openssh-formula

Installs the openssh server package and service.

Manages SSH certificates for users.

Same functionality as openssh.auth but with a simplified Pillar syntax. Plays nicely with Pillarstack.

Installs a banner that users see when SSH-ing in.

Installs the openssh client package.

Installs the ssh daemon configuration file included in this formula (under "openssh/files"). This configuration file is populated by values from pillar. pillar.example results in the generation of the default sshd_config file on Debian Wheezy.

It is highly recommended PermitRootLogin is added to pillar so root login will be disabled.

Version of managing sshd_config that uses the ini_managed.option_present state module, so it enables to override only one or multiple values and keeping the defaults shipped by your distribution.

Manages /etc/ssh/ssh_known_hosts and fills it with the public SSH host keys of your minions (collected via the Salt mine) and of hosts listed in you pillar data. It’s possible to include minions managed via salt-ssh by using the known_hosts_salt_ssh renderer.

You can restrict the set of minions whose keys are listed by using the pillar data openssh:known_hosts:target and openssh:known_hosts:tgt_type (those fields map directly to the corresponding attributes of the mine.get function).

The Salt mine is used to share the public SSH host keys, you must thus configure it accordingly on all hosts that must export their keys. Two mine functions are required, one that exports the keys (one key per line, as they are stored in /etc/ssh/ssh_host_*_key.pub) and one that defines the public hostname that the keys are associated to. Here’s the way to setup those functions through pillar:

The above example assumes that the minion identifier is a valid DNS name that can be used to connect to the host. If that’s not the case, you might want to use the fqdn grain instead of the id one. The above example also uses the default mine function names used by this formula. If you have to use other names, then you should indicate the names to use in pillar keys openssh:known_hosts:mine_keys_function and openssh:known_hosts:mine_hostname_function.

You can also integrate alternate DNS names of the various hosts in /etc/ssh/ssh_known_hosts. You just have to specify all the alternate DNS names as a list in the openssh:known_hosts:aliases pillar key. Whenever the IPv4 or IPv6 behind one of those DNS entries matches an IPv4 or IPv6 behind the official hostname of a minion, the alternate DNS name will be associated to the minion’s public SSH host key.

To include minions managed via salt-ssh install the known_hosts_salt_ssh renderer:

You’ll find the cached pubkeys in Pillar openssh:known_hosts:salt_ssh.

It’s possible to define aliases for certain hosts:

The cache is populated by applying openssh.gather_host_keys to the salt master:

The state tries to fetch the SSH host keys via salt-ssh. It calls the command as user salt-master by default. The username can be changed via Pillar:

Use a cronjob to populate a host key cache:

If you must have the latest pubkeys, run the state before all others:

You can also use a "golden" known hosts file. It overrides the keys fetched by the cronjob. This lets you re-use the trust estabished in the salt-ssh user’s known_hosts file:

To add public keys of hosts not among your minions list them under the pillar key openssh:known_hosts:static:

Pillar openssh:known_hosts:static overrides openssh:known_hosts:salt_ssh.

To include localhost and local IP addresses (127.0.0.1 and ::1) use this Pillar:

To prevent ever-changing IP addresses from being added to a host, use this:

To completely disable adding IP addresses:

Manages the system wide /etc/ssh/moduli file.

Testing state which dumps the map.jinja values in /tmp/salt_mapdata_dump.yaml. This state is not called by any include but is mostly used by kitchen and Inspec infrastructure to validate map.jinja.

Where [platform] is the platform name defined in kitchen.yml, e.g. debian-9-2019-2-py3.

Creates the docker instance and runs the openssh main states, ready for testing.

Runs the inspec tests on the actual instance.

Removes the docker instance.

Runs all of the stages above in one go: i.e. destroy + converge
verify + destroy.

Gives you SSH access to the instance for manual testing.

Where [platform] is the platform name defined in kitchen.vagrant.yml, e.g. windows-81-latest-py3.

When testing using Vagrant you must set the environment variable KITCHEN_LOCAL_YAML to kitchen.vagrant.yml. For example:

Then run the following commands as needed.

Creates the Vagrant instance and runs the openssh main states, ready for testing.

Runs the inspec tests on the actual instance.

Removes the Vagrant instance.

Runs all of the stages above in one go: i.e. destroy + converge
verify + destroy.

Gives you RDP/SSH access to the instance for manual testing.