Add a new openssh.known_hosts state

This state manages /etc/ssh/ssh_known_hosts and fills it with
public SSH host keys of other minions.

openssh/files/ssh_known_hosts

@@ -0,0 +1,34 @@
+{%- set target = salt['pillar.get']('openssh:known_hosts:target', '*') -%}
+{%- set expr_form = salt['pillar.get']('openssh:known_hosts:expr_form', 'glob') -%}
+{%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%}
+{%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%}
+{#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name
+    in the SSH known_hosts entry -#}
+{%- set aliases = salt['pillar.get']('openssh:known_hosts:aliases', []) -%}
+{%- set aliases_ips = {} -%}
+{%- for alias in aliases -%}
+  {%- for ip in salt['dig.A'](alias) + salt['dig.AAAA'](alias) -%}
+    {%- do aliases_ips.setdefault(ip, []).append(alias) -%}
+  {%- endfor -%}
+{%- endfor -%}
+{#- Loop over targetted minions -#}
+{%- set host_keys = salt['mine.get'](target, keys_function, expr_form=expr_form) -%}
+{%- set host_names = salt['mine.get'](target, hostname_function, expr_form=expr_form) -%}
+{%- for host, keys in host_keys|dictsort -%}
+  {%- set ip4 = salt['dig.A'](host) -%}
+  {%- set ip6 = salt['dig.AAAA'](host) -%}
+  {%- set names = [host_names.get(host, host)] -%}
+  {%- for ip in ip4 + ip6 -%}
+    {%- do names.append(ip) -%}
+    {%- for alias in aliases_ips.get(ip, []) -%}
+      {%- if alias not in names -%}
+        {%- do names.append(alias) -%}
+      {%- endif -%}
+    {%- endfor -%}
+  {%- endfor -%}
+  {%- for line in keys.split('\n') -%}
+  {%- if line -%}
+{{ ','.join(names) }} {{ line }}
+{% endif -%}
+  {%- endfor -%}
+{%- endfor -%}

openssh/known_hosts.sls

@@ -0,0 +1,16 @@
+{% from "openssh/map.jinja" import openssh with context %}
+
+ensure dig is available:
+  pkg.installed:
+    - name: {{ openssh.dig_pkg }}
+
+manage ssh_known_hosts file:
+  file.managed:
+    - name: {{ openssh.ssh_known_hosts }}
+    - source: salt://openssh/files/ssh_known_hosts
+    - template: jinja
+    - user: root
+    - group: root
+    - mode: 644
+    - require:
+      - pkg: ensure dig is available

openssh/map.jinja

@@ -7,6 +7,8 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'dnsutils',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     },
     'Debian': {
         'server': 'openssh-server',
@@ -16,6 +18,8 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'dnsutils',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     },
     'FreeBSD': {
         'service': 'sshd',
@@ -23,6 +27,8 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'bind-tools',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     },
     'Gentoo': {
         'server': 'net-misc/openssh',
@@ -32,6 +38,8 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'net-dns/bind-tools',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     },
     'RedHat': {
         'server': 'openssh-server',
@@ -41,6 +49,8 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'bind-utils',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     },
     'Suse': {
         'server': 'openssh',
@@ -50,5 +60,7 @@
         'sshd_config_src': 'salt://openssh/files/sshd_config',
         'banner': '/etc/ssh/banner',
         'banner_src': 'salt://openssh/files/banner',
+        'dig_pkg': 'bind-utils',
+        'ssh_known_hosts': '/etc/ssh/ssh_known_hosts',
     }, 
 }, merge=salt['pillar.get']('openssh:lookup')) %}