salt
/
openssh-formula
forked from ExternalMirrors/openssh-formula
Watch 1
Star 0
Fork 0
Code Releases 0 Activity
Saltstack Official OpenSSH Formula
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
252 Commits
1 Branch
Tree: ffafd2a2f5
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'ffafd2a2f5'
${ noResults }
openssh-formula/openssh/files/sshd_config

241 lines
8.5KB
Raw Blame History 

  1. {% from "openssh/map.jinja" import sshd_config with context %}

  2. {#- present in sshd_config and known in actual file options -#}

  3. {%- set processed_options = [] -%}

  4. 

  5. {#- generic renderer used for sshd matches, known options, -#}

  6. {#- and unknown options -#}

  7. {%- macro render_option(keyword, config_dict=sshd_config) -%}

  8. {%-   set value = config_dict.get(keyword) -%}

  9. {%-   if value is sameas true -%}

  10.         {{ keyword }} yes

  11. {%    elif value is sameas false -%}

  12.         {{ keyword }} no

  13. {%    elif value is string or value is number -%}

  14.         {{ keyword }} {{ value }}

  15. {%    else -%}

  16. {%-     for single_value in value -%}

  17. {{ keyword }} {{ single_value }}

  18. {%      endfor -%}

  19. {%-   endif -%}

  20. {%- endmacro -%}

  21. 

  22. {#- macros for render option if present -#}

  23. {%- macro option(keyword, present) -%}

  24. {%-   if keyword in sshd_config -%}

  25. {%-     do processed_options.append(keyword) -%}

  26.         {{ render_option(keyword) }}

  27. {%-   endif -%}

  28. {%- endmacro -%}

  29. 

  30. {#- macro for collapsing a list into a string -#}

  31. {%- macro option_collapselist(keyword, sep, config_dict=None) -%}

  32. {%-   if config_dict is sameas None -%}

  33. {%-     do processed_options.append(keyword) -%}

  34. {%-     set config_dict = sshd_config -%}

  35. {%-   endif -%}

  36.       {{ keyword }} {{ config_dict.get(keyword) | join(sep) }}

  37. {% endmacro -%}

  38. 

  39. {#- macro for handling an option that can be specified as a list or a string -#}

  40. {%- macro option_string_or_list(keyword, sep=',') -%}

  41. {%-   if sshd_config.get(keyword, '') is string -%}

  42.         {{ option(keyword) }}

  43. {%-   else -%}

  44.         {{ option_collapselist(keyword, sep) }}

  45. {%-   endif -%}

  46. {%- endmacro -%}

  47. 

  48. {#- macro for conditionally joining a string, list or dict(keys) to just a string -#}

  49. {%- macro join_to_string(src, keyword, sep=',') -%}

  50. {%-   set srcval = src.get(keyword, '') -%}

  51. {%-   if srcval is string -%}

  52.         {{ srcval }}

  53. {%-   elif srcval is mapping  -%}

  54.         {{ srcval.keys() | sort | join(sep) }}

  55. {%-   else -%}

  56.         {{ srcval | join(sep) }}

  57. {%-   endif -%}

  58. {%- endmacro -%}

  59. 

  60. {%- if sshd_config.get('ConfigBanner', False) -%}

  61. {%-   do processed_options.append('ConfigBanner') -%}

  62.       {{ sshd_config['ConfigBanner'] }}

  63. {%- else -%}

  64. # This file is managed by salt. Manual changes risk being overwritten.

  65. {%- endif %}

  66. {%- set global_src_url = salt ['pillar.get']('__formulas:print_template_url', None) %}

  67. {%- set local_src_url = salt ['pillar.get']('openssh-formula:print_template_url', None) %}

  68. {%- if (global_src_url and local_src_url is none) or local_src_url %}

  69. #

  70. # Template used to generate this file:

  71. # {{ source }}

  72. #

  73. {%- endif %}

  74. # The contents of the original sshd_config are kept on the bottom for

  75. # quick reference.

  76. # See the sshd_config(5) manpage for details

  77. 

  78. {#  Specifies which address family should be used by sshd(8). -#}

  79. {#- Valid arguments are any, inet (use IPv4 only), or inet6 (use IPv6 only) -#}

  80. {{- option('AddressFamily') -}}

  81. 

  82. {#- What ports, IPs and protocols we listen for -#}

  83. {{- option('Port') -}}

  84. {#- Use these options to restrict which interfaces/protocols sshd will bind to -#}

  85. {{- option('ListenAddress') -}}

  86. {{- option('Protocol') -}}

  87. {#- HostKeys for protocol version 2 -#}

  88. {{- option('HostKey') -}}

  89. 

  90. {#- Privilege Separation is turned on for security -#}

  91. {{- option('UsePrivilegeSeparation') -}}

  92. 

  93. {#- Lifetime and size of ephemeral version 1 server key -#}

  94. {{- option('KeyRegenerationInterval') -}}

  95. {{- option('ServerKeyBits') -}}

  96. 

  97. {#- Logging -#}

  98. {{- option('SyslogFacility') -}}

  99. {{- option('LogLevel') -}}

  100. 

  101. {#- Session idle time out -#}

  102. {{- option('ClientAliveInterval') -}}

  103. {{- option('ClientAliveCountMax') -}}

  104. 

  105. {#- Authentication: -#}

  106. {{- option('LoginGraceTime') -}}

  107. {{- option('PermitRootLogin') -}}

  108. {{- option('StrictModes') -}}

  109. {{- option('MaxAuthTries') -}}

  110. {{- option('MaxSessions') -}}

  111. 

  112. {{- option('DSAAuthentication') -}}

  113. {{- option('RSAAuthentication') -}}

  114. {{- option('PubkeyAuthentication') -}}

  115. {{- option('AuthorizedKeysFile') -}}

  116. {{- option('AuthorizedKeysCommand') -}}

  117. {{- option('AuthorizedKeysCommandUser') -}}

  118. 

  119. {#- Don't read the user's ~/.rhosts and ~/.shosts files -#}

  120. {{- option('IgnoreRhosts') -}}

  121. {#- For this to work you will also need host keys in /etc/ssh_known_hosts -#}

  122. {{- option('RhostsRSAAuthentication') -}}

  123. {#- similar for protocol version 2 -#}

  124. {{- option('HostbasedAuthentication') -}}

  125. {#- Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#}

  126. {{- option('IgnoreUserKnownHosts') -}}

  127. 

  128. {#- To enable empty passwords, change to yes (NOT RECOMMENDED) -#}

  129. {{- option('PermitEmptyPasswords') -}}

  130. 

  131. {#- Change to yes to enable challenge-response passwords (beware issues with -#}

  132. {#- some PAM modules and threads) -#}

  133. {{- option('ChallengeResponseAuthentication') -}}

  134. {{- option('AuthenticationMethods') -}}

  135. 

  136. {#- Change to no to disable tunnelled clear text passwords -#}

  137. {{- option('PasswordAuthentication') -}}

  138. 

  139. {#- Kerberos options -#}

  140. {{- option('KerberosAuthentication') -}}

  141. {{- option('KerberosGetAFSToken') -}}

  142. {{- option('KerberosOrLocalPasswd') -}}

  143. {{- option('KerberosTicketCleanup') -}}

  144. 

  145. {#- GSSAPI options -#}

  146. {{- option('GSSAPIAuthentication') -}}

  147. {{- option('GSSAPICleanupCredentials') -}}

  148. 

  149. {{- option('X11Forwarding') -}}

  150. {{- option('AllowTcpForwarding') -}}

  151. {{- option('X11DisplayOffset') -}}

  152. {{- option('PrintMotd') -}}

  153. {#- Bug in FreeBSD 10.3 (?) See https://lists.freebsd.org/pipermail/freebsd-stable/2016-April/084501.html -#}

  154. {% if not (salt['grains.get']('os') == 'FreeBSD' and salt['grains.get']('osrelease')|float >= 10.3) -%}

  155. {{- option('PrintLastLog') -}}

  156. {% endif -%}

  157. {{- option('TCPKeepAlive') -}}

  158. {{- option('UseLogin') -}}

  159. 

  160. {{- option('MaxStartups') -}}

  161. {{- option('Banner') -}}

  162. 

  163. {#- Allow client to pass locale environment variables -#}

  164. {{- option('AcceptEnv') -}}

  165. 

  166. {{- option('Subsystem') -}}

  167. 

  168. {% if not salt['grains.get']('os') == 'OpenBSD' -%}

  169. {#- Set this to 'yes' to enable PAM authentication, account processing, -#}

  170. {#- and session processing. If this is enabled, PAM authentication will -#}

  171. {#- be allowed through the ChallengeResponseAuthentication and -#}

  172. {#- PasswordAuthentication.  Depending on your PAM configuration, -#}

  173. {#- PAM authentication via ChallengeResponseAuthentication may bypass -#}

  174. {#- the setting of "PermitRootLogin without-password". -#}

  175. {#- If you just want the PAM account and session checks to run without -#}

  176. {#- PAM authentication, then enable this but set PasswordAuthentication -#}

  177. {#- and ChallengeResponseAuthentication to 'no'. -#}

  178. {{- option('UsePAM') -}}

  179. {%- endif %}

  180. 

  181. {#- DNS resolve and map remote IP addresses -#}

  182. {{- option('UseDNS') -}}

  183. 

  184. {#- Restricting Users and Hosts -#}

  185. {#- example: -#}

  186. {#-  AllowUsers vader@10.0.0.1 maul@sproing.evil.com luke -#}

  187. {#-  AllowGroups wheel staff -#}

  188. 

  189. {#- Keep in mind that using AllowUsers or AllowGroups means that anyone -#}

  190. {#- not Matching one of the supplied patterns will be denied access by default. -#}

  191. {#- Also, in order for sshd to allow access based on full or partial hostnames it -#}

  192. {#- needs to to a DNS lookup -#}

  193. 

  194. {# DenyUsers -#}

  195. {{- option_string_or_list('DenyUsers', sep=' ') }}

  196. {# AllowUsers -#}

  197. {{- option_string_or_list('AllowUsers', sep=' ') }}

  198. {# DenyGroups -#}

  199. {{- option_string_or_list('DenyGroups', sep=' ') }}

  200. {# AllowGroups -#}

  201. {{- option_string_or_list('AllowGroups', sep=' ') }}{{ "\n" -}}

  202. 

  203. 

  204. {#- Specifies the available KEX (Key Exchange) algorithms. -#}

  205. {{- option_string_or_list('KexAlgorithms') -}}

  206. 

  207. {#- Specifies the ciphers allowed for protocol version 2. -#}

  208. {{- option_string_or_list('Ciphers') -}}

  209. 

  210. {#- Specifies the available MAC (message authentication code) algorithms. -#}

  211. {{- option_string_or_list('MACs') -}}

  212. 

  213. {#- Handling unknown in salt template options -#}

  214. {%- for keyword in sshd_config.keys() %}

  215. {#-   Matches have to be at the bottom and should be handled differently -#}

  216. {%-   if not keyword in processed_options and keyword != 'matches' -%}

  217. {{- render_option(keyword) -}}

  218. {%    endif -%}

  219. {%- endfor %}

  220. 

  221. {#- Handle matches last as they need to go at the bottom -#}

  222. {%- if 'matches' in sshd_config %}

  223.   {%- for name, match in sshd_config['matches']|dictsort(true) %}

  224. Match

  225.     {#- Set up the match criteria -#}

  226.     {%- for criteria in match['type'].keys()|sort() -%}

  227.       {{ ' ' -}}{{criteria }} {{ join_to_string(match['type'], criteria) }}

  228.     {%- endfor %} #{{- name }}

  229. {#  Set up the applied options -#}

  230.     {%- for keyword in match['options'].keys()|sort() -%}

  231.       {%- if keyword in ['AllowUsers', 'DenyUsers', 'AllowGroups', 'DenyGroups'] -%}

  232.             {{ option_collapselist(keyword, ' ', config_dict=match['options']) | indent(4, true) }}

  233. {%        else -%}

  234.             {{ render_option(keyword, config_dict=match['options']) | indent(4, true) }}

  235. {%        endif -%}

  236. {%-     endfor %}

  237.   {%- endfor %}

  238. {%- endif %}

  239. 

  240. {#- vim: set ft=jinja : -#}