|
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240 |
- {% from "openssh/map.jinja" import sshd_config with context %}
-
- {%- set processed_options = [] -%}
-
-
-
- {%- macro render_option(keyword, config_dict=sshd_config) -%}
- {%- set value = config_dict.get(keyword) -%}
- {%- if value is sameas true -%}
- {{ keyword }} yes
- {% elif value is sameas false -%}
- {{ keyword }} no
- {% elif value is string or value is number -%}
- {{ keyword }} {{ value }}
- {% else -%}
- {%- for single_value in value -%}
- {{ keyword }} {{ single_value }}
- {% endfor -%}
- {%- endif -%}
- {%- endmacro -%}
-
-
- {%- macro option(keyword, present) -%}
- {%- if keyword in sshd_config -%}
- {%- do processed_options.append(keyword) -%}
- {{ render_option(keyword) }}
- {%- endif -%}
- {%- endmacro -%}
-
-
- {%- macro option_collapselist(keyword, sep, config_dict=None) -%}
- {%- if config_dict is sameas None -%}
- {%- do processed_options.append(keyword) -%}
- {%- set config_dict = sshd_config -%}
- {%- endif -%}
- {{ keyword }} {{ config_dict.get(keyword) | join(sep) }}
- {% endmacro -%}
-
-
- {%- macro option_string_or_list(keyword, sep=',') -%}
- {%- if sshd_config.get(keyword, '') is string -%}
- {{ option(keyword) }}
- {%- else -%}
- {{ option_collapselist(keyword, sep) }}
- {%- endif -%}
- {%- endmacro -%}
-
-
- {%- macro join_to_string(src, keyword, sep=',') -%}
- {%- set srcval = src.get(keyword, '') -%}
- {%- if srcval is string -%}
- {{ srcval }}
- {%- elif srcval is mapping -%}
- {{ srcval.keys() | sort | join(sep) }}
- {%- else -%}
- {{ srcval | join(sep) }}
- {%- endif -%}
- {%- endmacro -%}
-
- {%- if sshd_config.get('ConfigBanner', False) -%}
- {%- do processed_options.append('ConfigBanner') -%}
- {{ sshd_config['ConfigBanner'] }}
- {%- else -%}
- # This file is managed by salt. Manual changes risk being overwritten.
- {%- endif %}
- {%- set global_src_url = salt ['pillar.get']('__formulas:print_template_url', None) %}
- {%- set local_src_url = salt ['pillar.get']('openssh-formula:print_template_url', None) %}
- {%- if (global_src_url and local_src_url is none) or local_src_url %}
- #
- # Template used to generate this file:
- # {{ source }}
- #
- {%- endif %}
- # The contents of the original sshd_config are kept on the bottom for
- # quick reference.
- # See the sshd_config(5) manpage for details
-
-
-
- {{- option('AddressFamily') -}}
-
-
- {{- option('Port') -}}
-
- {{- option('ListenAddress') -}}
- {{- option('Protocol') -}}
-
- {{- option('HostKey') -}}
-
-
- {{- option('UsePrivilegeSeparation') -}}
-
-
- {{- option('KeyRegenerationInterval') -}}
- {{- option('ServerKeyBits') -}}
-
-
- {{- option('SyslogFacility') -}}
- {{- option('LogLevel') -}}
-
-
- {{- option('ClientAliveInterval') -}}
- {{- option('ClientAliveCountMax') -}}
-
-
- {{- option('LoginGraceTime') -}}
- {{- option('PermitRootLogin') -}}
- {{- option('StrictModes') -}}
- {{- option('MaxAuthTries') -}}
- {{- option('MaxSessions') -}}
-
- {{- option('DSAAuthentication') -}}
- {{- option('RSAAuthentication') -}}
- {{- option('PubkeyAuthentication') -}}
- {{- option('AuthorizedKeysFile') -}}
- {{- option('AuthorizedKeysCommand') -}}
- {{- option('AuthorizedKeysCommandUser') -}}
-
-
- {{- option('IgnoreRhosts') -}}
-
- {{- option('RhostsRSAAuthentication') -}}
-
- {{- option('HostbasedAuthentication') -}}
-
- {{- option('IgnoreUserKnownHosts') -}}
-
-
- {{- option('PermitEmptyPasswords') -}}
-
-
-
- {{- option('ChallengeResponseAuthentication') -}}
- {{- option('AuthenticationMethods') -}}
-
-
- {{- option('PasswordAuthentication') -}}
-
-
- {{- option('KerberosAuthentication') -}}
- {{- option('KerberosGetAFSToken') -}}
- {{- option('KerberosOrLocalPasswd') -}}
- {{- option('KerberosTicketCleanup') -}}
-
-
- {{- option('GSSAPIAuthentication') -}}
- {{- option('GSSAPICleanupCredentials') -}}
-
- {{- option('X11Forwarding') -}}
- {{- option('AllowTcpForwarding') -}}
- {{- option('X11DisplayOffset') -}}
- {{- option('PrintMotd') -}}
-
- {% if not (salt['grains.get']('os') == 'FreeBSD' and salt['grains.get']('osrelease')|float >= 10.3) -%}
- {{- option('PrintLastLog') -}}
- {% endif -%}
- {{- option('TCPKeepAlive') -}}
- {{- option('UseLogin') -}}
-
- {{- option('MaxStartups') -}}
- {{- option('Banner') -}}
-
-
- {{- option('AcceptEnv') -}}
-
- {{- option('Subsystem') -}}
-
- {% if not salt['grains.get']('os') == 'OpenBSD' -%}
-
-
-
-
-
-
-
-
-
- {{- option('UsePAM') -}}
- {%- endif %}
-
-
- {{- option('UseDNS') -}}
-
-
-
-
-
-
-
-
-
-
-
-
- {{- option_string_or_list('DenyUsers', sep=' ') }}
-
- {{- option_string_or_list('AllowUsers', sep=' ') }}
-
- {{- option_string_or_list('DenyGroups', sep=' ') }}
-
- {{- option_string_or_list('AllowGroups', sep=' ') }}{{ "\n" -}}
-
-
-
- {{- option_string_or_list('KexAlgorithms') -}}
-
-
- {{- option_string_or_list('Ciphers') -}}
-
-
- {{- option_string_or_list('MACs') -}}
-
-
- {%- for keyword in sshd_config.keys() %}
-
- {%- if not keyword in processed_options and keyword != 'matches' -%}
- {{- render_option(keyword) -}}
- {% endif -%}
- {%- endfor %}
-
-
- {%- if 'matches' in sshd_config %}
- {%- for name, match in sshd_config['matches']|dictsort(true) %}
- Match
-
- {%- for criteria in match['type'].keys()|sort() -%}
- {{ ' ' -}}{{criteria }} {{ join_to_string(match['type'], criteria) }}
- {%- endfor %} #{{- name }}
-
- {%- for keyword in match['options'].keys()|sort() -%}
- {%- if keyword in ['AllowUsers', 'DenyUsers', 'AllowGroups', 'DenyGroups'] -%}
- {{ option_collapselist(keyword, ' ', config_dict=match['options']) | indent(4, true) }}
- {% else -%}
- {{ render_option(keyword, config_dict=match['options']) | indent(4, true) }}
- {% endif -%}
- {%- endfor %}
- {%- endfor %}
- {%- endif %}
-
-
|