Manage ssh client and server.

The module uses exported resources to manage ssh keys and removes ssh keys that are not managed by puppet. This behavior is managed by the parameters ssh_key_ensure and purge_keys.

===

This module has been tested to work on the following systems with Puppet v3.

• EL 5
• EL 6
• SLES 11
• Ubuntu 12.04 LTS

===

Hash of keys for user's ~/.ssh/authorized_keys

• Default: undefined

Array of package names used for installation.

• Default: 'openssh-server', 'openssh-server', 'openssh-clients'

Allow root login. Valid values are 'yes', 'without-password', 'forced-commands-only', 'no'.

• Default: no

Remove keys not managed by puppet.

• Default: 'true'

Open firewall for SSH service.

• Default: false

Path to ssh_config.

• Default: '/etc/ssh/ssh_config'

ssh_config's owner.

• Default: 'root'

ssh_config's group.

• Default: 'root'

ssh_config's mode.

• Default: '0644'

ForwardX11 option in ssh_config. Not set by default.

• Default: undef

ForwardAgent option in ssh_config. Not set by default.

• Default: undef

ServerAliveInterval option in ssh_config. Not set by default.

• Default: undef

Path to sshd_config.

• Default: '/etc/ssh/sshd_config

sshd_config's owner.

• Default: 'root'

sshd_config's group.

• Default: 'root'

sshd_config's mode.

• Default: '0600'

SyslogFacility option in sshd_config.

• Default: 'AUTH'

LoginGraceTime option in sshd_config.

• Default: '120'

ChallengeResponseAuthentication option in sshd_config.

• Default: 'no'

PrintMotd option in sshd_config.

• Default: 'yes'

UseDNS option in sshd_config.

• Default: 'yes'

Banner option in sshd_config.

• Default: 'none'

XAuthLocation option in sshd_config.

• Default: '/usr/bin/xauth'

Path to sftp file transfer subsystem in sshd_config.

• Default: '/usr/libexec/openssh/sftp-server'

Ensure SSH service is running. Valid values are 'stopped' and 'running'.

• Default: 'running'

Name of the SSH service.

• Default: 'sshd'

Start SSH at boot. Valid values are 'true', 'false' and 'manual'.

• Default: 'true'

Specify that the init script has a restart command. Valid values are 'true' and 'false'.

• Default: 'true'

Declare whether the service's init script has a functional status command. Valid values are 'true' and 'false'

• Default: 'true'

Export node SSH key. Valid values are 'present' and 'absent'.

• Default: 'present'

Encryption type for SSH key. Valid values are 'rsa', 'dsa', 'ssh-dss' and 'ssh-rsa'

• Default: 'ssh-rsa'

Manage SSH config of root. Valid values are 'true' and 'false'.

• Default: 'false'

Content of root's ~/.ssh/config.

• Default: "# This file is being maintained by Puppet.\n# DO NOT EDIT\n"

===

This works by passing the ssh::keys hash to the ssh_authorized_keys type with create_resources(). Because of this, you may specify any valid parameter for ssh_authorized_key. See the Type Reference for a complete list.

Push authorized key "root_for_userX" and remove key "root_for_userY" through Hiera.

ssh::keys:
  root_for_userX:
    ensure: present
    user: root
    type: dsa
    key: AAAA...==
  root_for_userY:
    ensure: absent
    user: root