Skip to content

Commit 8d32494

Browse files
author
Phil Friderici
committed
Add support for CentOS 9
1 parent 99c5633 commit 8d32494

File tree

9 files changed

+286
-0
lines changed

9 files changed

+286
-0
lines changed

‎data/os/CentOS/9.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
ssh::config_files:
3+
'/etc/ssh/ssh_config.d/50-redhat.conf':
4+
lines:
5+
Match: 'final all'
6+
Include: '/etc/crypto-policies/back-ends/openssh.config'
7+
GSSAPIAuthentication: 'yes'
8+
ForwardX11Trusted: 'yes'
9+
ssh::manage_config_files: true
10+
ssh::packages:
11+
- 'openssh-clients'
12+
ssh::server::packages:
13+
- 'openssh-server'
14+
15+
ssh::include: '/etc/ssh/ssh_config.d/*.conf'
16+
17+
ssh::server::authorized_keys_file:
18+
- '.ssh/authorized_keys'
19+
ssh::server::config_files:
20+
'/etc/ssh/sshd_config.d/50-redhat.conf':
21+
lines:
22+
Include: '/etc/crypto-policies/back-ends/opensshserver.config'
23+
SyslogFacility: 'AUTHPRIV'
24+
ChallengeResponseAuthentication: 'no'
25+
GSSAPIAuthentication: 'yes'
26+
GSSAPICleanupCredentials: 'no'
27+
UsePAM: 'yes'
28+
X11Forwarding: 'yes'
29+
PrintMotd: 'no'
30+
ssh::server::manage_config_files: true
31+
ssh::server::include: '/etc/ssh/sshd_config.d/*.conf'
32+
ssh::server::subsystem: 'sftp /usr/libexec/openssh/sftp-server'

‎spec/fixtures/testing/CentOS-9_ssh_config

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
#
4+
# See https://man.openbsd.org/ssh_config for more info
5+
6+
Include /etc/ssh/ssh_config.d/*.conf

‎spec/fixtures/testing/CentOS-9_ssh_config.d

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
4+
Match final all
5+
Include /etc/crypto-policies/back-ends/openssh.config
6+
GSSAPIAuthentication yes
7+
ForwardX11Trusted yes

‎spec/fixtures/testing/CentOS-9_sshd_config

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
#
4+
# See https://man.openbsd.org/sshd_config for more info
5+
6+
AuthorizedKeysFile .ssh/authorized_keys
7+
Include /etc/ssh/sshd_config.d/*.conf
8+
Subsystem sftp /usr/libexec/openssh/sftp-server

‎spec/fixtures/testing/CentOS-9_sshd_config.d

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
4+
Include /etc/crypto-policies/back-ends/opensshserver.config
5+
SyslogFacility AUTHPRIV
6+
ChallengeResponseAuthentication no
7+
GSSAPIAuthentication yes
8+
GSSAPICleanupCredentials no
9+
UsePAM yes
10+
X11Forwarding yes
11+
PrintMotd no

‎spec/fixtures/untouched/CentOS-9_ssh_config

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# $OpenBSD: ssh_config,v 1.35 2020/07/17 03:43:42 dtucker Exp $
2+
3+
# This is the ssh client system-wide configuration file. See
4+
# ssh_config(5) for more information. This file provides defaults for
5+
# users, and the values can be changed in per-user configuration files
6+
# or on the command line.
7+
8+
# Configuration data is parsed as follows:
9+
# 1. command line options
10+
# 2. user-specific file
11+
# 3. system-wide file
12+
# Any configuration value is only changed the first time it is set.
13+
# Thus, host-specific definitions should be at the beginning of the
14+
# configuration file, and defaults at the end.
15+
16+
# Site-wide defaults for some commonly used options. For a comprehensive
17+
# list of available options, their meanings and defaults, please see the
18+
# ssh_config(5) man page.
19+
20+
# Host *
21+
# ForwardAgent no
22+
# ForwardX11 no
23+
# PasswordAuthentication yes
24+
# HostbasedAuthentication no
25+
# GSSAPIAuthentication no
26+
# GSSAPIDelegateCredentials no
27+
# GSSAPIKeyExchange no
28+
# GSSAPITrustDNS no
29+
# BatchMode no
30+
# CheckHostIP yes
31+
# AddressFamily any
32+
# ConnectTimeout 0
33+
# StrictHostKeyChecking ask
34+
# IdentityFile ~/.ssh/id_rsa
35+
# IdentityFile ~/.ssh/id_dsa
36+
# IdentityFile ~/.ssh/id_ecdsa
37+
# IdentityFile ~/.ssh/id_ed25519
38+
# Port 22
39+
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
40+
# MACs hmac-md5,hmac-sha1,[email protected]
41+
# EscapeChar ~
42+
# Tunnel no
43+
# TunnelDevice any:any
44+
# PermitLocalCommand no
45+
# VisualHostKey no
46+
# ProxyCommand ssh -q -W %h:%p gateway.example.com
47+
# RekeyLimit 1G 1h
48+
# UserKnownHostsFile ~/.ssh/known_hosts.d/%k
49+
#
50+
# This system is following system-wide crypto policy.
51+
# To modify the crypto properties (Ciphers, MACs, ...), create a *.conf
52+
# file under /etc/ssh/ssh_config.d/ which will be automatically
53+
# included below. For more information, see manual page for
54+
# update-crypto-policies(8) and ssh_config(5).
55+
Include /etc/ssh/ssh_config.d/*.conf

‎spec/fixtures/untouched/CentOS-9_ssh_config.d-50-redhat.conf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# The options here are in the "Match final block" to be applied as the last
2+
# options and could be potentially overwritten by the user configuration
3+
Match final all
4+
# Follow system-wide Crypto Policy, if defined:
5+
Include /etc/crypto-policies/back-ends/openssh.config
6+
7+
GSSAPIAuthentication yes
8+
9+
# If this option is set to yes then remote X11 clients will have full access
10+
# to the original X11 display. As virtually no X11 client supports the untrusted
11+
# mode correctly we set this to yes.
12+
ForwardX11Trusted yes
13+
14+
# Uncomment this if you want to use .local domain
15+
# Host *.local

‎spec/fixtures/untouched/CentOS-9_sshd_config

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $
2+
3+
# This is the sshd server system-wide configuration file. See
4+
# sshd_config(5) for more information.
5+
6+
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
7+
8+
# The strategy used for options in the default sshd_config shipped with
9+
# OpenSSH is to specify options with their default value where
10+
# possible, but leave them commented. Uncommented options override the
11+
# default value.
12+
13+
# To modify the system-wide sshd configuration, create a *.conf file under
14+
# /etc/ssh/sshd_config.d/ which will be automatically included below
15+
Include /etc/ssh/sshd_config.d/*.conf
16+
17+
# If you want to change the port on a SELinux system, you have to tell
18+
# SELinux about this change.
19+
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
20+
#
21+
#Port 22
22+
#AddressFamily any
23+
#ListenAddress 0.0.0.0
24+
#ListenAddress ::
25+
26+
#HostKey /etc/ssh/ssh_host_rsa_key
27+
#HostKey /etc/ssh/ssh_host_ecdsa_key
28+
#HostKey /etc/ssh/ssh_host_ed25519_key
29+
30+
# Ciphers and keying
31+
#RekeyLimit default none
32+
33+
# Logging
34+
#SyslogFacility AUTH
35+
#LogLevel INFO
36+
37+
# Authentication:
38+
39+
#LoginGraceTime 2m
40+
#PermitRootLogin prohibit-password
41+
#StrictModes yes
42+
#MaxAuthTries 6
43+
#MaxSessions 10
44+
45+
#PubkeyAuthentication yes
46+
47+
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
48+
# but this is overridden so installations will only check .ssh/authorized_keys
49+
AuthorizedKeysFile .ssh/authorized_keys
50+
51+
#AuthorizedPrincipalsFile none
52+
53+
#AuthorizedKeysCommand none
54+
#AuthorizedKeysCommandUser nobody
55+
56+
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
57+
#HostbasedAuthentication no
58+
# Change to yes if you don't trust ~/.ssh/known_hosts for
59+
# HostbasedAuthentication
60+
#IgnoreUserKnownHosts no
61+
# Don't read the user's ~/.rhosts and ~/.shosts files
62+
#IgnoreRhosts yes
63+
64+
# To disable tunneled clear text passwords, change to no here!
65+
#PasswordAuthentication yes
66+
#PermitEmptyPasswords no
67+
68+
# Change to no to disable s/key passwords
69+
#KbdInteractiveAuthentication yes
70+
71+
# Kerberos options
72+
#KerberosAuthentication no
73+
#KerberosOrLocalPasswd yes
74+
#KerberosTicketCleanup yes
75+
#KerberosGetAFSToken no
76+
#KerberosUseKuserok yes
77+
78+
# GSSAPI options
79+
#GSSAPIAuthentication no
80+
#GSSAPICleanupCredentials yes
81+
#GSSAPIStrictAcceptorCheck yes
82+
#GSSAPIKeyExchange no
83+
#GSSAPIEnablek5users no
84+
85+
# Set this to 'yes' to enable PAM authentication, account processing,
86+
# and session processing. If this is enabled, PAM authentication will
87+
# be allowed through the KbdInteractiveAuthentication and
88+
# PasswordAuthentication. Depending on your PAM configuration,
89+
# PAM authentication via KbdInteractiveAuthentication may bypass
90+
# the setting of "PermitRootLogin without-password".
91+
# If you just want the PAM account and session checks to run without
92+
# PAM authentication, then enable this but set PasswordAuthentication
93+
# and KbdInteractiveAuthentication to 'no'.
94+
# WARNING: 'UsePAM no' is not supported in RHEL and may cause several
95+
# problems.
96+
#UsePAM no
97+
98+
#AllowAgentForwarding yes
99+
#AllowTcpForwarding yes
100+
#GatewayPorts no
101+
#X11Forwarding no
102+
#X11DisplayOffset 10
103+
#X11UseLocalhost yes
104+
#PermitTTY yes
105+
#PrintMotd yes
106+
#PrintLastLog yes
107+
#TCPKeepAlive yes
108+
#PermitUserEnvironment no
109+
#Compression delayed
110+
#ClientAliveInterval 0
111+
#ClientAliveCountMax 3
112+
#UseDNS no
113+
#PidFile /var/run/sshd.pid
114+
#MaxStartups 10:30:100
115+
#PermitTunnel no
116+
#ChrootDirectory none
117+
#VersionAddendum none
118+
119+
# no default banner path
120+
#Banner none
121+
122+
# override default of no subsystems
123+
Subsystem sftp /usr/libexec/openssh/sftp-server
124+
125+
# Example of overriding settings on a per-user basis
126+
#Match User anoncvs
127+
# X11Forwarding no
128+
# AllowTcpForwarding no
129+
# PermitTTY no
130+
# ForceCommand cvs server

‎spec/fixtures/untouched/CentOS-9_sshd_config.d-50-redhat.conf

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# This system is following system-wide crypto policy. The changes to
2+
# crypto properties (Ciphers, MACs, ...) will not have any effect in
3+
# this or following included files. To override some configuration option,
4+
# write it before this block or include it before this file.
5+
# Please, see manual pages for update-crypto-policies(8) and sshd_config(5).
6+
Include /etc/crypto-policies/back-ends/opensshserver.config
7+
8+
SyslogFacility AUTHPRIV
9+
10+
ChallengeResponseAuthentication no
11+
12+
GSSAPIAuthentication yes
13+
GSSAPICleanupCredentials no
14+
15+
UsePAM yes
16+
17+
X11Forwarding yes
18+
19+
# It is recommended to use pam_motd in /etc/pam.d/sshd instead of PrintMotd,
20+
# as it is more configurable and versatile than the built-in version.
21+
PrintMotd no
22+

0 commit comments

Comments
 (0)