mirror of
https://github.com/saltstack-formulas/openssh-formula.git
synced 2026-09-25 03:51:53 +02:00
feat(semantic-release): implement for this formula
* Close #165 * Move existing `.kitchen.yml` => `kitchen.vagrant.yml` * Semi-automated using https://github.com/myii/ssf-formula/pull/30 * Fix errors shown below: ```bash openssh-formula$ yamllint -s . ./pillar.example 49:3 error duplication of key "AllowUsers" in mapping (key-duplicates) 57:3 error duplication of key "DenyUsers" in mapping (key-duplicates) 63:3 error duplication of key "AllowGroups" in mapping (key-duplicates) 70:3 error duplication of key "DenyGroups" in mapping (key-duplicates) 79:24 warning truthy value should be one of [false, true] (truthy) 80:29 warning truthy value should be one of [false, true] (truthy) 118:4 warning missing starting space in comment (comments) 119:4 warning missing starting space in comment (comments) 119:89 error line too long (122 > 88 characters) (line-length) 120:4 warning missing starting space in comment (comments) 120:89 error line too long (144 > 88 characters) (line-length) 147:30 warning truthy value should be one of [false, true] (truthy) 148:21 warning truthy value should be one of [false, true] (truthy) 149:19 warning truthy value should be one of [false, true] (truthy) 150:32 warning truthy value should be one of [false, true] (truthy) 151:26 warning truthy value should be one of [false, true] (truthy) 152:31 warning truthy value should be one of [false, true] (truthy) 153:32 warning truthy value should be one of [false, true] (truthy) 154:29 warning truthy value should be one of [false, true] (truthy) 155:34 warning truthy value should be one of [false, true] (truthy) 175:8 warning missing starting space in comment (comments) 175:89 error line too long (152 > 88 characters) (line-length) 176:8 warning missing starting space in comment (comments) 176:89 error line too long (126 > 88 characters) (line-length) 177:8 warning missing starting space in comment (comments) 177:89 error line too long (148 > 88 characters) (line-length) 213:18 warning truthy value should be one of [false, true] (truthy) 219:18 warning truthy value should be one of [false, true] (truthy) 225:18 warning truthy value should be one of [false, true] (truthy) 241:22 warning truthy value should be one of [false, true] (truthy) 243:22 warning truthy value should be one of [false, true] (truthy) 244:20 warning truthy value should be one of [false, true] (truthy) 245:21 warning truthy value should be one of [false, true] (truthy) 254:24 warning truthy value should be one of [false, true] (truthy) 255:22 warning truthy value should be one of [false, true] (truthy) 256:23 warning truthy value should be one of [false, true] (truthy) 265:22 warning truthy value should be one of [false, true] (truthy) 268:21 warning truthy value should be one of [false, true] (truthy) 269:20 warning truthy value should be one of [false, true] (truthy) 270:21 warning truthy value should be one of [false, true] (truthy) 279:26 warning truthy value should be one of [false, true] (truthy) 280:24 warning truthy value should be one of [false, true] (truthy) 281:25 warning truthy value should be one of [false, true] (truthy) 307:16 warning truthy value should be one of [false, true] (truthy) 308:6 warning missing starting space in comment (comments) 314:6 warning missing starting space in comment (comments) 316:24 warning truthy value should be one of [false, true] (truthy) 339:89 error line too long (546 > 88 characters) (line-length) 340:89 error line too long (546 > 88 characters) (line-length) 341:89 error line too long (546 > 88 characters) (line-length) 342:89 error line too long (546 > 88 characters) (line-length) 344:4 warning missing starting space in comment (comments) 345:4 warning missing starting space in comment (comments) 357:19 warning truthy value should be one of [false, true] (truthy) ./openssh/osfamilymap.yaml 1:1 warning missing document start "---" (document-start) ./openssh/osfingermap.yaml 1:1 warning missing document start "---" (document-start) ./openssh/osmap.yaml 1:1 warning missing document start "---" (document-start) ./openssh/defaults.yaml 1:1 warning missing document start "---" (document-start) 3:18 warning truthy value should be one of [false, true] (truthy) 6:34 warning too few spaces before comment (comments) 10:25 warning truthy value should be one of [false, true] (truthy) 12:32 warning too few spaces before comment (comments) 16:24 warning truthy value should be one of [false, true] (truthy) 18:24 warning too few spaces before comment (comments) 20:42 warning too few spaces before comment (comments) 27:6 warning missing starting space in comment (comments) ```
This commit is contained in:
Imran Iqbal
+264
@@ -0,0 +1,264 @@
|
||||
.. _readme:
|
||||
|
||||
openssh
|
||||
=======
|
||||
|img_travis| |img_sr|
|
||||
|
||||
.. |img_travis| image:: https://travis-ci.com/saltstack-formulas/openssh-formula.svg?branch=master
|
||||
:alt: Travis CI Build Status
|
||||
:scale: 100%
|
||||
:target: https://travis-ci.com/saltstack-formulas/openssh-formula
|
||||
.. |img_sr| image:: https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg
|
||||
:alt: Semantic Release
|
||||
:scale: 100%
|
||||
:target: https://github.com/semantic-release/semantic-release
|
||||
|
||||
Install and configure an openssh server.
|
||||
|
||||
.. contents:: **Table of Contents**
|
||||
|
||||
General notes
|
||||
-------------
|
||||
|
||||
See the full `SaltStack Formulas installation and usage instructions
|
||||
<https://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html>`_.
|
||||
|
||||
If you are interested in writing or contributing to formulas, please pay attention to the `Writing Formula Section
|
||||
<https://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html#writing-formulas>`_.
|
||||
|
||||
If you want to use this formula, please pay attention to the ``FORMULA`` file and/or ``git tag``,
|
||||
which contains the currently released version. This formula is versioned according to `Semantic Versioning <http://semver.org/>`_.
|
||||
|
||||
See `Formula Versioning Section <https://docs.saltstack.com/en/latest/topics/development/conventions/formulas.html#versioning>`_ for more details.
|
||||
|
||||
Contributing to this repo
|
||||
-------------------------
|
||||
|
||||
**Commit message formatting is significant!!**
|
||||
|
||||
Please see :ref:`How to contribute <CONTRIBUTING>` for more details.
|
||||
|
||||
Available states
|
||||
----------------
|
||||
|
||||
.. contents::
|
||||
:local:
|
||||
|
||||
``openssh``
|
||||
^^^^^^^^^^^
|
||||
|
||||
Installs the ``openssh`` server package and service.
|
||||
|
||||
``openssh.auth``
|
||||
^^^^^^^^^^^^^^^^
|
||||
|
||||
Manages SSH certificates for users.
|
||||
|
||||
``openssh.auth_map``
|
||||
^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Same functionality as openssh.auth but with a simplified Pillar syntax.
|
||||
Plays nicely with `Pillarstack
|
||||
<https://docs.saltstack.com/en/latest/ref/pillar/all/salt.pillar.stack.html>`_.
|
||||
|
||||
``openssh.banner``
|
||||
^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Installs a banner that users see when SSH-ing in.
|
||||
|
||||
``openssh.client``
|
||||
^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Installs the openssh client package.
|
||||
|
||||
``openssh.config``
|
||||
^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Installs the ssh daemon configuration file included in this formula
|
||||
(under "openssh/files"). This configuration file is populated
|
||||
by values from pillar. ``pillar.example`` results in the generation
|
||||
of the default ``sshd_config`` file on Debian Wheezy.
|
||||
|
||||
It is highly recommended ``PermitRootLogin`` is added to pillar
|
||||
so root login will be disabled.
|
||||
|
||||
``openssh.config_ini``
|
||||
^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Version of managing ``sshd_config`` that uses the
|
||||
`ini_managed.option_present <https://docs.saltstack.com/en/latest/ref/states/all/salt.states.ini_manage.html>`_
|
||||
state module, so it enables to override only one or
|
||||
multiple values and keeping the defaults shipped by your
|
||||
distribution.
|
||||
|
||||
|
||||
``openssh.known_hosts``
|
||||
^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Manages ``/etc/ssh/ssh_known_hosts`` and fills it with the
|
||||
public SSH host keys of your minions (collected via the Salt mine)
|
||||
and of hosts listed in you pillar data. It's possible to include
|
||||
minions managed via ``salt-ssh`` by using the ``known_hosts_salt_ssh`` renderer.
|
||||
|
||||
You can restrict the set of minions
|
||||
whose keys are listed by using the pillar data ``openssh:known_hosts:target``
|
||||
and ``openssh:known_hosts:tgt_type`` (those fields map directly to the
|
||||
corresponding attributes of the ``mine.get`` function).
|
||||
|
||||
The **Salt mine** is used to share the public SSH host keys, you must thus
|
||||
configure it accordingly on all hosts that must export their keys. Two
|
||||
mine functions are required, one that exports the keys (one key per line,
|
||||
as they are stored in ``/etc/ssh/ssh_host_*_key.pub``) and one that defines
|
||||
the public hostname that the keys are associated to. Here's the way to
|
||||
setup those functions through pillar::
|
||||
|
||||
# Required for openssh.known_hosts
|
||||
mine_functions:
|
||||
public_ssh_host_keys:
|
||||
mine_function: cmd.run
|
||||
cmd: cat /etc/ssh/ssh_host_*_key.pub
|
||||
python_shell: True
|
||||
public_ssh_hostname:
|
||||
mine_function: grains.get
|
||||
key: id
|
||||
|
||||
The above example assumes that the minion identifier is a valid DNS name
|
||||
that can be used to connect to the host. If that's not the case, you might
|
||||
want to use the ``fqdn`` grain instead of the ``id`` one. The above example
|
||||
also uses the default mine function names used by this formula. If you have to
|
||||
use other names, then you should indicate the names to use in pillar keys
|
||||
``openssh:known_hosts:mine_keys_function`` and
|
||||
``openssh:known_hosts:mine_hostname_function``.
|
||||
|
||||
You can also integrate alternate DNS names of the various hosts in
|
||||
``/etc/ssh/ssh_known_hosts``. You just have to specify all the alternate DNS names as a
|
||||
list in the ``openssh:known_hosts:aliases`` pillar key. Whenever the IPv4 or
|
||||
IPv6 behind one of those DNS entries matches an IPv4 or IPv6 behind the
|
||||
official hostname of a minion, the alternate DNS name will be associated to the
|
||||
minion's public SSH host key.
|
||||
|
||||
To **include minions managed via salt-ssh** install the ``known_hosts_salt_ssh`` renderer::
|
||||
|
||||
# in pillar.top:
|
||||
'*':
|
||||
- openssh.known_hosts_salt_ssh
|
||||
|
||||
# In your salt/ directory:
|
||||
# Link the pillar file:
|
||||
mkdir pillar/openssh
|
||||
ln -s ../../formulas/openssh-formula/_pillar/known_hosts_salt_ssh.sls pillar/openssh/known_hosts_salt_ssh.sls
|
||||
|
||||
You'll find the cached pubkeys in Pillar ``openssh:known_hosts:salt_ssh``.
|
||||
|
||||
It's possible to define aliases for certain hosts::
|
||||
|
||||
openssh:
|
||||
known_hosts:
|
||||
cache:
|
||||
public_ssh_host_names:
|
||||
minion.id:
|
||||
- minion.id
|
||||
- alias.of.minion.id
|
||||
|
||||
The cache is populated by applying ``openssh.gather_host_keys``
|
||||
to the salt master::
|
||||
|
||||
salt 'salt-master.example.test' state.apply openssh.gather_host_keys
|
||||
|
||||
The state tries to fetch the SSH host keys via ``salt-ssh``. It calls the command as user
|
||||
``salt-master`` by default. The username can be changed via Pillar::
|
||||
|
||||
openssh:
|
||||
known_hosts:
|
||||
cache:
|
||||
user: salt-master
|
||||
|
||||
Use a cronjob to populate a host key cache::
|
||||
|
||||
# crontab -e -u salt-master
|
||||
0 1 * * * salt 'salt-master.example.test' state.apply openssh.gather_host_keys
|
||||
|
||||
If you must have the latest pubkeys, run the state before all others::
|
||||
|
||||
# states/top.sls:
|
||||
base:
|
||||
salt:
|
||||
# slooooow!
|
||||
- openssh.gather_host_keys
|
||||
|
||||
You can also use a "golden" known hosts file. It overrides the keys fetched by the cronjob.
|
||||
This lets you re-use the trust estabished in the salt-ssh user's known_hosts file::
|
||||
|
||||
# In your salt/ directory: (Pillar expects the file here.)
|
||||
ln -s /home/salt-master/.ssh/known_hosts ./known_hosts
|
||||
|
||||
# Test it:
|
||||
salt-ssh 'minion' pillar.get 'openssh:known_hosts:salt_ssh'
|
||||
|
||||
To add **public keys of hosts not among your minions** list them under the
|
||||
pillar key ``openssh:known_hosts:static``::
|
||||
|
||||
openssh:
|
||||
known_hosts:
|
||||
static:
|
||||
github.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq[...]'
|
||||
gitlab.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABA[...]'
|
||||
|
||||
Pillar ``openssh:known_hosts:static`` overrides ``openssh:known_hosts:salt_ssh``.
|
||||
|
||||
To **include localhost** and local IP addresses (``127.0.0.1`` and ``::1``) use this Pillar::
|
||||
|
||||
openssh:
|
||||
known_hosts:
|
||||
include_localhost: True
|
||||
|
||||
``openssh.moduli``
|
||||
^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Manages the system wide ``/etc/ssh/moduli`` file.
|
||||
|
||||
Testing
|
||||
-------
|
||||
|
||||
Linux testing is done with ``kitchen-salt``.
|
||||
|
||||
Requirements
|
||||
^^^^^^^^^^^^
|
||||
|
||||
* Ruby
|
||||
* Docker
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
$ gem install bundler
|
||||
$ bundle install
|
||||
$ bin/kitchen test [platform]
|
||||
|
||||
Where ``[platform]`` is the platform name defined in ``kitchen.yml``,
|
||||
e.g. ``debian-9-2019-2-py3``.
|
||||
|
||||
``bin/kitchen converge``
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Creates the docker instance and runs the ``template`` main state, ready for testing.
|
||||
|
||||
``bin/kitchen verify``
|
||||
^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Runs the ``inspec`` tests on the actual instance.
|
||||
|
||||
``bin/kitchen destroy``
|
||||
^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Removes the docker instance.
|
||||
|
||||
``bin/kitchen test``
|
||||
^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Runs all of the stages above in one go: i.e. ``destroy`` + ``converge`` + ``verify`` + ``destroy``.
|
||||
|
||||
``bin/kitchen login``
|
||||
^^^^^^^^^^^^^^^^^^^^^
|
||||
|
||||
Gives you SSH access to the instance for manual testing.
|
||||
|
||||
Reference in New Issue
Block a user