Saltstack Official OpenSSH Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

237 lines
9.5KB

  1. # -*- coding: utf-8 -*-
  2. # vim: ft=yaml
  3. ---
  4. # yamllint disable rule:line-length
  5. # Using a stripped down version of both `sshd_config` and `ssh_config` here
  6. # The values introduced by the initial commit are taken from the Travis
  7. # instances themselves
  8. # Care must be taken when modifying this, not to lock out Travis before the
  9. # `kitchen verify` stage takes place, resulting in:
  10. # ```
  11. # $$$$$$ [SSH] connection failed, terminating (#<Net::SSH::AuthenticationFailed: Authentication failed for user kitchen@localhost>)
  12. # >>>>>> ------Exception-------
  13. # >>>>>> Class: Kitchen::ActionFailed
  14. # >>>>>> Message: 1 actions failed.
  15. # >>>>>> Failed to complete #verify action: [Transport error, can't connect to 'ssh' backend: SSH session could not be established] on ...
  16. # ```
  17. # yamllint enable rule:line-length
  18. sshd_config:
  19. ChallengeResponseAuthentication: 'no'
  20. X11Forwarding: 'yes'
  21. PrintMotd: 'no'
  22. AcceptEnv: "LANG LC_*"
  23. Subsystem: "sftp /usr/lib/openssh/sftp-server"
  24. {%- if grains.os != "OpenBSD" %}
  25. UsePAM: 'yes'
  26. {%- endif %}
  27. {#- Need this on various platforms to avoid the `kitchen verify` failure as mentioned above; see: #}
  28. {#- * https://gitlab.com/saltstack-formulas/infrastructure/salt-image-builder/-/commit/cb6781a2bba9 #}
  29. {%- if grains.os in ["Arch", "OpenBSD", "Gentoo"] or grains.get("oscodename", "") in ["openSUSE Tumbleweed"] %}
  30. PubkeyAcceptedAlgorithms: "+ssh-rsa"
  31. {%- endif %}
  32. ssh_config:
  33. Hosts:
  34. '*':
  35. GSSAPIAuthentication: 'yes'
  36. HashKnownHosts: 'yes'
  37. SendEnv: 'LANG LC_*'
  38. openssh:
  39. # Instead of adding a custom banner file you can set it in pillar
  40. banner_string: |
  41. Welcome to {{ grains['id'] }}!
  42. # Set installed package version
  43. server_version: latest
  44. client_version: latest
  45. # Controls if SSHD should be enabled/started
  46. sshd_enable: true
  47. auth:
  48. joe-valid-ssh-key-desktop:
  49. - user: joe
  50. present: true
  51. enc: ssh-rsa
  52. comment: main key - desktop
  53. source: salt://ssh_keys/joe.desktop.pub
  54. joe-valid-ssh-key-notebook:
  55. - user: joe
  56. present: true
  57. enc: ssh-rsa
  58. comment: main key - notebook
  59. source: salt://ssh_keys/joe.netbook.pub
  60. joe-non-valid-ssh-key:
  61. - user: joe
  62. present: false
  63. enc: ssh-rsa
  64. comment: obsolete key - removed
  65. source: salt://ssh_keys/joe.no-valid.pub
  66. # Maps users to source files
  67. # Designed to play nice with ext_pillar
  68. # salt.states.ssh_auth: If source is set, comment and enc will be ignored
  69. auth_map:
  70. personal_keys: # store name
  71. source: salt://ssh_keys
  72. users:
  73. joe:
  74. joe.desktop: {}
  75. joe.netbook:
  76. options: [] # see salt.states.ssh_auth.present
  77. joe.no-valid:
  78. present: false
  79. generate_dsa_keys: false
  80. absent_dsa_keys: false
  81. provide_dsa_keys: false
  82. dsa:
  83. private_key: |
  84. -----BEGIN DSA PRIVATE KEY-----
  85. NOT_DEFINED
  86. -----END DSA PRIVATE KEY-----
  87. public_key: |
  88. ssh-dss NOT_DEFINED
  89. generate_ecdsa_keys: false
  90. absent_ecdsa_keys: false
  91. provide_ecdsa_keys: false
  92. ecdsa:
  93. private_key: |
  94. -----BEGIN EC PRIVATE KEY-----
  95. NOT_DEFINED
  96. -----END EC PRIVATE KEY-----
  97. public_key: |
  98. ecdsa-sha2-nistp256 NOT_DEFINED
  99. generate_rsa_keys: false
  100. generate_rsa_size: 4096
  101. # Will remove the old key if it is to short and generate a new one.
  102. enforce_rsa_size: false
  103. absent_rsa_keys: false
  104. provide_rsa_keys: false
  105. rsa:
  106. private_key: |
  107. -----BEGIN RSA PRIVATE KEY-----
  108. NOT_DEFINED
  109. -----END RSA PRIVATE KEY-----
  110. public_key: |
  111. ssh-rsa NOT_DEFINED
  112. generate_ed25519_keys: false
  113. absent_ed25519_keys: false
  114. provide_ed25519_keys: false
  115. ed25519:
  116. private_key: |
  117. -----BEGIN OPENSSH PRIVATE KEY-----
  118. NOT_DEFINED
  119. -----END OPENSSH PRIVATE KEY-----
  120. public_key: |
  121. ssh-ed25519 NOT_DEFINED
  122. known_hosts:
  123. # The next 2 settings restrict the set of minions that will be added in
  124. # the generated ssh_known_hosts files (the default is to match all minions)
  125. target: '*'
  126. tgt_type: 'glob'
  127. # Name of mining functions used to gather public keys and hostnames
  128. # (the default values are shown here)
  129. mine_keys_function: public_ssh_host_keys
  130. mine_hostname_function: public_ssh_hostname
  131. # List of DNS entries also pointing to our managed machines and that we want
  132. # to inject in our generated ssh_known_hosts file
  133. aliases:
  134. - cname-to-minion.example.org
  135. - alias.example.org
  136. # Includes short hostnames derived from the FQDN
  137. # (host.example.test -> host)
  138. # (Deactivated by default, because there can be collisions!)
  139. hostnames: false
  140. # hostnames:
  141. # Restrict wich hosts you want to use via their hostname
  142. # (i.e. ssh user@host instead of ssh user@host.example.com)
  143. # target: '*' # Defaults to "*.{{ grains['domain']}}"
  144. # tgt_type: 'glob'
  145. # To activate the defaults you can just set an empty dict.
  146. # hostnames: {}
  147. # Include localhost, 127.0.0.1 and ::1 (default: false)
  148. include_localhost: false
  149. # Host keys fetched via salt-ssh
  150. salt_ssh:
  151. # The salt-ssh user
  152. user: salt-master
  153. # specify public host names of a minion
  154. public_ssh_host_names:
  155. minion.id:
  156. - minion.id
  157. - alias.of.minion.id
  158. # specify public host keys of a minion
  159. public_ssh_host_keys:
  160. minion.id: |
  161. ssh-rsa [...]
  162. ssh-ed25519 [...]
  163. # Here you can list keys for hosts which are not among your minions:
  164. static:
  165. github.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGm[...]'
  166. gitlab.com: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bN[...]'
  167. omit_ip_address:
  168. - github.com
  169. # specify DH parameters (see /etc/ssh/moduli)
  170. # yamllint disable rule:line-length
  171. moduli: |
  172. # Time Type Tests Tries Size Generator Modulus
  173. 20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
  174. 20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
  175. 20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
  176. 20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
  177. # yamllint enable rule:line-length
  178. # ALTERNATIVELY, specify the location of the moduli file. Examples:
  179. # moduli_source: http://some.server.somewhere/salt/moduli
  180. # moduli_source: salt://files/ssh/moduli
  181. # If moduli is specified, moduli_source will be ignored.
  182. # Also, a proper hash file *must* be included in the same path. E.g.:
  183. # http://some.server.somewhere/salt/moduli.hash
  184. # salt://files/ssh/moduli.hash
  185. # These will be automatically referenced to by the ssh_moduli state.
  186. tofs:
  187. # The files_switch key serves as a selector for alternative
  188. # directories under the formula files directory. See TOFS pattern
  189. # doc for more info.
  190. # Note: Any value not evaluated by `config.get` will be used literally.
  191. # This can be used to set custom paths, as many levels deep as required.
  192. # files_switch:
  193. # - any/path/can/be/used/here
  194. # - id
  195. # - role
  196. # - osfinger
  197. # - os
  198. # - os_family
  199. # All aspects of path/file resolution are customisable using the options below.
  200. # This is unnecessary in most cases; there are sensible defaults.
  201. # path_prefix: template_alt
  202. # dirs:
  203. # files: files_alt
  204. # default: default_alt
  205. source_files:
  206. manage ssh_known_hosts file:
  207. - alt_ssh_known_hosts
  208. sshd_config:
  209. - alt_sshd_config
  210. ssh_config:
  211. - alt_ssh_config
  212. sshd_banner:
  213. - fire_banner
  214. # Required for openssh.known_hosts
  215. mine_functions:
  216. public_ssh_host_keys:
  217. mine_function: cmd.run
  218. cmd: cat /etc/ssh/ssh_host_*_key.pub
  219. python_shell: true
  220. public_ssh_hostname:
  221. mine_function: grains.get
  222. key: id