Reference

Table of Contents

Classes

• openssh: openssh main class (internal variables initialization)
• openssh::config: Setup SSHD daemon configuration
• openssh::keys: Set up authorized_keys file for root account
• openssh::package: Manage OpenSSH daemon and client packages
• openssh::params: openssh module parameters
• openssh::service: Manage SSHd daemon service
• openssh::ssh_keygen: A short summary of the purpose of this class

Defined types

• openssh::auth_key: A short summary of the purpose of this defined type.
• openssh::priv_key: Set SSH private key for user.
• openssh::ssh_config: A short summary of the purpose of this defined type.

Data types

• Openssh::ClientOption
• Openssh::KeyType
• Openssh::SshConfig

Classes

openssh

Openssh class for variables initialization

Examples

include openssh

Parameters

The following parameters are available in the openssh class.

allow_tcp_forwarding

Data type: String

permit_root_login

Data type: String

strict_modes

Data type: String

gss_api_authentication

Data type: String

config_template

Data type: String

keys_file

Data type: Optional[String]

banner

Data type: String

manage_server_package

Data type: Boolean

manage_client_package

Data type: Boolean

sshkey_user

Data type: String

sshkey_group

Data type: Optional[String]

sshkey_dir

Data type: String

sshkey_name

Data type: Optional[String]

sshkey_type

Data type: String

sshkey_target

Data type: String

sshkey_options

Data type: Array[String]

setup_host_key

Data type: Boolean

ssh_port

Data type: Integer

Default value: $openssh::params::ssh_port

config

Data type: String

Default value: $openssh::params::config

base_package_name

Data type: String

Default value: $openssh::params::base_package_name

server_package_name

Data type: Optional[String]

Default value: $openssh::params::server_package_name

client_package_name

Data type: Optional[String]

Default value: $openssh::params::client_package_name

server_dependencies

Data type: Optional[ Array[String] ]

Default value: $openssh::params::openssh_server_dependencies

openssh::config

Setup SSHD daemon configuration based on template

Examples

include openssh::config

Parameters

The following parameters are available in the openssh::config class.

config

Data type: Stdlib::Unixpath

Default value: $openssh::config

ssh_port

Data type: Stdlib::Port

Default value: $openssh::ssh_port

config_template

Data type: String

Default value: $openssh::config_template

banner

Data type: Variant[ Enum['none'], Stdlib::Unixpath ]

Default value: $openssh::banner

keys_file

Data type: Optional[String]

Default value: $openssh::keys_file

allow_tcp_forwarding

Data type: Enum['yes', 'no', 'all', 'local', 'remote']

Default value: $openssh::allow_tcp_forwarding

permit_root_login

Data type: Enum['yes', 'no', 'without-password', 'prohibit-password', 'forced-commands-only']

Default value: $openssh::permit_root_login

strict_modes

Data type: Enum['yes', 'no']

Default value: $openssh::strict_modes

gss_api_authentication

Data type: Enum['yes', 'no']

Default value: $openssh::gss_api_authentication

setup_host_key

Data type: Boolean

Default value: $openssh::setup_host_key

openssh::keys

Set up authorized_keys file for root account

Examples

include openssh::keys

Parameters

The following parameters are available in the openssh::keys class.

sshkey_user

Data type: String

The user account in which the SSH key should be installed. The resource will autorequire this user if it is being managed as a user resource.

Default value: $openssh::sshkey_user

authorized

Data type: Optional[ Array[ Struct[{ type => String, key => String, name => String, }] ] ]

If provided - it is exact list of SSH public keys to be added into user root account All other settings will be ignored except sshkey_dir

Default value: undef

sshkey

Data type: Optional[Stdlib::Base64]

The public key itself; generally a long string of hex characters. The key attribute may not contain whitespace.

Make sure to omit the following in this attribute (and specify them in other attributes):

• Key headers, such as ‘ssh-rsa’ — put these in the type attribute.
• Key identifiers / comments, such as ‘joe@joescomputer.local’ — put these in the name attribute/resource title.

Default value: undef

sshkey_name

Data type: Optional[String]

The SSH key comment. This can be anything, and doesn’t need to match the original comment from the .pub file.

Due to internal limitations, this must be unique across all user accounts; if you want to specify one key for multiple users, you must use a different comment for each instance.

Default value: $openssh::sshkey_name

sshkey_type

Data type: Openssh::KeyType

The encryption type used. Allowed values: ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519 dsa ed25519 rsa

Default value: $openssh::sshkey_type

sshkey_target

Data type: Stdlib::Unixpath

The absolute filename in which to store the SSH key. This property is optional and should be used only in cases where keys are stored in a non- standard location, for instance when not in ~user/.ssh/authorized_keys

Default value: $openssh::sshkey_target

sshkey_options

Data type: Array[String]

Key options; see sshd(8) for possible values. Multiple values should be specified as an array.

Default value: $openssh::sshkey_options

sshkey_ensure

Data type: Enum['present', 'absent']

Default value: present

sshkey_propagate

Data type: Boolean

Default value: false

sshkey_group

Data type: Optional[String]

Default value: $openssh::sshkey_group

sshkey_dir

Data type: Stdlib::Unixpath

Default value: $openssh::sshkey_dir

openssh::package

Manage OpenSSH daemon and client packages

Examples

include openssh::package

Parameters

The following parameters are available in the openssh::package class.

package_ensure

Data type: String

Default value: present

client_ensure

Data type: String

Default value: present

server_ensure

Data type: String

Default value: present

package_name

Data type: String

Default value: $openssh::base_package_name

manage_client

Data type: Boolean

Default value: $openssh::manage_client_package

client_package

Data type: Optional[String]

Default value: $openssh::client_package_name

manage_server

Data type: Boolean

Default value: $openssh::manage_server_package

server_package

Data type: Optional[String]

Default value: $openssh::server_package_name

server_dependencies

Data type: Optional[ Array[String] ]

Default value: $openssh::openssh_server_dependencies

openssh::params

Openssh module parameters

Examples

include openssh::params

openssh::service

Manage SSHd daemon service

Examples

include openssh::service

Parameters

The following parameters are available in the openssh::service class.

service_enabled

Data type: Boolean

Default value: true

service_ensure

Data type: String

Default value: running

service_name

Data type: String

Default value: $openssh::params::service_name

openssh::ssh_keygen

Generate new OpenSSH private key or export root public key

Examples

include openssh::ssh_keygen

Parameters

The following parameters are available in the openssh::ssh_keygen class.

sshkey_name

Data type: String

Default value: $openssh::sshkey_name

sshkey_user

Data type: String

Default value: $openssh::sshkey_user

sshkey_type

Data type: Openssh::KeyType

Default value: $openssh::sshkey_type

sshkey_target

Data type: Stdlib::Unixpath

Default value: $openssh::sshkey_target

sshkey_dir

Data type: Stdlib::Unixpath

Default value: $openssh::sshkey_dir

sshkey_options

Data type: Array[String]

Default value: $openssh::sshkey_options

sshkey_ensure

Data type: String

Default value: present

sshkey_bits

Data type: Integer

Default value: 2048

root_key_export

Data type: Boolean

Default value: true

sshkey_generate_enable

Data type: Boolean

Default value: false

Defined types

openssh::auth_key

A description of what this defined type does

Examples

openssh::auth_key { 'namevar': }

Parameters

The following parameters are available in the openssh::auth_key defined type.

sshkey_user

Data type: String

The user account in which the SSH key should be installed

sshkey_ensure

Data type: Enum['present', 'absent']

Default value: present

sshkey_type

Data type: Openssh::KeyType

Default value: 'ssh-rsa'

sshkey_name

Data type: Optional[String]

The The SSH key name/comment. In their native habitat, SSH keys usually appear as a single long line, in the format: <TYPE> <KEY> <NAME/COMMENT>

Default value: undef

sshkey_target

Data type: Optional[Stdlib::Unixpath]

Default value: undef

sshkey_options

Data type: Optional[Array[String]]

Default value: undef

sshkey

Data type: Optional[Stdlib::Base64]

Default value: undef

sshkey_export

Data type: Boolean

Boolean flag. If set to true openssh::auth_key resource will export ssh host key via resource Sshkey with title equal to <fqdn>_<sshkey_user>_known_host where <fqdn> is puppet fact $::fqdn and <sshkey_user> is sshkey_user parameter. The Sshkey resource's target parameter will be set to ~/.ssh/known_hosts path for user sshkey_user (with home directory /root for user root and /home/<sshkey_user> for all other users)

Default value: true

sshkey_propagate

Data type: Boolean

Boolean flag. If set to true openssh::auth_key resource will import Ssh_authorized_key resource with title equal: 1) to either parameter sshkey_name or 2) to name combined from parameter sshkey_user and fact $::hostname as string <sshkey_user>@<hostname>

Default value: false

openssh::priv_key

Set SSH private key for user.

Examples

openssh::priv_key { 'namevar': }

Parameters

The following parameters are available in the openssh::priv_key defined type.

user_name

Data type: String

The name of system user for which private key should be set Used for SSH directory compilation (either /root/.ssh if user is 'root' or /home/user_name/.ssh) Used as ownership group if user_group is not specified Used for SSH public key comment during public key generating

key_data

Data type: String

SSH private key content

sshkey_name

Data type: Optional[String]

SSH public key comment (will be set if specified)

Default value: $name

sshkey_format

Data type: Enum['PEM', 'RFC4716', 'PKCS8']

Default is 'PEM' The supported key formats are: "RFC4716" (RFC 4716/SSH2 public or private key), "PKCS8" (PEM PKCS8 public key) or "PEM" (PEM public key). The default conversion format for ssh-keygen tool is "RFC4716"

Default value: 'PEM'

sshkey_type

Data type: Openssh::KeyType

Default is 'rsa' SSH private key type (eg rsa or dsa) Used for SSH private and public key file name compilation (eg .ssh/id_<key_id> where key_id is the type of key: dsa | ecdsa | ed25519 | rsa)

Default value: 'ssh-rsa'

user_group

Data type: Optional[String]

Private key ownership group

Default value: undef

sshkey_dir

Data type: Optional[Stdlib::Unixpath]

SSH directory which used for SSH keys storage instead of standard one compiled based on user_name

Default value: undef

generate_public

Data type: Boolean

if set - public key will be generated with suffix .pub based on private key

Default value: false

key_prefix

Data type: Optional[Pattern[/^[-a-z0-9]+$/]]

if set - used for private and public file name compilation as prefix (eg git.id_rsa where key_prefix is git)

Default value: undef

openssh::ssh_config

A description of what this defined type does

Examples

openssh::ssh_config { 'namevar': }

Parameters

The following parameters are available in the openssh::ssh_config defined type.

ssh_config

Data type: Array[Openssh::SshConfig]

user_name

Data type: String

Default value: $name

user_group

Data type: Optional[String]

Default value: undef

system_wide

Data type: Boolean

Default value: false

sshkey_dir

Data type: Optional[Stdlib::Unixpath]

Default value: undef

Data types

Openssh::ClientOption

The Openssh::ClientOption data type.

Alias of Enum['AddressFamily', 'BatchMode', 'BindAddress', 'ChallengeResponseAuthentication', 'CheckHostIP', 'Cipher', 'Ciphers', 'ClearAllForwardings', 'Compression', 'CompressionLevel', 'ConnectionAttempts', 'ConnectTimeout', 'ControlMaster', 'ControlPath', 'ControlPersist', 'DynamicForward', 'EnableSSHKeysign', 'EscapeChar', 'ExitOnForwardFailure', 'ForwardAgent', 'ForwardX11', 'ForwardX11Trusted', 'GatewayPorts', 'GlobalKnownHostsFile', 'GSSAPIAuthentication', 'GSSAPIKeyExchange', 'GSSAPIClientIdentity', 'GSSAPIDelegateCredentials', 'GSSAPIRenewalForcesRekey', 'GSSAPITrustDns', 'GSSAPIKexAlgorithms', 'Host', 'HashKnownHosts', 'HostbasedAuthentication', 'HostKeyAlgorithms', 'HostKeyAlias', 'HostName', 'IdentitiesOnly', 'IdentityFile', 'KbdInteractiveAuthentication', 'KbdInteractiveDevices', 'KexAlgorithms', 'LocalCommand', 'LocalForward', 'LogLevel', 'MACs', 'NoHostAuthenticationForLocalhost', 'NumberOfPasswordPrompts', 'PasswordAuthentication', 'PermitLocalCommand', 'PKCS11Provider', 'Port', 'PreferredAuthentications', 'Protocol', 'ProxyCommand', 'PubkeyAuthentication', 'RekeyLimit', 'RemoteForward', 'RhostsRSAAuthentication', 'RSAAuthentication', 'SendEnv', 'ServerAliveCountMax', 'ServerAliveInterval', 'StrictHostKeyChecking', 'TCPKeepAlive', 'Tunnel', 'TunnelDevice', 'UsePrivilegedPort', 'User', 'UserKnownHostsFile', 'VerifyHostKeyDNS', 'VisualHostKey', 'XAuthLocation']

Openssh::KeyType

The Openssh::KeyType data type.

Alias of Enum['ssh-dss', 'ssh-rsa', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-ed25519', 'dsa', 'ed25519', 'rsa']

Openssh::SshConfig

The Openssh::SshConfig data type.

Alias of Hash[Openssh::ClientOption, Variant[ String, Integer, Array[String, 1], ]]

Changelog

All notable changes to this project will be documented in this file.

Release 0.1.0

Features

Bugfixes

Known Issues

Release 0.4.5

Features

• Added flag manage_sshkey_target to disable sshkey_target directory management

Bugfixes

Known Issues

Release 0.4.6

Features

• Set sshkey_name to defined resource title for uniquness
• Disable sshkey_export by default

Bugfixes

• Bugfix for dependency on sshkey_target directory management Exec

Known Issues

Release 0.4.7

Features

Bugfixes

• Corrected parameter name in openssh::package

Known Issues

Release 0.4.8

Features

• Added ability to tag exported sshkey resources

Bugfixes

Known Issues

Release 0.4.9

Features

• Added Openssh::Switch type to use true/false for some parameters
• Added boolean to challenge_response_authentication and password_authentication parameter

Bugfixes

Known Issues

Release 0.4.10

Features

• Added hardening for OpenSSH binaries

Bugfixes

Known Issues

Release 0.5.0

Features

Bugfixes

• Fixed sshd config template to properly interpret switch parameters

Known Issues

Release 0.6.0

Features

• Added custom path to system wide SSH configuration file to allow setting up /etc/ssh/ssh_config.d/*.conf

Bugfixes

Known Issues

Release 0.6.2

Features

Bugfixes

• Bugfix for Ubuntu

Known Issues

Release 0.6.3

Features

• Added ability to define custom_ssh_keys for profile openssh::profile::server

Bugfixes

• Improved user root key export integrity
• Added some Ubuntu 18.04 support

Known Issues

Release 0.6.4

Features

• Added type Openssh::SshKey

Bugfixes

• Corrected custom_ssh_keys parameter type for profile openssh::profile::server

Known Issues

Release 0.6.5

Features

Bugfixes

• Added workaround for SSH public key comment setup

Known Issues

Release 0.6.6

Features

• Added $sshkey_ensure flag for openssh::priv_key

Bugfixes

• Added $sshkey_enable to manage exec resources in openssh::auth_key

Known Issues

Release 0.6.7

Features

Bugfixes

• Fixed resource dependencies

Known Issues

Release 0.6.8

Features

• Added ability to disable ed25519 key setup

Bugfixes

Known Issues

Release 0.6.9

Features

• PDK upgrade to version 2.3.0

Bugfixes

Known Issues

Release 0.7.0

Features

• Added Rocky Linux 8 support
• Added user's ssh directory management in priv_key

Bugfixes

Known Issues

Release 0.8.0

Features

• PDK upgrade to 3.0.0

Bugfixes

Known Issues

Release 0.9.0

Features

• Added type Openssh::KeyID

Bugfixes

Known Issues

Release 0.9.2

Features

• Added sshkey_export_tag into openssh::keys
• Added export_tags_extra for an additional list of tags

Bugfixes

Known Issues

Release 0.9.3

Features

• Added install_options to pass to package installations
• Added HostKeyAlgorithms into openssh sshd_config

Bugfixes

Known Issues

Release 0.9.4

Features

• Added sshkey export resources for all existing host keys

Bugfixes

Known Issues

Release 0.9.5

Features

Bugfixes

• Corrected base_package_name and package_provider for Ubuntu OS

Known Issues

Release 0.9.6

Features

Bugfixes

• Corrected service name for Ubuntu OS

Known Issues