diff --git a/openssh/config.sls b/openssh/config.sls index 857eecd..3cf3376 100644 --- a/openssh/config.sls +++ b/openssh/config.sls @@ -13,42 +13,24 @@ sshd_config: - watch_in: - service: openssh -{% if salt['pillar.get']('openssh:provide_dsa_keys', False) %} -ssh_host_dsa_key: +{% for keyType in ['ecdsa', 'dsa', 'rsa'] %} +{% if salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %} +ssh_host_{{ keyType }}_key: file.managed: - - name: /etc/ssh/ssh_host_dsa_key - - contents_pillar: 'openssh:dsa:private_key' + - name: /etc/ssh/ssh_host_{{ keyType }}_key + - contents_pillar: 'openssh:{{ keyType }}:private_key' - user: root - mode: 600 - require_in: - service: {{ openssh.service }} -ssh_host_dsa_key.pub: +ssh_host_{{ keyType }}_key.pub: file.managed: - - name: /etc/ssh/ssh_host_dsa_key.pub - - contents_pillar: 'openssh:dsa:public_key' - - user: root - - mode: 600 - - require_in: - - service: {{ openssh.service }} -{% endif %} - -{% if salt['pillar.get']('openssh:provide_rsa_keys', False) %} -ssh_host_rsa_key: - file.managed: - - name: /etc/ssh/ssh_host_rsa_key - - contents_pillar: 'openssh:rsa:private_key' - - user: root - - mode: 600 - - require_in: - - service: {{ openssh.service }} - -ssh_host_rsa_key.pub: - file.managed: - - name: /etc/ssh/ssh_host_rsa_key.pub - - contents_pillar: 'openssh:rsa:public_key' + - name: /etc/ssh/ssh_host_{{ keyType }}_key.pub + - contents_pillar: 'openssh:{{ keyType }}:public_key' - user: root - mode: 600 - require_in: - service: {{ openssh.service }} {% endif %} +{% endfor %} \ No newline at end of file diff --git a/pillar.example b/pillar.example index 4edbbd3..678e2f3 100644 --- a/pillar.example +++ b/pillar.example @@ -49,7 +49,15 @@ openssh: -----END DSA PRIVATE KEY----- public_key: | ssh-dss NOT_DEFINED + ecdsa: + private_key: | + -----BEGIN EC PRIVATE KEY----- + NOT_DEFINED + -----END EC PRIVATE KEY----- + public_key: | + ecdsa-sha2-nistp256 NOT_DEFINED provide_dsa_keys: False + provide_ecdsa_keys: False provide_rsa_keys: False rsa: private_key: |