_authentication = 'no',
$permit_empty_passwords = hiera('sshd_permit_empty_passwords','no'), $permit_empty_passwords = 'no',
$authorized_keys_file = hiera('sshd_authorized_keys_file','%h/.ssh/authorized_keys'), $authorized_keys_file = '%h/.ssh/authorized_keys',
$hardened_ssl = hiera('sshd_hardened_ssl','no'), $hardened_ssl = 'no',
$sftp_subsystem = hiera('sshd_sftp_subsystem',''), $sftp_subsystem = '',
$head_additional_options = hiera('sshd_head_additional_options',''), $head_additional_options = '',
$tail_additional_options = hiera('sshd_tail_additional_options',''), $tail_additional_options = '',
$print_motd = hiera('sshd_print_motd','yes') $print_motd = 'yes',
$manage_shorewall = false,
$shorewall_source = 'net'
) { ) {
class{'sshd::client': class{'sshd::client':
shared_ip => $sshd::shared_ip, shared_ip => $sshd::shared_ip,
ensure_version => $sshd::ensure_version ensure_version => $sshd::ensure_version,
manage_shorewall => $manage_shorewall,
} }
case $::operatingsystem { case $::operatingsystem {
@ -47,15 +50,16 @@ class sshd(
default: { include sshd::base } default: { include sshd::base }
} }
if hiera('use_nagios',false) and $sshd::nagios_check_ssh { if $manage_nagios {
sshd::nagios{$sshd::ports: sshd::nagios{$ports:
check_hostname => $sshd::nagios_check_ssh_hostname check_hostname => $nagios_check_ssh_hostname
} }
} }
if hiera('use_shorewall', false) { if $manage_shorewall {
class{'shorewall::rules::ssh': class{'shorewall::rules::ssh':
ports => $sshd::ports, ports => $ports,
source => $shorewall_source
} }
} }
} }