diff --git a/openssh/files/ssh_known_hosts b/openssh/files/ssh_known_hosts index f3e2a87..ff448bd 100644 --- a/openssh/files/ssh_known_hosts +++ b/openssh/files/ssh_known_hosts @@ -13,6 +13,18 @@ {#- If there are none, the host is used directly. #} {%- set names = [host_names.get(host, host)] -%} +{#- Extract the hostname from the FQDN and add it to the names. #} +{%- if use_hostnames is iterable -%} +{%- for name in names | sort -%} +{%- if salt["match.{}".format(hostnames_expr_form)](hostnames_target, minion_id=name) -%} +{%- set hostname = name.split('.')|first -%} +{%- if hostname not in names -%} +{%- do names.append(hostname) -%} +{%- endif -%} +{%- endif -%} +{%- endfor -%} +{%- endif -%} + {#- Append IP addresses and aliases (if they are not already present) #} {%- for ip in (ip4 + ip6)|sort -%} {%- do names.append(ip) -%} @@ -36,6 +48,10 @@ {%- set expr_form = salt['pillar.get']('openssh:known_hosts:expr_form', 'glob') -%} {%- set keys_function = salt['pillar.get']('openssh:known_hosts:mine_keys_function', 'public_ssh_host_keys') -%} {%- set hostname_function = salt['pillar.get']('openssh:known_hosts:mine_hostname_function', 'public_ssh_hostname') -%} +{%- set use_hostnames = salt['pillar.get']('openssh:known_hosts:hostnames', False) -%} +{%- set hostnames_target_default = '*' if grains['domain'] == '' else "*.{}".format(grains['domain']) -%} +{%- set hostnames_target = salt['pillar.get']('openssh:known_hosts:hostnames:target', hostnames_target_default) -%} +{%- set hostnames_expr_form = salt['pillar.get']('openssh:known_hosts:hostnames:expr_form', 'glob') -%} {#- Lookup IP of all aliases so that when we have a matching IP, we inject the alias name in the SSH known_hosts entry -#} diff --git a/pillar.example b/pillar.example index c295bb1..a1c6de7 100644 --- a/pillar.example +++ b/pillar.example @@ -277,6 +277,17 @@ openssh: aliases: - cname-to-minion.example.org - alias.example.org + # Includes short hostnames derived from the FQDN + # (host.example.test -> host) + # (Deactivated by default, because there can be collisions!) + hostnames: False + #hostnames: + # Restrict wich hosts you want to use via their hostname + # (i.e. ssh user@host instead of ssh user@host.example.com) + # target: '*' # Defaults to "*.{}".format(grains['domain']) with a fallback to '*' + # expr_form: 'glob' + # To activate the defaults you can just set an empty dict. + #hostnames: {} # specify DH parameters (see /etc/ssh/moduli) moduli: |