Skip to content

Introduce SSH cert support #867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
+64 −26
Draft

Introduce SSH cert support #867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions manifests/plugin/ansible.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,14 +50,6 @@
$foreman_ssl_key = pick($foreman_proxy::foreman_ssl_key, $foreman_proxy::ssl_key)
$foreman_ssl_ca = pick($foreman_proxy::foreman_ssl_ca, $foreman_proxy::ssl_ca)

file { "${foreman_proxy::config_dir}/ansible.env":
ensure => file,
content => template('foreman_proxy/plugin/ansible.env.erb'),
owner => 'root',
group => $foreman_proxy::user,
mode => '0640',
}

if ($facts['os']['family'] in ['RedHat', 'Debian'] and $foreman_proxy::plugin::ansible::callback == 'theforeman.foreman.foreman') {
stdlib::ensure_packages(['ansible-collection-theforeman-foreman'])
}
Expand All @@ -68,6 +60,24 @@
include foreman_proxy::plugin::ansible::runner
}

$certificate_file_option = $foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file ? {
undef => '',
default => " -o CertificateFile=${foreman_proxy::plugin::remote_execution::script::ssh_identity_path}-cert.pub",
}
$host_ca_options = $foreman_proxy::plugin::remote_execution::script::ssh_host_ca_public_key ? {
undef => '',
default => " -o UserKnownHostsFile=${foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file} -o StrictHostKeyChecking=yes",
}
$ansible_ssh_args = "${ssh_args}${certificate_file_option}${host_ca_options}"

file { "${foreman_proxy::config_dir}/ansible.env":
ensure => file,
content => template('foreman_proxy/plugin/ansible.env.erb'),
owner => 'root',
group => $foreman_proxy::user,
mode => '0640',
}

foreman_proxy::plugin::module { 'ansible':
enabled => $enabled,
listen_on => $listen_on,
Expand Down
55 changes: 38 additions & 17 deletions manifests/plugin/remote_execution/script.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,42 +4,46 @@
#
# === Parameters:
#
# $mode:: Operation Mode of the plugin.
# $mode:: Operation Mode of the plugin.
#
# $cockpit_integration:: Enables/disables Cockpit integration
# $cockpit_integration:: Enables/disables Cockpit integration
#
# === SSH parameters:
#
# $generate_keys:: Automatically generate SSH keys
# $generate_keys:: Automatically generate SSH keys
#
# $install_key:: Automatically install generated SSH key to root authorized keys
# which allows managing this host through Remote Execution
# $install_key:: Automatically install generated SSH key to root authorized keys
# which allows managing this host through Remote Execution
#
# $ssh_identity_dir:: Directory where SSH keys are stored
# $ssh_identity_dir:: Directory where SSH keys are stored
#
# $ssh_identity_file:: Provide an alternative name for the SSH keys
# $ssh_identity_file:: Provide an alternative name for the SSH keys
#
# $ssh_keygen:: Location of the ssh-keygen binary
# $ssh_user_ca_public_key_file:: Public key file for the SSH CA certificate
Copy link
Contributor Author

@adamlazik1 adamlazik1 Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we unify with the host CA key behavior and pass the public key contents instead of a path? I would solve issues with permissions.

Copy link
Contributor

@lhellebr lhellebr Jul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From security POV, it should be fine since the CA key is public. But how long is it? How long will it eventually be? Maybe the shell won't like a line that long. I think this kind of data shouldn't be passed in the command line. OTOH, if it's consistent with something we already have, it may be the least confusing.
The permission issues themselves can be solved by documentation + help text.

Copy link
Contributor Author

@adamlazik1 adamlazik1 Jul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, thanks for your input. You have a good point with possible future length, so I will probably leave it as it is.

#
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
# $ssh_host_ca_public_key:: Trusted host CA public key
#
# $local_working_dir:: Local working directory on the smart proxy
# $ssh_keygen:: Location of the ssh-keygen binary
#
# $remote_working_dir:: Remote working directory on clients
# $ssh_kerberos_auth:: Enable kerberos authentication for SSH
#
# $ssh_log_level:: Configure ssh client LogLevel
# $local_working_dir:: Local working directory on the smart proxy
#
# $remote_working_dir:: Remote working directory on clients
#
# $ssh_log_level:: Configure ssh client LogLevel
#
# === Advanced parameters:
#
# $enabled:: Enables/disables the plugin
# $enabled:: Enables/disables the plugin
#
# $listen_on:: Proxy feature listens on https, http, or both
# $listen_on:: Proxy feature listens on https, http, or both
#
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
# $mqtt_ttl:: Time interval in seconds given to the host to pick up the job before considering the job undelivered.
#
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
# $mqtt_rate_limit:: Number of jobs that are allowed to run at the same time
#
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
# $mqtt_resend_interval:: Time interval in seconds at which the notification should be re-sent to the host until the job is picked up or canceleld
#
class foreman_proxy::plugin::remote_execution::script (
Boolean $enabled = true,
Expand All @@ -48,6 +52,8 @@
Boolean $install_key = false,
Stdlib::Absolutepath $ssh_identity_dir = '/var/lib/foreman-proxy/ssh',
String $ssh_identity_file = 'id_rsa_foreman_proxy',
Optional[Stdlib::Absolutepath] $ssh_user_ca_public_key_file = undef,
Optional[String] $ssh_host_ca_public_key = undef,
String $ssh_keygen = '/usr/bin/ssh-keygen',
Stdlib::Absolutepath $local_working_dir = '/var/tmp',
Stdlib::Absolutepath $remote_working_dir = '/var/tmp',
Expand All @@ -59,6 +65,7 @@
Optional[Integer] $mqtt_rate_limit = undef,
Optional[Integer] $mqtt_resend_interval = undef,
) {
$ssh_ca_known_hosts_file = "${ssh_identity_dir}/foreman_known_hosts_ca"
$ssh_identity_path = "${ssh_identity_dir}/${ssh_identity_file}"

include foreman_proxy
Expand Down Expand Up @@ -87,5 +94,19 @@
ssl_key => $foreman_proxy::ssl_key,
}

if $ssh_host_ca_public_key {
file { $ssh_ca_known_hosts_file:
ensure => file,
owner => $foreman_proxy::user,
group => $foreman_proxy::group,
mode => '0600',
content => "@cert-autority * ${ssh_host_ca_public_key}\n",
}
} else {
file { $ssh_ca_known_hosts_file:
ensure => absent,
}
}

Class['foreman_proxy::config'] ~> Class['foreman_proxy::plugin::remote_execution::mosquitto']
}
2 changes: 1 addition & 1 deletion templates/plugin/ansible.env.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,4 @@ export FOREMAN_SSL_CERT="<%= @foreman_ssl_cert %>"
export FOREMAN_SSL_KEY="<%= @foreman_ssl_key %>"
export FOREMAN_SSL_VERIFY="<%= @foreman_ssl_ca %>"

export ANSIBLE_SSH_ARGS="<%= @ssh_args %>"
export ANSIBLE_SSH_ARGS="<%= @ansible_ssh_args %>"
7 changes: 7 additions & 0 deletions templates/plugin/remote_execution_ssh.yml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,13 @@

:cockpit_integration: <%= scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::cockpit_integration') %>

<% if ssh_user_ca_public_key_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_user_ca_public_key_file') -%>
:ssh_user_ca_public_key_file: <%= ssh_user_ca_public_key_file %>
<% end -%>
<% if ssh_ca_known_hosts_file = scope.lookupvar('::foreman_proxy::plugin::remote_execution::script::ssh_ca_known_hosts_file') -%>
:ssh_ca_known_hosts_file: <%= ssh_ca_known_hosts_file %>
<% end -%>

# Whether to run remote execution jobs asynchronously
:mode: <%= scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") %>
<% if scope.lookupvar("::foreman_proxy::plugin::remote_execution::script::mode") == 'pull-mqtt' -%>
Expand Down
Loading