ExternalMirrors
/
openssh-formula
miroir de https://github.com/saltstack-formulas/openssh-formula
Suivre 1
Ajouter aux favoris 0
Bifurcation 1
Code Tickets 0 Versions 27 Wiki Activité
Saltstack Official OpenSSH Formula
Vous ne pouvez pas sélectionner plus de 25 sujets Les noms de sujets doivent commencer par une lettre ou un nombre, peuvent contenir des tirets ('-') et peuvent comporter jusqu'à 35 caractères.
248 Révisions
3 Branches
Aborescence: aa3da8f2c2
Branches Tags
${ item.name }
Créer la branche ${ searchTerm }
de 'aa3da8f2c2'
${ noResults }
openssh-formula/pillar.example

356 lines
13KB
Brut Annotations Historique 

  1. sshd_config:

  2.   # This keyword is totally optional

  3.   ConfigBanner: |

  4.     # Alternative banner for the config file

  5.     # (Indented) hash signs lose their special meaning here

  6.     # and the lines will be written as-is.

  7.   Port: 22

  8.   Protocol: 2

  9.   HostKey:

  10.     - /etc/ssh/ssh_host_rsa_key

  11.     - /etc/ssh/ssh_host_dsa_key

  12.     - /etc/ssh/ssh_host_ecdsa_key

  13.     - /etc/ssh/ssh_host_ed25519_key

  14.   UsePrivilegeSeparation: 'sandbox'

  15.   KeyRegenerationInterval: 3600

  16.   ServerKeyBits: 1024

  17.   SyslogFacility: AUTH

  18.   LogLevel: INFO

  19.   ClientAliveInterval: 0

  20.   ClientAliveCountMax: 3

  21.   LoginGraceTime: 120

  22.   PermitRootLogin: 'yes'

  23.   PasswordAuthentication: 'no'

  24.   StrictModes: 'yes'

  25.   MaxAuthTries: 6

  26.   MaxSessions: 10

  27.   RSAAuthentication: 'yes'

  28.   PubkeyAuthentication: 'yes'

  29.   AuthorizedKeysCommand: '/usr/bin/sss_ssh_authorizedkeys'

  30.   AuthorizedKeysCommandUser: 'nobody'

  31.   IgnoreRhosts: 'yes'

  32.   RhostsRSAAuthentication: 'no'

  33.   HostbasedAuthentication: 'no'

  34.   PermitEmptyPasswords: 'no'

  35.   ChallengeResponseAuthentication: 'no'

  36.   AuthenticationMethods: 'publickey,keyboard-interactive'

  37.   AuthorizedKeysFile: '%h/.ssh/authorized_keys'

  38.   X11Forwarding: 'no'

  39.   X11DisplayOffset: 10

  40.   PrintMotd: 'yes'

  41.   PrintLastLog: 'yes'

  42.   TCPKeepAlive: 'yes'

  43.   AcceptEnv: "LANG LC_*"

  44.   Subsystem: "sftp /usr/lib/openssh/sftp-server"

  45.   UsePAM: 'yes'

  46.   UseDNS: 'yes'

  47.   # set as string

  48.   AllowUsers: 'vader@10.0.0.1 maul@evil.com sidious luke'

  49.   # or set as list

  50.   AllowUsers:

  51.     - vader@10.0.0.1

  52.     - maul@evil.com

  53.     - sidious

  54.     - luke

  55.   # set as string

  56.   DenyUsers: 'yoda chewbaca@112.10.21.1'

  57.   # or set as list

  58.   DenyUsers:

  59.     - yoda

  60.     - chewbaca@112.10.21.1

  61.   # set as string

  62.   AllowGroups: 'wheel staff imperial'

  63.   # or set as list

  64.   AllowGroups:

  65.     - wheel

  66.     - staff

  67.     - imperial

  68.   # set as string

  69.   DenyGroups: 'rebel'

  70.   # or set as list

  71.   DenyGroups:

  72.     - rebel

  73.     - badcompany

  74.   matches:

  75.     sftp_chroot:

  76.       type:

  77.         Group: sftpusers

  78.       options:

  79.         ChrootDirectory: /sftp-chroot/%u

  80.         X11Forwarding: no

  81.         AllowTcpForwarding: no

  82.         ForceCommand: internal-sftp

  83.     # Supports complex compound matches in Match criteria. For example, be able

  84.     # to match against multiple Users for a given Match, or be able to match

  85.     # against address ranges. Or Groups. Or any combination thereof.

  86.     #

  87.     # Support for matching users can take one of several different appearances

  88.     # in pillar data:

  89.     match_1:

  90.       type:

  91.         User: one_user

  92.       options:

  93.         ChrootDirectory: /ex/%u

  94.     match_2:

  95.       type:

  96.         User:

  97.           - jim

  98.           - bob

  99.           - sally

  100.       options:

  101.         ChrootDirectory: /ex/%u

  102.     # Note the syntax of match_3. By using empty dicts for each user, we can

  103.     # leverage Salt's pillar mergine. If we use simple lists, we cannot do

  104.     # this; Salt can't merge simple lists, because it doesn't know what order

  105.     # they ought to be in.

  106.     match_3:

  107.       type:

  108.         User:

  109.           jim: ~

  110.           bob: ~

  111.           sally: ~

  112.       options:

  113.         ChrootDirectory: /ex/%u

  114. 

  115.   # Check `man sshd_config` for supported KexAlgorithms, Ciphers and MACs first.

  116.   # You can specify KexAlgorithms, Ciphers and MACs as both key or a list.

  117.   # The configuration given in the example below is based on:

  118.   # https://stribika.github.io/2015/01/04/secure-secure-shell.html

  119.   #KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256'

  120.   #Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'

  121.   #MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'

  122.   KexAlgorithms:

  123.     - 'curve25519-sha256@libssh.org'

  124.     - 'diffie-hellman-group-exchange-sha256'

  125.   Ciphers:

  126.     - 'chacha20-poly1305@openssh.com'

  127.     - 'aes256-gcm@openssh.com'

  128.     - 'aes128-gcm@openssh.com'

  129.     - 'aes256-ctr'

  130.     - 'aes192-ctr'

  131.     - 'aes128-ctr'

  132.   MACs:

  133.     - 'hmac-sha2-512-etm@openssh.com'

  134.     - 'hmac-sha2-256-etm@openssh.com'

  135.     - 'umac-128-etm@openssh.com'

  136.     - 'hmac-sha2-512'

  137.     - 'hmac-sha2-256'

  138.     - 'umac-128@openssh.com'

  139. 

  140. # Warning! You should generally NOT NEED to set ssh_config. Setting ssh_config

  141. # pillar will overwrite the defaults of your distribution's SSH client. This

  142. # will also force the default configuration for all the SSH clients on the

  143. # machine. This can break SSH connections with servers using older versions of

  144. # openssh. Please make sure you understand the implication of different settings

  145. ssh_config:

  146.   StrictHostKeyChecking: no

  147.   ForwardAgent: no

  148.   ForwardX11: no

  149.   RhostsRSAAuthentication: no

  150.   RSAAuthentication: yes

  151.   PasswordAuthentication: yes

  152.   HostbasedAuthentication: no

  153.   GSSAPIAuthentication: no

  154.   GSSAPIDelegateCredentials: no

  155.   BatchMode: 'yes'

  156.   CheckHostIP: 'yes'

  157.   AddressFamily: 'any'

  158.   ConnectTimeout: 0

  159.   IdentityFile: '~/.ssh/id_rsa'

  160.   Port: 22

  161.   Protocol: 2

  162.   Cipher: '3des'

  163.   Tunnel: 'no'

  164.   TunnelDevice: 'any:any'

  165.   PermitLocalCommand: 'no'

  166.   VisualHostKey: 'no'

  167.   # Check `man ssh_config` for supported KexAlgorithms, Ciphers and MACs first.

  168.   # WARNING! Please make sure you understand the implications of the below

  169.   # settings. The examples provided below might break your connection to older /

  170.   # legacy openssh servers.

  171.   # The configuration given in the example below is based on:

  172.   # https://stribika.github.io/2015/01/04/secure-secure-shell.html

  173.   # You can specify KexAlgorithms, Ciphers and MACs as both key or a list.

  174.   #KexAlgorithms: 'curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1'

  175.   #Ciphers: 'chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'

  176.   #MACs: 'hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com'

  177.   KexAlgorithms:

  178.     - 'curve25519-sha256@libssh.org'

  179.     - 'diffie-hellman-group-exchange-sha256'

  180.     - 'diffie-hellman-group-exchange-sha1'

  181.     - 'diffie-hellman-group14-sha1'

  182.   Ciphers:

  183.     - 'chacha20-poly1305@openssh.com'

  184.     - 'aes256-gcm@openssh.com'

  185.     - 'aes128-gcm@openssh.com'

  186.     - 'aes256-ctr'

  187.     - 'aes192-ctr'

  188.     - 'aes128-ctr'

  189.   MACs:

  190.     - 'hmac-sha2-512-etm@openssh.com'

  191.     - 'hmac-sha2-256-etm@openssh.com'

  192.     - 'umac-128-etm@openssh.com'

  193.     - 'hmac-sha2-512'

  194.     - 'hmac-sha2-256'

  195.     - 'umac-128@openssh.com'

  196. 

  197. 

  198. openssh:

  199.   # Instead of adding a custom banner file you can set it in pillar

  200.   banner_string: |

  201.     Welcome to {{ grains['id'] }}!

  202. 

  203.   # Controls if SSHD should be enabled/started

  204.   sshd_enable: true

  205.   auth:

  206.     joe-valid-ssh-key-desktop:

  207.       - user: joe

  208.         present: True

  209.         enc: ssh-rsa

  210.         comment: main key - desktop

  211.         source: salt://ssh_keys/joe.desktop.pub

  212.     joe-valid-ssh-key-notebook:

  213.       - user: joe

  214.         present: True

  215.         enc: ssh-rsa

  216.         comment: main key - notebook

  217.         source: salt://ssh_keys/joe.netbook.pub

  218.     joe-non-valid-ssh-key:

  219.       - user: joe

  220.         present: False

  221.         enc: ssh-rsa

  222.         comment: obsolete key - removed

  223.         source: salt://ssh_keys/joe.no-valid.pub

  224.   # Maps users to source files

  225.   # Designed to play nice with ext_pillar

  226.   # salt.states.ssh_auth: If source is set, comment and enc will be ignored

  227.   auth_map:

  228.     personal_keys:  # store name

  229.       source: salt://ssh_keys

  230.       users:

  231.         joe:

  232.           joe.desktop: {}

  233.           joe.netbook:

  234.             options: []  # see salt.states.ssh_auth.present

  235.           joe.no-valid:

  236.             present: False

  237. 

  238.   generate_dsa_keys: False

  239.   absent_dsa_keys: False

  240.   provide_dsa_keys: False

  241.   dsa:

  242.     private_key: |

  243.       -----BEGIN DSA PRIVATE KEY-----

  244.       NOT_DEFINED

  245.       -----END DSA PRIVATE KEY-----

  246.     public_key: |

  247.       ssh-dss NOT_DEFINED

  248. 

  249.   generate_ecdsa_keys: False

  250.   absent_ecdsa_keys: False

  251.   provide_ecdsa_keys: False

  252.   ecdsa:

  253.     private_key: |

  254.       -----BEGIN EC PRIVATE KEY-----

  255.       NOT_DEFINED

  256.       -----END EC PRIVATE KEY-----

  257.     public_key: |

  258.       ecdsa-sha2-nistp256 NOT_DEFINED

  259. 

  260.   generate_rsa_keys: False

  261.   generate_rsa_size: 4096

  262.   # Will remove the old key if it is to short and generate a new one.

  263.   enforce_rsa_size: False

  264.   absent_rsa_keys: False

  265.   provide_rsa_keys: False

  266.   rsa:

  267.     private_key: |

  268.       -----BEGIN RSA PRIVATE KEY-----

  269.       NOT_DEFINED

  270.       -----END RSA PRIVATE KEY-----

  271.     public_key: |

  272.       ssh-rsa NOT_DEFINED

  273. 

  274.   generate_ed25519_keys: False

  275.   absent_ed25519_keys: False

  276.   provide_ed25519_keys: False

  277.   ed25519:

  278.     private_key: |

  279.       -----BEGIN OPENSSH PRIVATE KEY-----

  280.       NOT_DEFINED

  281.       -----END OPENSSH PRIVATE KEY-----

  282.     public_key: |

  283.       ssh-ed25519 NOT_DEFINED

  284. 

  285.   known_hosts:

  286.     # The next 2 settings restrict the set of minions that will be added in

  287.     # the generated ssh_known_hosts files (the default is to match all minions)

  288.     target: '*'

  289.     tgt_type: 'glob'

  290.     # Name of mining functions used to gather public keys and hostnames

  291.     # (the default values are shown here)

  292.     mine_keys_function: public_ssh_host_keys

  293.     mine_hostname_function: public_ssh_hostname

  294.     # List of DNS entries also pointing to our managed machines and that we want

  295.     # to inject in our generated ssh_known_hosts file

  296.     aliases:

  297.       - cname-to-minion.example.org

  298.       - alias.example.org

  299.     # Includes short hostnames derived from the FQDN

  300.     # (host.example.test -> host)

  301.     # (Deactivated by default, because there can be collisions!)

  302.     hostnames: False

  303.     #hostnames:

  304.     # Restrict wich hosts you want to use via their hostname

  305.     # (i.e. ssh user@host instead of ssh user@host.example.com)

  306.     #  target: '*'  # Defaults to "*.{{ grains['domain']}}"

  307.     #  tgt_type: 'glob'

  308.     # To activate the defaults you can just set an empty dict.

  309.     #hostnames: {}

  310.     # Include localhost, 127.0.0.1 and ::1 (default: False)

  311.     include_localhost: False

  312.     # Host keys fetched via salt-ssh

  313.     salt_ssh:

  314.       # The salt-ssh user

  315.       user: salt-master

  316.       # specify public host names of a minion

  317.       public_ssh_host_names:

  318.         minion.id:

  319.           - minion.id

  320.           - alias.of.minion.id

  321.       # specify public host keys of a minion

  322.       public_ssh_host_keys:

  323.         minion.id: |

  324.           ssh-rsa [...]

  325.           ssh-ed25519 [...]

  326.     # Here you can list keys for hosts which are not among your minions:

  327.     static:

  328.       github.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGm[...]'

  329.       gitlab.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bN[...]'

  330. 

  331.   # specify DH parameters (see /etc/ssh/moduli)

  332.   moduli: |

  333.     # Time Type Tests Tries Size Generator Modulus

  334.     20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63

  335.     20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB

  336.     20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53

  337.     20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F

  338.   # ALTERNATIVELY, specify the location of the moduli file. Examples:

  339.   #moduli_source: http://some.server.somewhere/salt/moduli

  340.   #moduli_source: salt://files/ssh/moduli

  341.   # If moduli is specified, moduli_source will be ignored.

  342.   # Also, a proper hash file *must* be included in the same path. E.g.:

  343.   #     http://some.server.somewhere/salt/moduli.hash

  344.   #     salt://files/ssh/moduli.hash

  345.   # These will be automatically referenced to by the ssh_moduli state.

  346. 

  347. # Required for openssh.known_hosts

  348. mine_functions:

  349.   public_ssh_host_keys:

  350.     mine_function: cmd.run

  351.     cmd: cat /etc/ssh/ssh_host_*_key.pub

  352.     python_shell: True

  353.   public_ssh_hostname:

  354.     mine_function: grains.get

  355.     key: id