91 line
2.5 KiB
Puppet
91 line
2.5 KiB
Puppet
# manage an sshd installation
|
|
class sshd(
|
|
$manage_nagios = false,
|
|
$nagios_check_ssh_hostname = 'absent',
|
|
$ports = [ 22 ],
|
|
$shared_ip = 'no',
|
|
$ensure_version = 'installed',
|
|
$listen_address = [ '0.0.0.0', '::' ],
|
|
$allowed_users = '',
|
|
$allowed_groups = '',
|
|
$use_pam = 'no',
|
|
$permit_root_login = 'without-password',
|
|
$password_authentication = 'no',
|
|
$kerberos_authentication = 'no',
|
|
$kerberos_orlocalpasswd = 'yes',
|
|
$kerberos_ticketcleanup = 'yes',
|
|
$gssapi_authentication = 'no',
|
|
$gssapi_cleanupcredentials = 'yes',
|
|
$tcp_forwarding = 'no',
|
|
$x11_forwarding = 'no',
|
|
$agent_forwarding = 'no',
|
|
$challenge_response_authentication = 'no',
|
|
$pubkey_authentication = 'yes',
|
|
$rsa_authentication = 'no',
|
|
$strict_modes = 'yes',
|
|
$ignore_rhosts = 'yes',
|
|
$rhosts_rsa_authentication = 'no',
|
|
$hostbased_authentication = 'no',
|
|
$permit_empty_passwords = 'no',
|
|
$authorized_keys_file = $::osfamily ? {
|
|
Debian => $::lsbmajdistrelease ? {
|
|
6 => '%h/.ssh/authorized_keys',
|
|
default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
|
|
},
|
|
RedHat => $::operatingsystemmajrelease ? {
|
|
5 => '%h/.ssh/authorized_keys',
|
|
6 => '%h/.ssh/authorized_keys',
|
|
default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
|
|
},
|
|
OpenBSD => '%h/.ssh/authorized_keys',
|
|
default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
|
|
},
|
|
$hardened = 'no',
|
|
$sftp_subsystem = '',
|
|
$head_additional_options = '',
|
|
$tail_additional_options = '',
|
|
$print_motd = 'yes',
|
|
$manage_shorewall = false,
|
|
$shorewall_source = 'net',
|
|
$sshkey_ipaddress = $::ipaddress,
|
|
$manage_client = true,
|
|
$hostkey_type = versioncmp($::ssh_version, '6.5') ? {
|
|
/(^1|0)/ => [ 'rsa', 'ed25519' ],
|
|
/-1/ => [ 'rsa', 'dsa' ]
|
|
}
|
|
) {
|
|
|
|
validate_bool($manage_shorewall)
|
|
validate_bool($manage_client)
|
|
validate_array($listen_address)
|
|
validate_array($ports)
|
|
|
|
if $manage_client {
|
|
class{'sshd::client':
|
|
shared_ip => $shared_ip,
|
|
ensure_version => $ensure_version,
|
|
manage_shorewall => $manage_shorewall,
|
|
}
|
|
}
|
|
|
|
case $::operatingsystem {
|
|
gentoo: { include sshd::gentoo }
|
|
redhat,centos: { include sshd::redhat }
|
|
openbsd: { include sshd::openbsd }
|
|
debian,ubuntu: { include sshd::debian }
|
|
default: { include sshd::base }
|
|
}
|
|
|
|
if $manage_nagios {
|
|
sshd::nagios{$ports:
|
|
check_hostname => $nagios_check_ssh_hostname
|
|
}
|
|
}
|
|
|
|
if $manage_shorewall {
|
|
class{'shorewall::rules::ssh':
|
|
ports => $ports,
|
|
source => $shorewall_source
|
|
}
|
|
}
|
|
}
|