ffafd2a2f5
Support package versions ( #134 )
...
added possibility to configure server version and client version
with pillar example
2018-09-03 16:42:39 +02:00
63ad14efb1
Fix invalid require_in sshd_config for key states
...
Change the require_ins used by the key management states in the
config.sls to be conditional based on whether the sshd_config
is managed by the formula
Fixes #130
2018-08-03 08:35:42 -04:00
aa3da8f2c2
Pillar openssh.known_hosts_salt_ssh ( #128 )
...
* Pillar openssh.known_hosts_salt_ssh
* Dropped ill-named file
* Fixed aliasing of host names
* Improved pillar.example
* Opt-in to include localhost
* pillar/known_hosts_salt_ssh: clear cache in run()
* Dropped forgotten debugging output
2018-06-01 14:11:52 +02:00
45763f54aa
Add host keys from pillar[openssh:known_hosts:static] to `ssh_known_hosts`
2018-04-26 16:56:18 +02:00
6fbef86827
Add sftp subsystem debian ( #3 )
...
* Add map for debian
2018-04-25 17:48:47 -03:00
b93448b5e6
Merge pull request #124 from arthurlogilab/123-add-ini-version-of-config
...
[openssh/config_ini] initial version of config_ini which uses ini state
2018-03-17 21:35:30 +01:00
af9721a0f5
fix iteritems for python3
2018-03-10 16:35:57 +01:00
6ccb9fc87d
Replace deprecated "user" attribute by "runas"
2018-02-16 12:11:54 +01:00
dcb70e5181
[openssh/config_ini] initial version of config_ini which uses ini state
...
closes #123
2018-02-15 17:43:13 +01:00
73727bc218
Merge pull request #118 from Perceptyx/master
...
[FIX] When key is present override generating by any way
2017-12-29 04:02:08 +01:00
e665450ed4
Changed expr_form to tgt_type for deprecation reasons. ( #122 )
2017-12-23 00:11:24 +01:00
5e3368afcb
drop default values ( fixes #102 ) ( #117 )
...
* drop default values (fixes #102 )
* hmac-ripemd160 was dropped in 7.6
2017-10-23 20:18:11 +02:00
26f2fc8e97
[FIX] When key is present override generating by any way
2017-10-15 17:55:44 -03:00
9cdb9aaba0
improve allow_deny_users_groups
2017-08-21 23:35:04 +02:00
178692f92e
Merge pull request #113 from brianholland99/master
...
Add ConfigBanner to processed_options when handled.
2017-08-18 05:03:30 +02:00
d157c0a36e
Merge pull request #111 from saltstack-formulas/hostnames-in-known-hosts
...
Hostnames in known hosts
2017-08-16 14:29:25 +02:00
6400516c5e
Add ConfigBanner to processed_options when handled.
...
This prevents a verbatim version being added to end of file that will
cause the parsing to fail.
2017-08-15 23:08:23 -04:00
83e60fd840
Fixed supporting multiline banner_string defined in the pillar.
2017-08-10 15:45:05 +02:00
e523ae5281
Optionally add hostnames to known_hosts
2017-08-08 07:51:38 +02:00
75e582a7bc
New macro: known_hosts_entry; added comments
2017-08-08 07:16:23 +02:00
f4cf9aa22b
CentOS 6: UsePrivilegeSeparation 'yes' ( fixes #108 )
2017-08-01 14:50:08 +02:00
a5f4a56956
UsePrivilegeSeparation 'sandbox'
...
This is was introduced in 5.9, and is default in 6.1.
https://www.openssh.com/txt/release-5.9
https://www.openssh.com/txt/release-6.1
2017-08-01 00:02:03 +02:00
7afea021c6
Fixed key generation
...
- generate before running check_mk on the sshd_config
- set permissions on private key
- cope with empty keys
2017-07-31 23:35:18 +02:00
c7a97ae72f
Create needed directory for UsePrivilegeSeparation option
2017-07-28 10:17:16 -03:00
500c915c33
Allow to config banner in pillar
2017-07-27 19:55:34 -03:00
467c5e56fc
Remove extra whitespace
2017-07-27 19:06:27 -03:00
c71f2ae4fa
minor fix: use keyFile in config.sls
2017-07-04 22:47:02 +02:00
e44d8860f4
Sort Match options
2017-07-04 22:30:49 +02:00
f810b27211
Merge branch 'prioritized-compound-match-2' of git://github.com/mikemol/openssh-formula
2017-07-04 21:58:05 +02:00
add969822c
add optional `{{source}} to sshd_config
2017-07-04 21:38:21 +02:00
8594cd90ba
add optional `{{source}} to ssh_config
2017-07-04 21:38:21 +02:00
6229a6d122
Stabily sort matches
...
OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,
We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.
Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.
2017-06-12 12:08:26 -04:00
710175799b
Support compound matches
...
Support complex compound matches in Match criteria. For example, be able
to match against multiple Users for a given Match, or be able to match
against address ranges. Or Groups. Or any combination thereof.
Support for matching users can take one of several different appearances
in pillar data:
sshd_config:
matches:
match_1:
type:
User: one_user
options:
ChrootDirectory: /ex/%u
match_2:
type:
User:
- jim
- bob
- sally
options:
ChrootDirectory: /ex/%u
match_3:
type:
User:
jim: ~
bob: ~
sally: ~
options:
ChrootDirectory: /ex/%u
Note the syntax of match_3. By using empty dicts for each user, we can
leverage Salt's pillar mergine. If we use simple lists, we cannot do
this; Salt can't merge simple lists, because it doesn't know what order
they ought to be in.
2017-06-12 11:43:46 -04:00
345e07c85e
Support Match prioritization
...
OpenSSH's Match declarations are applied first-match-wins. However, we
can't safely define two Matches that might overlap unless we first sort
the keys, as Python (and Jinja) dicts don't guarantee the order of
dict keys,
We also won't scramble the match sequence every time the user adds,
removes or renames a match, and so we give the user clearer, more
concise diffs as when they apply changes.
Finally, we leave a comment on the Match line identifying where the
Match rule came from, to assist in troubleshooting.
2017-06-09 15:51:13 -04:00
1284109335
PrintLastLog missing in FreeBSD 11.0
...
The fix introduced in 678cc9066c
2017-06-04 10:33:14 -06:00
162705c7ce
Test config before applying it
2017-05-17 13:00:06 +02:00
844e96b57b
Merge pull request #88 from alxwr/force_key_length
...
Opt-in to enforce RSA key length
2017-03-07 20:24:34 +01:00
6b23b28f52
Opt-in to enforce RSA key length
2017-03-04 14:21:58 +01:00
674216d0ad
openssh.auth_map
2017-03-04 14:21:53 +01:00
66c954ed66
Set correct ssh(d)_config_group for *BSD
2017-03-04 14:20:07 +01:00
6d6c7a0ead
Merge branch 'master' into file-mode
2017-02-25 06:40:30 -07:00
044d4d646b
Merge pull request #81 from leansalt/pillar-example-update
...
Add secure defaults to pillar.example + secure sshd_config in defaults.yml #66
2017-02-25 12:30:37 +01:00
038a51cdc8
manage sshd_config and ssh_config only if pillars are defined
2017-02-24 21:13:52 +01:00
c03e29a498
remove Kex,MACs,Ciphers from defaults
2017-02-24 21:13:35 +01:00
613bea2cac
Add variables for file owner and mode
2017-02-23 14:56:22 -07:00
70461403cb
known_hosts: sort IP addresses
...
in order to prevent unnecessary changes due to
random ordering of dig results.
2017-02-23 03:59:40 +01:00
678cc9066c
PrintLastLog missing in FreeBSD 10.3
2017-02-23 01:19:21 +01:00
f5a74f3fa0
defaults: enable secure defaults on sshd_config
2017-02-19 14:45:12 +01:00
2db9253c45
Merge pull request #82 from pepoluan/allow_list_or_string
...
Allow list or string for some option, and setting of ConfigBanner
2017-02-07 07:26:44 -03:00
f4ea96f9c1
setup sftp correctly on RedHat-like machines
2017-01-24 18:17:15 -05:00
773d9ae092
Apply string-or-list processing to ssh_config
...
Now ssh_config also accepts string-or-list options, for serveral
keywords.
2017-01-24 01:34:24 +07:00
30648d115e
Add macro to handle string or list
...
Added a macro to handle multivalue options entered in either string
format or list format (with auto joiner).
2017-01-24 01:17:51 +07:00
b9689cedff
Merge pull request #79 from leansalt/server-service-control
...
Add ability to control SSH server service status (default: on)
2017-01-15 21:48:04 -08:00
686fc2c4ee
do not set UsePAM on OpenBSD
...
Upstream opensshd does not support PAM
2017-01-14 18:38:37 -05:00
1b69ecab2c
fix issue with stripping new line will result in invalid SLS definition if AuthorizedKeysFile is missing in sshd_config
2016-11-02 15:21:50 +01:00
2a1b8fbc66
fix issue sshd won't start if AddressFamily is specified, because it must be defined before ListenAddress
2016-11-01 13:24:30 +01:00
ec663a6f5e
Merge pull request #51 from mathieupotier/master
...
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile)
2016-10-31 09:32:50 -07:00
51fd8b1391
fix Subsystem directive on archlinux
2016-10-30 00:06:02 -04:00
de66dbee97
Update name of package containing dig on ArchLinux
2016-10-14 22:25:56 +00:00
02b52fa7cf
Add AuthorizedKeysCommand support
...
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
2016-10-01 20:53:44 +02:00
760a2ad277
fix the path to authkeys
...
Allow user to specify aliased path (with %u)
2016-08-02 09:54:46 +02:00
4c814843f8
Merge remote-tracking branch 'refs/remotes/saltstack-formulas/master'
2016-08-02 09:46:08 +02:00
e6603ae62a
Allow moduli to be pulled as file
...
Added Jinja logic to allow the option to pull the moduli from an online source.
2016-08-01 23:59:11 +07:00
781be61881
Convert dig exist check to unless req
2016-07-19 13:23:48 -07:00
87057c7c6b
Correct openssh-clients package name for Red Hat
2016-07-01 23:53:00 -06:00
641851632f
add more authentication options
2016-05-26 21:57:02 +02:00
3542a1f534
Implement Session idle time out
2016-05-25 00:06:45 +02:00
22037f7b8b
Merge pull request #63 from llua/arch_bind_utils
...
set dig_pkg on arch linux for issue #59
2016-05-09 20:52:42 -07:00
dfb04a43b4
set dig_pkg on arch linux for issue #59
2016-05-09 23:47:57 -04:00
bd8d46d784
add OpenBSD to map.jinja
2016-05-09 23:44:20 -04:00
f7c84783f0
Merge pull request #61 from babilen/relax-ssh-defaults
...
Drop overly biased ssh_config defaults
2016-05-04 12:32:48 -07:00
49923a6371
Drop overly opinionated ssh_config defaults
...
This set of options reflect the ssh_config options that are set by
default on Debian. The way this was set before has the potential to
break exisisting setups that rely on "normal" defaults, rather than the
rather opinionated ones that are now being shipped with this formula.
2016-05-04 18:25:01 +02:00
daed52de19
Add sshd_config to map.jinja and check if dig command is available before installing 'dig' package.
2016-04-19 02:53:14 +02:00
0abbaac60d
Fix the default Subystem sftp-server path for SLE
2016-03-23 14:41:25 +01:00
1e515b0f5d
make the host option rendering support lists by refactoring the main option rendering code
...
put the ssh_config Host:* options in the defaults file so they can be overridden
2016-01-14 02:57:45 +00:00
143451eb19
Add support for Host definitions in ssh_config
...
This gives us the ability to define system-wide definitions for specific Hosts, and their options.
For example, with this in pillar:
```
# this is the place for host-wide SSH config
ssh_config:
...
Hosts:
# this simplifies cloning with custom params
# eg: git clone my-git:foo/bar
my-git:
User: git
HostName: git.example.com
Port: 2222
```
This would add a section in `/etc/ssh/ssh_config`:
```
Host my-git
User git
HostName git.example.com
Port 2222
```
2016-01-02 18:12:55 -05:00
33344743b0
Add ability to control SSH server status (default: on)
2015-12-27 18:17:01 +01:00
b813b4b52a
Replaced iteritems deprecated function with items
2015-11-30 09:25:28 -03:00
3791b11380
Added default path for sftp Subsystem in FreeBSD
2015-11-29 15:56:17 -03:00
f55445211c
Specify config clause only if defined in pillar.
...
Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-18 20:33:50 +01:00
dda1fb5128
Put ssh keys on configured path in sshd_config (AuthorizedKeysFile)
...
Signed-off-by: POTIER Mathieu <mathieu.potier@onzeway.eu>
2015-11-17 11:09:37 +01:00
13cf374efe
Added configuration options for ssh_config
...
Made a small change to reflect the default sshd_config
2015-10-01 15:21:16 +00:00
fd4381b769
The default value for ServerKeyBits is 1024 both upstream and in distros
2015-07-30 12:27:05 +00:00
c27f9a81f3
Use iteritems() instead of items().
...
Signed-off-by: René Jochum <rene@jochums.at>
2015-07-13 16:00:22 +02:00
064d489f41
Use iteritems() instead of items().
...
Signed-off-by: René Jochum <rene@jochums.at>
2015-07-13 15:59:44 +02:00
a013b79027
Use iteritems() instead of items().
...
Signed-off-by: René Jochum <rene@jochums.at>
2015-07-13 15:56:25 +02:00
18ba94d0fc
add options to give a key size to generate_key
2015-07-12 18:09:26 +02:00
a927107b28
Adds support to customize /etc/ssh/moduli file
2015-07-02 19:09:41 +02:00
83bb5ac5a0
adds support to harden sshd_config (KeyExchange, Ciphers, MACs)
2015-06-30 14:33:57 +02:00
6b68c44583
Stop messing up the first line in ssh_known_hosts
2015-06-25 14:28:26 +02:00
4dddff0ccd
Fix service name for Arch Linux
2015-06-20 14:24:51 -04:00
2a68ccac1a
Add option to remove ssh_host_keys
2015-06-07 20:37:33 +02:00
ca62b7d118
Improve default lookup
...
Added defaults.yaml and map.jinja similar to template-formula and salt-formula
2015-06-02 22:52:59 +02:00
60691ef20d
Fix bug that added : at the end of the key
2015-05-22 14:32:57 +02:00
1b74efd2d0
Add a new openssh.known_hosts state
...
This state manages /etc/ssh/ssh_known_hosts and fills it with
public SSH host keys of other minions.
2015-03-26 17:50:32 +01:00
c6aeaf4dc5
add gentoo support
2015-03-23 14:56:12 +01:00
28e0916840
sort distros alphabetically
2015-03-23 14:55:40 +01:00
6efc981885
Refactor auth.sls to allow more keys for one user
2015-01-28 22:17:07 +01:00
33ee945557
Added AllowUsers,AllowGroups,DenyUsers,DenyGroups
...
This will add more options to set to secure openssh
- AllowUsers
- AllowGroups
- DenyUsers
- DenyGroups
2015-01-16 22:56:59 +01:00
b843d8168b
add ed25519 host key type; add AuthenticationMethods option
2015-01-16 17:21:10 +00:00
reschl
tmeneau
alxwr
Florian Ermisch
Felipe Zipitría
Niels Abspoel
Niels Abspoel
Raphaël Hertzog
Arthur Lutz
Mario Fritschen
Andres Montalban
Niels Abspoel
Brian Holland
Tibold Kandrai
Alexander Weidinger
Florian Ermisch
Michael Mol
Adam Mendlik
ek9
Javier Bértoli
Eric Cook
Pandu E Poluan
Brian Jackson
Simon Pirschel
Forrest
omltorg
Johannes Löthberg
Mathieu POTIER
Lev Lozhkin
Jonathon Anderson
Matthieu DERASSE
llua
Wolodja Wentland
Simon Lloyd
Theo Chatzimichos
Nigel Sim
ketzacoatl
abednarik
Bogdan Radulescu
René Jochum
elfixit
Ingo Bente
Thomas Juberg
Imran Haider
jvblasco
Marc Schiffbauer
Bernd Schlapsi
Bohdan Kmit