Forge Home


puppet module to manage ssh


7,735 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.4.0 (latest)
  • 2.3.2
  • 2.3.0
  • 2.2.0
  • 2.1.0
  • 2.0.1
  • 2.0.0
released Sep 20th 2016
This version is compatible with:
  • Puppet Enterprise 2023.5.x, 2023.4.x, 2023.3.x, 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x, 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >=2.7.11
  • , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'aptituz-ssh', '2.4.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add aptituz-ssh
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install aptituz-ssh --version 2.4.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



aptituz/ssh — version 2.4.0 Sep 20th 2016

Puppet module: ssh

Table of contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Backwards incompatibility
  4. Setup - The basics of getting started with ssh
  5. Usage - Configuration options and additional functionality
  6. Reference - An under-the-hood peek at what the module is doing and how
  7. Limitations - OS compatibility, etc.
  8. Development - Guide for contributing to the module
  9. Contributors


This is a puppet module to manage openssh, including management of hostkeys and a global known_hosts file. Works on puppet >= 2.7 and Debian- aswell as RedHat-based systems.

##Module description

openssh is an integral part of most linux infrastructures and this module provides a way to manage it. Apart from package installation, configuration and service management, it supports two ways to manage a global known_hosts file:

  • based on storeconfig/puppetdb, by collecting the keys created with the package installation
  • based on keys generated by the module, cached on the server and rolled out by puppet (enduring re-provisioning and working without storeconfig)

Backwards incompatibility

This module has just gone through a refactoring, from the module previously written for my employer (credativ/puppet-ssh-hiera). It is no longer compatible to that module, since some of its distinct features (user management) and specifics have been removed and/or changed. This module is no longer using the params_lookup function, nor is it managing anything except ssh.


What ssh effects

  • openssh package
  • openssh configuration
  • openssh hostkey
  • openssh service
  • /etc/ssh/ssh_known_hosts

Beginning with ssh

If you just want a client installed, you can run include '::ssh::client'.

If you just want a server being installed and managed with default option, you can include '::ssh::server'.

If you need to customize options, such as the ListenAddress of the server or other configurations, you need to pass an options hash or use the appropriate parameters for a few often used cases.

class { '::ssh::server':
  permit_root_login => 'yes',
  listen_address    => '',
  options           => $options_hash

Refer to the template to see what keys can be used in the options hash. Its also possible to specify an own template via the config_template parameter.

Setup requirements

This module does not have specific requirements, except if you want it to generate and manage the hostkeys of the system. Then its required to mkdir a directory /etc/puppet/ssh on your puppetmaster host and give it appropriate permissions so that puppetmaster can create and write files.


You can include the classes you need and configure it via the parameters it supports. Please see the class docs for supported parameters and their meaning.



Currently only installs a ssh-client.


Installs and configures openssh-server, manages configuration and service by default and optionally hostkeys.

Parser Functions


The module includes a parser function ssh_keygen which can create and cache ssh keys on the server. Its used internally by the module if the module is configured to manage the hostkey.


The module contains the following public clases:

  • ssh::client
  • ssh::server

The following classes are currently not meant to be used directly, but used by the ssh::server class (depending on the parameters given).

  • ssh::known_hosts
  • ssh::known_hosts::storeconfig
  • ssh::hostkey


This module has been tested and is used primarily on Debian-based systems. Other systems are supported but cannot be guaranted.


I happily accept bug reports and pull requests via github.


This module is written and being maintained by

Patrick Schoenfeld <>.

It has been based on the module credativ/puppet-ssh-hiera, previously written for my employer and maintained together with my colleagues. It contains contributions from at least the following authors:

  • Damian Lukowski
  • Arnd Hannemann
  • Alexander Wirt
  • Tomas Barton
  • Simon Page