path: root/manifests/init.pp

#
# ssh module
#
# Copyright 2008, micah@riseup.net
# Copyright 2008, admin(at)immerda.ch
# Copyright 2008, Puzzle ITC GmbH
# Marcel Härry haerry+puppet(at)puzzle.ch
# Simon Josi josi+puppet(at)puzzle.ch
#
# This program is free software; you can redistribute 
# it and/or modify it under the terms of the GNU 
# General Public License version 3 as published by 
# the Free Software Foundation.
#
# Deploy authorized_keys file with the define
#     sshd::deploy_auth_key
# 
# sshd-config:
#
# The configuration of the sshd is rather strict and might not fit all
# needs. However there are a bunch of variables, which you might
# consider configuring.
#
# To set any of the following, simply set them as variables in your manifests
# before the class is included, for example:
#
# $sshd_listen_address = ['10.0.0.1 192.168.0.1']
# $sshd_use_pam = yes
# include sshd::debian
#
# The following is a list of the currently available variables:
#
# sshd_listen_address:          specify the addresses sshd should listen on
#                               set this to ['10.0.0.1 192.168.0.1'] to have it listen on both
#                               addresses, or leave it unset to listen on all
#                               Default: empty -> results in listening on 0.0.0.0
#
# sshd_allowed_users:           list of usernames separated by spaces. 
#                               set this for example to "foobar root"
#                               to ensure that only user foobar and root
#                               might login. 
#                               Default: empty -> no restriction is set
# 
# sshd_use_pam:                 if you want to use pam or not for authenticaton
#                               Values: no or yes. 
#                               Default: no
#
# sshd_permit_root_login:       If you want to allow root logins or not.
#                               Valid values: yes, no, without-password, forced-commands-only
#                               Default: without-password
#
# sshd_password_authentication: If you want to enable password authentication or not
#                               Valid values: yes or no
#                               Default: no
#				
# sshd_challenge_response_authentication: If you want to enable ChallengeResponseAuthentication or not
# 				When disabled, s/key passowords are disabled
# 				Valid values: yes or no
#				Default: no
# 
# sshd_tcp_forwarding:		If you want to enable TcpForwarding
# 				Valid Values: yes or no
#				Default: no
#
# sshd_x11_forwarding:          If you want to enable x11 forwarding 
#                               Valid Values: yes or no
#                               Default: no
#
# sshd_agent_forwarding:	If you want to allow ssh-agent forwarding
# 				Valid Values: yes or no
#				Default: no
#
# sshd_pubkey_authentication:	If you want to enable public key authentication
# 				Valid Values: yes or no
#				Default: yes
#
# sshd_rsa_authentication:	If you want to enable RSA Authentication
# 				Valid Values: yes or no
#				Default: no
#				
# sshd_rhosts_rsa_authentication:	If you want to enable rhosts RSA Authentication
# 				Valid Values: yes or no
#				Default: no
#
# sshd_hostbased_authentication: If you want to enable HostbasedAuthentication
# 				 Valid Values: yes or no
#				 Default: no
#				
# sshd_strict_modes:		If you want to set StrictModes (check file modes/ownership before accepting login)
# 				Valid Values: yes or no
#				Default: yes
#
# sshd_permit_empty_passwords:	If you want enable PermitEmptyPasswords to allow empty passwords
# 				Valid Values: yes or no
#				Default: no
#
# sshd_port:                    If you want to specify a different port than the default 22
#                               Default: 22
#
# sshd_authorized_keys_file:    Set this to the location of the AuthorizedKeysFile (e.g. /etc/ssh/authorized_keys/%u)
#                               Default: AuthorizedKeysFile	%h/.ssh/authorized_keys
#

class sshd {
    include sshd::client 

    case $operatingsystem {
        gentoo: { include sshd::gentoo }
        redhat: { include sshd::redhat }
        centos: { include sshd::centos }
        openbsd: { include sshd::openbsd }
        debian: { include sshd::debian }
        ubuntu: { include sshd::ubuntu }
        default: { include sshd::default }
    }
}


class sshd::base {
    # prepare variables to use in templates
    $real_sshd_listen_address = $sshd_listen_address ? {
      '' => [ '0.0.0.0', '::' ],
      default => $sshd_listen_address
    }
    $real_sshd_allowed_users = $sshd_allowed_users ? {
        ''  => '',
        default => $sshd_allowed_users
    }
    $real_sshd_use_pam = $sshd_use_pam ? {
        '' => 'no',
        default => $sshd_use_pam
    }
    $real_sshd_permit_root_login = $sshd_permit_root_login ? {
        '' => 'without-password',
        default => $sshd_permit_root_login
    }
    $real_sshd_password_authentication = $sshd_password_authentication ? {
        '' => 'no',
        default => $sshd_password_authentication
    }
    $real_sshd_tcp_forwarding = $sshd_tcp_forwarding ? {
    	'' => 'no',
	default => $sshd_tcp_forwarding
    }
    $real_sshd_x11_forwarding = $sshd_x11_forwarding ? {
        '' => 'no',
        default => $sshd_x11_forwarding
    }
    $real_sshd_agent_forwarding = $sshd_agent_forwarding ? {
    	'' => 'no',
	default => $sshd_agent_forwarding
    }
    $real_sshd_challenge_response_authentication = $sshd_challenge_response_authentication ? {
        '' => 'no',
	default => $sshd_challenge_response_authentication
    }
    $real_sshd_pubkey_authentication = $sshd_pubkey_authentication ? {
    	'' => 'yes',
	default => $sshd_pubkey_authentication
    }
    $real_sshd_rsa_authentication = $sshd_rsa_authentication ? {
    	'' => 'no',
	default => $sshd_rsa_authentication
    }
    $real_sshd_strict_modes = $sshd_strict_modes ? {
    	'' => 'yes',
	default => $sshd_strict_modes
    }
    $real_sshd_ignore_rhosts = $sshd_ignore_rhosts ? {
        '' => 'yes',
	default => $sshd_ignore_rhosts
    }
    $real_sshd_rhosts_rsa_authentication = $sshd_rhosts_rsa_authentication ? {
    	'' => 'no',
	default => $sshd_rhosts_rsa_authentication
    }
    $real_sshd_hostbased_authentication = $sshd_hostbased_authentication ? {
    	'' => 'no',
	default => $sshd_hostbased_authentication
    }
    $real_sshd_permit_empty_passwords = $sshd_permit_empty_passwords ? {
    	'' => 'no',
	default => $sshd_permit_empty_passwords
    }
    $real_sshd_port = $sshd_port ? {
      '' => 22,
      default => $sshd_port
    }
    $real_sshd_authorized_keys_file = $sshd_authorized_keys_file ? {
      '' => "%h/.ssh/authorized_keys",
      default => $sshd_authorized_keys_file
    }
      
    file { 'sshd_config':
        path => '/etc/ssh/sshd_config',
        owner => root,
        group => 0,
        mode => 600,
        content => $lsbdistcodename ? {
          '' => template("sshd/sshd_config/${operatingsystem}.erb"),
          default => template ("sshd/sshd_config/${operatingsystem}_${lsbdistcodename}.erb"),
        },
        notify => Service[sshd],
    }
    # Now add the key, if we've got one
    case $sshrsakey_key {
        '': { info("no sshrsakey on $fqdn") }
        default: {
            @@sshkey{"$hostname.$domain":
                type => ssh-rsa,
                key => $sshrsakey_key,
                ensure => present,
                require => Package["openssh-clients"],
            }
        }
    }
    service{'sshd':
        name => 'sshd',
        enable => true,
        ensure => running,
        hasstatus => true,
		require => File[sshd_config],
    }
}

class sshd::linux inherits sshd::base {
    package{openssh:
	    ensure => present,
	}
    File[sshd_config]{
        require +> Package[openssh],
    }
}

class sshd::gentoo inherits sshd::linux {
    Package[openssh]{
        category => 'net-misc',
    }
}

class sshd::debian inherits sshd::linux {

  # the templates for Debian need lsbdistcodename
  include assert_lsbdistcodename
  
    Package[openssh]{
        name => 'openssh-server',
    }
    Service[sshd]{
        name => 'ssh',
        hasstatus => false,
    }
}
class sshd::ubuntu inherits sshd::debian {}

class sshd::redhat inherits sshd::linux {
    Package[openssh]{
        name => 'openssh-server',
    }
}
class sshd::centos inherits sshd::redhat {}

class sshd::openbsd inherits sshd::base {
    Service[sshd]{
        restart => '/bin/kill -HUP `/bin/cat /var/run/sshd.pid`',
	    stop => '/bin/kill `/bin/cat /var/run/sshd.pid`',
        start => '/usr/sbin/sshd',
        hasstatus => false,
    }
}

### defines 
# wrapper to have some defaults.
define sshd::ssh_authorized_key(
    $type = 'ssh-dss',
    $key,
    $user = 'root',
    $target = undef,
    $options = 'absent'
){
    ssh_authorized_key{$name:
        type => $type,
        key => $key,
        user => $user,
        target => $target,
    }

    case $options {
        'absent': { info("not setting any option for ssh_authorized_key: $name") }
        default: {
            Ssh_authorized_key[$name]{
                options => $options,
            }
        }
    }
}

# deprecated!
define sshd::deploy_auth_key(
        $source = 'present',
        $user = 'root', 
        $target_dir = '/root/.ssh/', 
        $group = 0 ) {

        notice("this way of deploying authorized keys is deprecated. use the native ssh_authorized_key instead")

        $real_target = $target_dir ? {
                '' => "/home/$user/.ssh/",
                default => $target_dir,
        }

        file {$real_target:
                ensure => directory,
                owner => $user,
                group => $group,
                mode => 700,
        }

        case $source {
            'present': { $keysource = $name }
            default: { $keysource = $source }
        }

        file {"authorized_keys_${user}":
                path => "$real_target/authorized_keys",
                owner => $user,
                group => $group,
                mode => 600,
                source => [ "puppet://$server/files/sshd/authorized_keys/${keysource}",
                    "puppet://$server/files/sshd/authorized_keys/${fqdn}",
                    "puppet://$server/files/sshd/authorized_keys/default",
                    "puppet://$server/sshd/authorized_keys/${name}",
                    "puppet://$server/sshd/authorized_keys/${fqdn}",
                    "puppet://$server/sshd/authorized_keys/default" ],
        }
}