|
|
|
|
|
|
|
|
{%- for keyType in ['ecdsa', 'dsa', 'rsa', 'ed25519'] %} |
|
|
{%- for keyType in ['ecdsa', 'dsa', 'rsa', 'ed25519'] %} |
|
|
{%- set keyFile = "/etc/ssh/ssh_host_" ~ keyType ~ "_key" %} |
|
|
{%- set keyFile = "/etc/ssh/ssh_host_" ~ keyType ~ "_key" %} |
|
|
{%- set keySize = salt['pillar.get']('openssh:generate_' ~ keyType ~ '_size', False) %} |
|
|
{%- set keySize = salt['pillar.get']('openssh:generate_' ~ keyType ~ '_size', False) %} |
|
|
{%- if salt['pillar.get']('openssh:generate_' ~ keyType ~ '_keys', False) %} |
|
|
|
|
|
|
|
|
{%- if salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %} |
|
|
|
|
|
ssh_host_{{ keyType }}_key: |
|
|
|
|
|
file.managed: |
|
|
|
|
|
- name: {{ keyFile }} |
|
|
|
|
|
- contents_pillar: 'openssh:{{ keyType }}:private_key' |
|
|
|
|
|
- user: root |
|
|
|
|
|
- mode: 600 |
|
|
|
|
|
- require_in: |
|
|
|
|
|
- file: sshd_config |
|
|
|
|
|
- watch_in: |
|
|
|
|
|
- service: {{ openssh.service }} |
|
|
|
|
|
|
|
|
|
|
|
ssh_host_{{ keyType }}_key.pub: |
|
|
|
|
|
file.managed: |
|
|
|
|
|
- name: {{ keyFile }}.pub |
|
|
|
|
|
- contents_pillar: 'openssh:{{ keyType }}:public_key' |
|
|
|
|
|
- user: root |
|
|
|
|
|
- mode: 600 |
|
|
|
|
|
- require_in: |
|
|
|
|
|
- file: sshd_config |
|
|
|
|
|
- watch_in: |
|
|
|
|
|
- service: {{ openssh.service }} |
|
|
|
|
|
{%- elif salt['pillar.get']('openssh:generate_' ~ keyType ~ '_keys', False) %} |
|
|
{%- if keySize and salt['pillar.get']('openssh:enforce_' ~ keyType ~ '_size', False) %} |
|
|
{%- if keySize and salt['pillar.get']('openssh:enforce_' ~ keyType ~ '_size', False) %} |
|
|
ssh_remove_short_{{ keyType }}_key: |
|
|
ssh_remove_short_{{ keyType }}_key: |
|
|
cmd.run: |
|
|
cmd.run: |
|
|
|
|
|
|
|
|
- name: {{ keyFile }}.pub |
|
|
- name: {{ keyFile }}.pub |
|
|
- watch_in: |
|
|
- watch_in: |
|
|
- service: {{ openssh.service }} |
|
|
- service: {{ openssh.service }} |
|
|
|
|
|
|
|
|
{%- elif salt['pillar.get']('openssh:provide_' ~ keyType ~ '_keys', False) %} |
|
|
|
|
|
ssh_host_{{ keyType }}_key: |
|
|
|
|
|
file.managed: |
|
|
|
|
|
- name: {{ keyFile }} |
|
|
|
|
|
- contents_pillar: 'openssh:{{ keyType }}:private_key' |
|
|
|
|
|
- user: root |
|
|
|
|
|
- mode: 600 |
|
|
|
|
|
- require_in: |
|
|
|
|
|
- file: sshd_config |
|
|
|
|
|
- watch_in: |
|
|
|
|
|
- service: {{ openssh.service }} |
|
|
|
|
|
|
|
|
|
|
|
ssh_host_{{ keyType }}_key.pub: |
|
|
|
|
|
file.managed: |
|
|
|
|
|
- name: {{ keyFile }}.pub |
|
|
|
|
|
- contents_pillar: 'openssh:{{ keyType }}:public_key' |
|
|
|
|
|
- user: root |
|
|
|
|
|
- mode: 600 |
|
|
|
|
|
- require_in: |
|
|
|
|
|
- file: sshd_config |
|
|
|
|
|
- watch_in: |
|
|
|
|
|
- service: {{ openssh.service }} |
|
|
|
|
|
{%- endif %} |
|
|
{%- endif %} |
|
|
{%- endfor %} |
|
|
{%- endfor %} |
|
|
|
|
|
|