Salt/openssh-formula
0
0
Fork 0
mirror of https://github.com/saltstack-formulas/openssh-formula.git synced 2024-11-27 20:57:48 +01:00
Code Issues Activity
d6e48f2b43
openssh-formula/pillar.example

213 lines
8.2 KiB
Plaintext
Raw Normal View History

Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
sshd_config:
Update pillar.example `pillar.example` now contains information on how to use the 'string-or-list' feature for some options. Also an explanation on the new `ConfigBanner` option.
2017-01-23 19:43:04 +01:00
# This keyword is totally optional
ConfigBanner: |
# Alternative banner for the config file
# (Indented) hash signs lose their special meaning here
# and the lines will be written as-is.
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
Port: 22
Protocol: 2
HostKey:
- /etc/ssh/ssh_host_rsa_key
- /etc/ssh/ssh_host_dsa_key
- /etc/ssh/ssh_host_ecdsa_key
add ed25519 host key type; add AuthenticationMethods option
2015-01-16 18:21:10 +01:00
- /etc/ssh/ssh_host_ed25519_key
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
UsePrivilegeSeparation: 'yes'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
KeyRegenerationInterval: 3600
rebase based on latest update
2017-02-07 19:45:59 +01:00
ServerKeyBits: 1024
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
SyslogFacility: AUTH
LogLevel: INFO
Implement Session idle time out
2016-05-25 00:06:45 +02:00
ClientAliveInterval: 0
ClientAliveCountMax: 3
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
LoginGraceTime: 120
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
PermitRootLogin: 'yes'
PasswordAuthentication: 'no'
StrictModes: 'yes'
add more authentication options
2016-05-26 21:57:02 +02:00
MaxAuthTries: 6
MaxSessions: 10
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
RSAAuthentication: 'yes'
PubkeyAuthentication: 'yes'
Add AuthorizedKeysCommand to pillar.example Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
2016-10-02 10:37:11 +02:00
AuthorizedKeysCommand: '/usr/bin/sss_ssh_authorizedkeys'
AuthorizedKeysCommandUser: 'nobody'
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
IgnoreRhosts: 'yes'
RhostsRSAAuthentication: 'no'
HostbasedAuthentication: 'no'
PermitEmptyPasswords: 'no'
ChallengeResponseAuthentication: 'no'
added the missing ":" and delete the redundant lines
2015-05-28 07:36:11 +02:00
AuthenticationMethods: 'publickey,keyboard-interactive'
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile) Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-17 11:09:37 +01:00
AuthorizedKeysFile: '%h/.ssh/authorized_keys'
rebase based on latest update
2017-02-07 19:45:59 +01:00
X11Forwarding: 'no'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
X11DisplayOffset: 10
rebase based on latest update
2017-02-07 19:45:59 +01:00
PrintMotd: 'yes'
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
PrintLastLog: 'yes'
TCPKeepAlive: 'yes'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
AcceptEnv: "LANG LC_*"
Subsystem: "sftp /usr/lib/openssh/sftp-server"
Explicitly defined options as strings. This fixes an issue where PyYAML was converting yes and no into True and False in the generated sshd_config file.
2014-04-27 20:52:58 +02:00
UsePAM: 'yes'
Add a UseDNS option to pillar.example
2014-07-22 07:37:41 +02:00
UseDNS: 'yes'
Added AllowUsers,AllowGroups,DenyUsers,DenyGroups This will add more options to set to secure openssh - AllowUsers - AllowGroups - DenyUsers - DenyGroups
2015-01-16 22:56:59 +01:00
AllowUsers: 'vader@10.0.0.1 maul@evil.com sidious luke'
add DenyUsers and DenyGroups example
2015-01-17 20:04:03 +01:00
DenyUsers: 'yoda chewbaca@112.10.21.1'
AllowGroups: 'wheel staff imperial'
DenyGroups: 'rebel'
add pillar example
2014-09-19 18:42:17 +02:00
matches:
sftp_chroot:
type:
Group: sftpusers
options:
ChrootDirectory: /sftp-chroot/%u
X11Forwarding: no
AllowTcpForwarding: no
ForceCommand: internal-sftp
adds support to harden sshd_config (KeyExchange, Ciphers, MACs)
2015-06-30 14:33:57 +02:00
# Check `man sshd_config` for supported KexAlgorithms, Ciphers and MACs first.
rebase based on latest update
2017-02-07 19:45:59 +01:00
# You can specify KexAlgorithms, Ciphers and MACs as both key or a list.
# The configuration given in the example below is based on:
# https://stribika.github.io/2015/01/04/secure-secure-shell.html
#KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'
#Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
#MACs: 'hmac-sha1'
Update pillar.example `pillar.example` now contains information on how to use the 'string-or-list' feature for some options. Also an explanation on the new `ConfigBanner` option.
2017-01-23 19:43:04 +01:00
KexAlgorithms:
rebase based on latest update
2017-02-07 19:45:59 +01:00
- 'curve25519-sha256@libssh.org'
- 'diffie-hellman-group-exchange-sha256'
- 'diffie-hellman-group-exchange-sha1'
- 'diffie-hellman-group14-sha1'
Ciphers:
- 'chacha20-poly1305@openssh.com'
- 'aes256-gcm@openssh.com'
- 'aes128-gcm@openssh.com'
- 'aes256-ctr'
- 'aes192-ctr'
- 'aes128-ctr'
MACs:
- 'hmac-sha1'
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
Added configuration options for ssh_config Made a small change to reflect the default sshd_config
2015-10-01 17:21:16 +02:00
ssh_config:
StrictHostKeyChecking: no
ForwardAgent: no
ForwardX11: no
RhostsRSAAuthentication: no
RSAAuthentication: yes
PasswordAuthentication: yes
HostbasedAuthentication: no
GSSAPIAuthentication: no
GSSAPIDelegateCredentials: no
BatchMode: 'yes'
CheckHostIP: 'yes'
AddressFamily: 'any'
ConnectTimeout: 0
IdentityFile: '~/.ssh/id_rsa'
Port: 22
Protocol: 2
Cipher: '3des'
Tunnel: 'no'
TunnelDevice: 'any:any'
PermitLocalCommand: 'no'
VisualHostKey: 'no'
Reverted the namespace change to avoid conflicts and backward incompatibilities
2014-02-09 23:42:52 +01:00
openssh:
Add ability to control SSH server status (default: on)
2015-12-27 18:17:01 +01:00
# Controls if SSHD should be enabled/started
sshd_enable: true
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
auth:
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
joe-valid-ssh-key-desktop:
- user: joe
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
present: True
enc: ssh-rsa
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
comment: main key - desktop
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile) Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-17 11:09:37 +01:00
source: salt://ssh_keys/joe.desktop.pub
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
joe-valid-ssh-key-notebook:
- user: joe
present: True
enc: ssh-rsa
comment: main key - notebook
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile) Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-17 11:09:37 +01:00
source: salt://ssh_keys/joe.netbook.pub
Update pillar.example with two valid ssh-keys
2015-01-28 23:00:47 +01:00
joe-non-valid-ssh-key:
- user: joe
Added support to manage ssh certificates
2014-02-09 23:38:30 +01:00
present: False
enc: ssh-rsa
comment: obsolete key - removed
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile) Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-17 11:09:37 +01:00
source: salt://ssh_keys/joe.no-valid.pub
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
generate_dsa_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_dsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_dsa_keys: False
Modifying OpenSSH formula state to populate public/private DSA and RSA keys based on pillar data
2014-01-03 05:34:48 +01:00
dsa:
private_key: |
-----BEGIN DSA PRIVATE KEY-----
NOT_DEFINED
-----END DSA PRIVATE KEY-----
public_key: |
ssh-dss NOT_DEFINED
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
generate_ecdsa_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_ecdsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_ecdsa_keys: False
Update pillar.example
2014-08-24 13:18:37 +02:00
ecdsa:
private_key: |
-----BEGIN EC PRIVATE KEY-----
NOT_DEFINED
-----END EC PRIVATE KEY-----
public_key: |
ecdsa-sha2-nistp256 NOT_DEFINED
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
Update pillar example
2014-08-24 17:44:33 +02:00
generate_rsa_keys: False
add options to give a key size to generate_key
2015-07-12 18:09:26 +02:00
generate_rsa_size: 4096
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_rsa_keys: False
Cleanups for host key pillar example
2014-12-15 07:00:45 +01:00
provide_rsa_keys: False
Modifying OpenSSH formula state to populate public/private DSA and RSA keys based on pillar data
2014-01-03 05:34:48 +01:00
rsa:
private_key: |
-----BEGIN RSA PRIVATE KEY-----
NOT_DEFINED
-----END RSA PRIVATE KEY-----
public_key: |
ssh-rsa NOT_DEFINED
Add support for ED25519 host keys
2014-12-15 07:00:17 +01:00
generate_ed25519_keys: False
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
absent_ed25519_keys: False
Add support for ED25519 host keys
2014-12-15 07:00:17 +01:00
provide_ed25519_keys: False
ed25519:
private_key: |
-----BEGIN OPENSSH PRIVATE KEY-----
NOT_DEFINED
-----END OPENSSH PRIVATE KEY-----
public_key: |
ssh-ed25519 NOT_DEFINED
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
known_hosts:
# The next 2 settings restrict the set of minions that will be added in
# the generated ssh_known_hosts files (the default is to match all minions)
target: '*'
expr_form: 'glob'
# Name of mining functions used to gather public keys and hostnames
# (the default values are shown here)
mine_keys_function: public_ssh_host_keys
mine_hostname_function: public_ssh_hostname
# List of DNS entries also pointing to our managed machines and that we want
# to inject in our generated ssh_known_hosts file
aliases:
- cname-to-minion.example.org
- alias.example.org
Give information on using moduli_source Give additional comments to inform that moduli can also be provided via a file, using the moduli_source key.
2016-08-01 19:03:14 +02:00
# specify DH parameters (see /etc/ssh/moduli)
Adds support to customize /etc/ssh/moduli file
2015-07-01 22:42:48 +02:00
moduli: |
# Time Type Tests Tries Size Generator Modulus
20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
Give information on using moduli_source Give additional comments to inform that moduli can also be provided via a file, using the moduli_source key.
2016-08-01 19:03:14 +02:00
# ALTERNATIVELY, specify the location of the moduli file. Examples:
#moduli_source: http://some.server.somewhere/salt/moduli
#moduli_source: salt://files/ssh/moduli
# If moduli is specified, moduli_source will be ignored.
# Also, a proper hash file *must* be included in the same path. E.g.:
# http://some.server.somewhere/salt/moduli.hash
# salt://files/ssh/moduli.hash
# These will be automatically referenced to by the ssh_moduli state.
Adds support to customize /etc/ssh/moduli file
2015-07-01 22:42:48 +02:00
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
# Required for openssh.known_hosts
mine_functions:
public_ssh_host_keys:
mine_function: cmd.run
cmd: cat /etc/ssh/ssh_host_*_key.pub
Fix mine_function example in pillar.example This fixes #34, salt version 2015.5.x needs an extra argument for shell routines.
2015-05-28 23:00:27 +02:00
python_shell: True
Add a new openssh.known_hosts state This state manages /etc/ssh/ssh_known_hosts and fills it with public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
public_ssh_hostname:
mine_function: grains.get
key: id
Reference in New Issue Copy Permalink