aboutsummaryrefslogtreecommitdiff
path: root/manifests/subsystem/ssh/known_hosts.pp
blob: c20b9730b38897b1a943793b65b584aebeb65b42 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# Manage known_hosts for a particular user
define nodo::subsystem::ssh::known_host(
  $owner,
  $home               = '/home/$owner',
  $ssh_localhost_auth = false
) {
  nodo::subsystem::ssh::folder { "ssh_known_host-${name}":
    home  => $home,
    owner => $owner,
    group => $group,
  }

  file { "${home}/.ssh/known_hosts":
    ensure  => present,
    owner   => $owner,
    group   => $group,
    mode    => 0600,
    require => File["${home}/.ssh"],
  }

  # You can choose to include the host's fingeprints
  # directly into the known_hosts file.
  if $::sshrsakey != '' {
    line { 'known_hosts-localhost-rsa-${owner}':
      file   => "${home}/.ssh/known_hosts",
      line   => "localhost ssh-rsa ${::sshrsakey}",
      ensure => $ssh_localhost_auth ? {
        'fingerprint' => present,
        'auto'        => undef,
        default       => undef,
      },
    }
  }

  if $::sshdsakey != '' {
    line { 'known_hosts-localhost-dsa-${owner}':
      file   => "${home}/.ssh/known_hosts",
      line   => "localhost ssh-dss ${::sshdsakey}",
      ensure => $ssh_localhost_auth ? {
        'fingerprint' => present,
        'auto'        => undef,
        default       => undef,
      },
    }
  }

  if $::sshecdsakey != '' {
    line { 'known_hosts-localhost-ecdsa-${owner}':
      file   => "${home}/.ssh/known_hosts",
      line   => "localhost ecdsa-sha2-nistp256 ${::sshedsakey}",
      ensure => $ssh_localhost_auth ? {
        'fingerprint' => present,
        'auto'        => undef,
        default       => undef,
      },
    }
  }
}