aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--.gitignore1
-rw-r--r--README30
-rw-r--r--files/etc/cron.d/update-monkeysphere-auth1
-rw-r--r--lib/facter/monkeysphere.rb42
-rw-r--r--manifests/debian.pp16
-rw-r--r--manifests/init.pp22
-rw-r--r--manifests/signer.pp4
-rw-r--r--manifests/sshserver.pp29
-rw-r--r--manifests/sshserverdanger.pp11
-rw-r--r--templates/host.erb3
10 files changed, 159 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b25c15b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+*~
diff --git a/README b/README
new file mode 100644
index 0000000..dbd13e3
--- /dev/null
+++ b/README
@@ -0,0 +1,30 @@
+puppet module for monkeysphere
+
+for information about monkeysphere, see http://web.monkeysphere.info/
+
+To install the monkeypshere module:
+
+* storeconfigs must be enabled in your puppet server. see:
+ http://projects.puppetlabs.com/projects/1/wiki/Using_Stored_Configuration#Configuring+basic+storeconfigs
+
+* copy the code to a directory named "monkeysphere" in the modules
+ directory of your puppet install. This will usually be
+ /etc/puppetd/modules/monkeysphere
+
+* add the following line to modules.pp:
+
+ import "monkeysphere"
+
+* in node definitions that should export a ssh host key via
+ monkeyshere, add:
+
+ include monkeysphere::sshserver
+
+A host can be configured as a host you would use to sign the gpg keys by placing:
+
+ include monkeysphere::signer
+
+into the node definition. ON this host, a file will be placed in
+/var/lib/puppet/monkeysphere/hosts for each host configured as a
+sshserver. Each file will contin the gpg id, the gpg fingerprint, and
+the ssh fingerprint of the sshserver. \ No newline at end of file
diff --git a/files/etc/cron.d/update-monkeysphere-auth b/files/etc/cron.d/update-monkeysphere-auth
new file mode 100644
index 0000000..06bb5ae
--- /dev/null
+++ b/files/etc/cron.d/update-monkeysphere-auth
@@ -0,0 +1 @@
+*/5 * * * * root /usr/sbin/monkeysphere-authentication update-users
diff --git a/lib/facter/monkeysphere.rb b/lib/facter/monkeysphere.rb
new file mode 100644
index 0000000..e3a0a73
--- /dev/null
+++ b/lib/facter/monkeysphere.rb
@@ -0,0 +1,42 @@
+has_hostkey = false
+pgp_fingerprint = ''
+pgp_id = ''
+ssh_fingerprint = ''
+
+if File.exist?('/usr/sbin/monkeysphere-host')
+
+ sk = %x{/usr/sbin/monkeysphere-host show-keys}
+ if $? == 0
+ has_hostkey = true
+ sk.lines.each do |line|
+ m = line.match('^OpenPGP fingerprint:(.*)$')
+ if m
+ pgp_fingerprint = m[1].strip
+ end
+ m = line.match('^uid (.*)$')
+ if m
+ pgp_id = m[1].strip
+ end
+ m = line.match('^ssh fingerprint:(.*)$')
+ if m
+ ssh_fingerprint = m[1].strip
+ end
+ end
+ end
+end
+
+Facter.add("monkeysphere_has_hostkey") do
+ setcode{ has_hostkey }
+end
+
+Facter.add("monkeysphere_pgp_fp") do
+ setcode{ pgp_fingerprint }
+end
+
+Facter.add("monkeysphere_pgp_id") do
+ setcode{ pgp_id }
+end
+
+Facter.add("monkeysphere_ssh_fp") do
+ setcode{ ssh_fingerprint }
+end
diff --git a/manifests/debian.pp b/manifests/debian.pp
new file mode 100644
index 0000000..4166c79
--- /dev/null
+++ b/manifests/debian.pp
@@ -0,0 +1,16 @@
+class monkeysphere::debian {
+
+case $lsbdistcodename {
+ lenny: {
+ if $monkeysphere_ensure_version == ''
+ {
+ $monkeysphere_ensure_version = '1.4.10-2~bpo50+1'
+ }
+
+ if $gnupg_ensure_version == ''
+ {
+ $gnupg_ensure_version = '0.31-3~bpo50+1'
+ }
+ }
+ }
+}
diff --git a/manifests/init.pp b/manifests/init.pp
new file mode 100644
index 0000000..943d3eb
--- /dev/null
+++ b/manifests/init.pp
@@ -0,0 +1,22 @@
+# monkeysphere module
+class monkeysphere {
+ module_dir { [ "monkeysphere", "monkeysphere/hosts", "monkeysphere/plugins" ]: }
+
+ case $operatingsystem {
+ debian: { include monkeysphere::debian }
+ }
+
+ if $monkeysphere_ensure_version == ''
+ {
+ $monkeysphere_ensure_version = 'installed'
+ }
+
+ if $gnupg_ensure_version == ''
+ {
+ $gnupg_ensure_version = 'installed'
+ }
+
+ package {"gnupg": ensure => $gnupg_ensure_version, }
+ package {"monkeysphere": ensure => $monkeysphere_ensure_version, require => [ Package["gnupg"] ] }
+
+}
diff --git a/manifests/signer.pp b/manifests/signer.pp
new file mode 100644
index 0000000..350b4be
--- /dev/null
+++ b/manifests/signer.pp
@@ -0,0 +1,4 @@
+class monkeysphere::signer inherits monkeysphere
+{
+ File <<| tag == 'monkeysphere-host' |>>
+}
diff --git a/manifests/sshserver.pp b/manifests/sshserver.pp
new file mode 100644
index 0000000..966e136
--- /dev/null
+++ b/manifests/sshserver.pp
@@ -0,0 +1,29 @@
+class monkeysphere::sshserver inherits monkeysphere
+{
+
+ exec {"import.hostkey":
+ command => "/usr/sbin/monkeysphere-host import-key /etc/ssh/ssh_host_rsa_key ssh://${fqdn} && echo Y | /usr/sbin/monkeysphere-host publish-key",
+ unless => "/usr/sbin/monkeysphere-host show-key",
+ user => root,
+ require => [ Package[ "monkeysphere" ] ],
+ }
+
+ if $monkeysphere_has_hostkey {
+ @@file { "/var/lib/puppet/modules/monkeysphere/hosts/${fqdn}":
+ ensure => present,
+ content => template("monkeysphere/host.erb" ),
+ require => [ Package[ "monkeysphere" ] ],
+ tag => 'monkeysphere-host',
+ }
+ }
+
+ file { "/etc/cron.d/update-monkeysphere-auth":
+ ensure => present,
+ source => "puppet:///modules/monkeysphere/etc/cron.d/update-monkeysphere-auth",
+ require => [ Package[ "monkeysphere" ] ],
+ mode => 0644,
+ owner => root,
+ group => root,
+ }
+
+}
diff --git a/manifests/sshserverdanger.pp b/manifests/sshserverdanger.pp
new file mode 100644
index 0000000..7d7f12c
--- /dev/null
+++ b/manifests/sshserverdanger.pp
@@ -0,0 +1,11 @@
+class monkeysphere::sshserverdanger inherits monkeysphere::sshserver
+{
+ augeas { "sshd_config":
+ context => "/files/etc/ssh/sshd_config",
+ changes => [
+ "set AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u"
+ ],
+ notify => Service[ "ssh" ],
+ }
+
+}
diff --git a/templates/host.erb b/templates/host.erb
new file mode 100644
index 0000000..6412663
--- /dev/null
+++ b/templates/host.erb
@@ -0,0 +1,3 @@
+uid <%= monkeysphere_pgp_id %>
+host_key <%= monkeysphere_ssh_fp %>
+fingerprint <%= monkeysphere_pgp_fp %>