Skip to content

Commit 3715cd6

Browse files
myiimyii
authored
Merge pull request #151 from alxwr/issue-98
CentOS does not support ed25519; fixes #98
2 parents 3f9876f + 29b89f0 commit 3715cd6

File tree

6 files changed

+124
-144
lines changed

6 files changed

+124
-144
lines changed

‎openssh/config.sls‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ ssh_config:
3636
{%- endif %}
3737
{% endif %}
3838
39-
{%- for keyType in ['ecdsa', 'dsa', 'rsa', 'ed25519'] %}
39+
{%- for keyType in openssh['host_key_algos'].split(',') %}
4040
{%- set keyFile = "/etc/ssh/ssh_host_" ~ keyType ~ "_key" %}
4141
{%- set keySize = salt['pillar.get']('openssh:generate_' ~ keyType ~ '_size', False) %}
4242
{%- if salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %}

‎openssh/defaults.yaml‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,29 @@
1-
openssh:
2-
sshd_enable: True
3-
sshd_binary: /usr/sbin/sshd
4-
sshd_config: /etc/ssh/sshd_config
5-
sshd_config_src: salt://openssh/files/sshd_config
6-
sshd_config_user: root
7-
sshd_config_group: root
8-
sshd_config_mode: '644'
9-
sshd_config_backup: True
10-
ssh_config: /etc/ssh/ssh_config
11-
ssh_config_src: salt://openssh/files/ssh_config
12-
ssh_config_user: root
13-
ssh_config_group: root
14-
ssh_config_mode: '644'
15-
ssh_config_backup: True
16-
banner: /etc/ssh/banner
17-
banner_src: salt://openssh/files/banner
18-
ssh_known_hosts: /etc/ssh/ssh_known_hosts
19-
dig_pkg: dnsutils
20-
ssh_moduli: /etc/ssh/moduli
21-
root_group: root
1+
default:
2+
openssh:
3+
sshd_enable: True
4+
sshd_binary: /usr/sbin/sshd
5+
sshd_config: /etc/ssh/sshd_config
6+
sshd_config_src: salt://openssh/files/sshd_config
7+
sshd_config_user: root
8+
sshd_config_group: root
9+
sshd_config_mode: '644'
10+
sshd_config_backup: True
11+
ssh_config: /etc/ssh/ssh_config
12+
ssh_config_src: salt://openssh/files/ssh_config
13+
ssh_config_user: root
14+
ssh_config_group: root
15+
ssh_config_mode: '644'
16+
ssh_config_backup: True
17+
banner: /etc/ssh/banner
18+
banner_src: salt://openssh/files/banner
19+
ssh_known_hosts: /etc/ssh/ssh_known_hosts
20+
dig_pkg: dnsutils
21+
ssh_moduli: /etc/ssh/moduli
22+
root_group: root
23+
# Prevent merge of array; always override values
24+
host_key_algos: ecdsa,ed25519,rsa
25+
# To manage/remove DSA:
26+
#host_key_algos: dsa,ecdsa,ed25519,rsa
2227

23-
sshd_config: {}
24-
ssh_config: {}
28+
sshd_config: {}
29+
ssh_config: {}

‎openssh/map.jinja‎

Lines changed: 22 additions & 120 deletions
Original file line numberDiff line numberDiff line change
@@ -1,120 +1,22 @@
1-
{## Start with defaults from defaults.yaml ##}
2-
{% import_yaml "openssh/defaults.yaml" as default_settings %}
3-
4-
{##
5-
Setup variable using grains['os_family'] based logic, only add key:values here
6-
that differ from whats in defaults.yaml
7-
##}
8-
{% set os_family_map = salt['grains.filter_by']({
9-
'Arch': {
10-
'server': 'openssh',
11-
'client': 'openssh',
12-
'service': 'sshd',
13-
'dig_pkg': 'bind-tools',
14-
},
15-
'Debian': {
16-
'server': 'openssh-server',
17-
'client': 'openssh-client',
18-
'service': 'ssh',
19-
},
20-
'FreeBSD': {
21-
'service': 'sshd',
22-
'dig_pkg': 'bind-tools',
23-
'sshd_config_group': 'wheel',
24-
'ssh_config_group': 'wheel',
25-
},
26-
'OpenBSD': {
27-
'service': 'sshd',
28-
'sshd_config_group': 'wheel',
29-
'ssh_config_group': 'wheel',
30-
},
31-
'Gentoo': {
32-
'server': 'net-misc/openssh',
33-
'client': 'net-misc/openssh',
34-
'service': 'sshd',
35-
'dig_pkg': 'net-dns/bind-tools',
36-
},
37-
'RedHat': {
38-
'server': 'openssh-server',
39-
'client': 'openssh-clients',
40-
'service': 'sshd',
41-
'dig_pkg': 'bind-utils',
42-
},
43-
'Suse': {
44-
'server': 'openssh',
45-
'client': 'openssh',
46-
'service': 'sshd',
47-
'dig_pkg': 'bind-utils',
48-
},
49-
'Solaris': {
50-
'service': 'network/ssh',
51-
'sshd_config_group': 'root',
52-
'ssh_config_group': 'root',
53-
'dig_pkg': 'bind',
54-
'sshd_binary': '/usr/lib/ssh/sshd',
55-
},
56-
}
57-
, grain="os_family"
58-
, merge=salt['pillar.get']('openssh:lookup'))
59-
%}
60-
61-
{## Merge the flavor_map to the default settings ##}
62-
{% do default_settings.openssh.update(os_family_map) %}
63-
64-
{## Merge in openssh:lookup pillar ##}
65-
{% set openssh = salt['pillar.get'](
66-
'openssh',
67-
default=default_settings.openssh,
68-
merge=True
69-
)
70-
%}
71-
72-
{% set os_family_map = salt['grains.filter_by']({
73-
'FreeBSD': {
74-
'Subsystem': 'sftp /usr/libexec/sftp-server',
75-
},
76-
'OpenBSD': {
77-
'Subsystem': 'sftp /usr/libexec/sftp-server',
78-
},
79-
'Suse': {
80-
'Subsystem': 'sftp /usr/lib/ssh/sftp-server',
81-
},
82-
'Arch': {
83-
'Subsystem': 'sftp /usr/lib/ssh/sftp-server',
84-
},
85-
'Debian': {
86-
'Subsystem': 'sftp /usr/lib/openssh/sftp-server',
87-
},
88-
'RedHat': {
89-
'Subsystem': 'sftp /usr/libexec/openssh/sftp-server',
90-
},
91-
'Solaris': {
92-
'Subsystem': 'sftp internal-sftp',
93-
},
94-
'default': {}
95-
}
96-
, grain="os_family"
97-
, merge=salt['pillar.get']('sshd_config:lookup'))
98-
%}
99-
100-
{% set os_finger_map = salt['grains.filter_by']({
101-
'CentOS-6': {
102-
},
103-
'default': {}
104-
}
105-
, grain="osfinger"
106-
, merge=salt['pillar.get']('sshd_config:lookup'))
107-
%}
108-
109-
110-
{## Merge the flavor_map to the default settings ##}
111-
{% do default_settings.sshd_config.update(os_family_map) %}
112-
{% do default_settings.sshd_config.update(os_finger_map) %}
113-
114-
{## Merge in sshd_config:lookup pillar ##}
115-
{% set sshd_config = salt['pillar.get'](
116-
'sshd_config',
117-
default=default_settings.sshd_config,
118-
merge=True
119-
)
120-
%}
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=jinja
3+
4+
{## Start imports as ##}
5+
{% import_yaml 'openssh/defaults.yaml' as default_settings %}
6+
{% import_yaml 'openssh/osfamilymap.yaml' as osfamilymap %}
7+
{% import_yaml 'openssh/osmap.yaml' as osmap %}
8+
{% import_yaml 'openssh/osfingermap.yaml' as osfingermap %}
9+
10+
{% set defaults = salt['grains.filter_by'](default_settings,
11+
default='default',
12+
merge=salt['grains.filter_by'](osfamilymap, grain='os_family',
13+
merge=salt['grains.filter_by'](osmap, grain='os',
14+
merge=salt['grains.filter_by'](osfingermap, grain='osfinger')
15+
)
16+
)
17+
) %}
18+
19+
{## merge the openssh pillar ##}
20+
{% set openssh = salt['pillar.get']('openssh', default=defaults['openssh'], merge=True) %}
21+
{% set ssh_config = salt['pillar.get']('ssh_config', default=defaults['ssh_config'], merge=True) %}
22+
{% set sshd_config = salt['pillar.get']('sshd_config', default=defaults['sshd_config'], merge=True) %}

‎openssh/osfamilymap.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
Arch:
2+
openssh:
3+
server: openssh
4+
client: openssh
5+
service: sshd
6+
dig_pkg: bind-tools
7+
sshd_config:
8+
Subsystem: sftp /usr/lib/ssh/sftp-server
9+
10+
Debian:
11+
openssh:
12+
server: openssh-server
13+
client: openssh-client
14+
service: ssh
15+
sshd_config:
16+
Subsystem: sftp /usr/lib/openssh/sftp-server
17+
18+
FreeBSD:
19+
openssh:
20+
service: sshd
21+
dig_pkg: bind-tools
22+
sshd_config_group: wheel
23+
ssh_config_group: wheel
24+
sshd_config:
25+
Subsystem: sftp /usr/libexec/sftp-server
26+
27+
Gentoo:
28+
openssh:
29+
server: net-misc/openssh
30+
client: net-misc/openssh
31+
service: sshd
32+
dig_pkg: net-dns/bind-tools
33+
34+
OpenBSD:
35+
openssh:
36+
service: sshd
37+
sshd_config_group: wheel
38+
ssh_config_group: wheel
39+
sshd_config:
40+
Subsystem: sftp /usr/libexec/sftp-server
41+
42+
RedHat:
43+
openssh:
44+
server: openssh-server
45+
client: openssh-clients
46+
service: sshd
47+
dig_pkg: bind-utils
48+
sshd_config:
49+
Subsystem: sftp /usr/libexec/openssh/sftp-server
50+
51+
Solaris:
52+
openssh:
53+
service: network/ssh
54+
sshd_config_group: root
55+
ssh_config_group: root
56+
dig_pkg: bind
57+
sshd_binary: /usr/lib/ssh/sshd
58+
sshd_config:
59+
Subsystem: sftp internal-sftp
60+
61+
Suse:
62+
openssh:
63+
server: openssh
64+
client: openssh
65+
service: sshd
66+
dig_pkg: bind-utils
67+
sshd_config:
68+
Subsystem: sftp /usr/lib/ssh/sftp-server

‎openssh/osfingermap.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Ubuntu-18.04: {}
2+
CentOS-6:
3+
openssh:
4+
host_key_algos: ecdsa,rsa

‎openssh/osmap.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
FreeBSD: {}

0 commit comments

Comments
 (0)