From 9729f09388b78d7e4e10ffe5158d7a7111be7ea3 Mon Sep 17 00:00:00 2001 From: 12ww1160 <12ww1160@confdroid.com> Date: Sun, 5 Apr 2026 15:26:08 +0200 Subject: [PATCH 1/3] OP#561 add source range --- manifests/firewall/iptables.pp | 3 ++- manifests/params.pp | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/manifests/firewall/iptables.pp b/manifests/firewall/iptables.pp index 83571b5..a43728e 100644 --- a/manifests/firewall/iptables.pp +++ b/manifests/firewall/iptables.pp @@ -9,9 +9,10 @@ class confdroid_ssh::firewall::iptables ( if $ssh_use_firewall { firewall { "${ssh_fw_order}${ssh_fw_port} allow SSH on port ${ssh_fw_port}": ensure => 'present', - jump => 'accept', proto => 'tcp', + source => $ssh_source_range, dport => $ssh_fw_port, + jump => 'accept', } } } diff --git a/manifests/params.pp b/manifests/params.pp index 2eb098a..e0b3ffb 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -7,6 +7,7 @@ # @param [Boolean] ssh_use_firewall whether to manage firewall settings # @param [String] ssh_fw_port port to use for SSHD and in fw # @param [String] ssh_fw_order order of firewall rule +# @param [String] ssh_source_range source range for firewall rule ############################################################################## class confdroid_ssh::params ( @@ -17,6 +18,7 @@ class confdroid_ssh::params ( Boolean $ssh_use_firewall = true, String $ssh_fw_port = '22', String $ssh_fw_order = '50', + String $ssh_source_range = '0.0.0.0/0', ) { # default facts From 29fdd463416bf3ecaff479a22afea35f1efee16c Mon Sep 17 00:00:00 2001 From: 12ww1160 <12ww1160@confdroid.com> Date: Sun, 5 Apr 2026 15:35:39 +0200 Subject: [PATCH 2/3] OP#561 add custom conf dir --- manifests/main/dirs.pp | 11 +++++++++++ manifests/main/files.pp | 9 +++++++++ manifests/params.pp | 4 ++++ templates/ssh_custom_conf.erb | 7 +++++++ 4 files changed, 31 insertions(+) create mode 100644 templates/ssh_custom_conf.erb diff --git a/manifests/main/dirs.pp b/manifests/main/dirs.pp index 896ccf6..e3ae64a 100644 --- a/manifests/main/dirs.pp +++ b/manifests/main/dirs.pp @@ -18,4 +18,15 @@ class confdroid_ssh::main::dirs ( seltype => etc_t, seluser => system_u, } + + file { $sshd_custom_path: + ensure => directory, + owner => $sshd_user, + group => $sshd_user, + mode => '0755', + selrange => s0, + selrole => object_r, + seltype => etc_t, + seluser => system_u, + } } diff --git a/manifests/main/files.pp b/manifests/main/files.pp index 8a0b862..43bca54 100644 --- a/manifests/main/files.pp +++ b/manifests/main/files.pp @@ -19,4 +19,13 @@ class confdroid_ssh::main::files ( seluser => system_u, content => template($sshd_config_erb), } + + if $ssh_manage_config { + file { "${ssh_etc_path}/sshd_config.d": + ensure => directory, + owner => 'root', + group => 'root', + mode => '0755', + } + } } diff --git a/manifests/params.pp b/manifests/params.pp index e0b3ffb..522f7b6 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -20,6 +20,9 @@ class confdroid_ssh::params ( String $ssh_fw_order = '50', String $ssh_source_range = '0.0.0.0/0', + # main configuration + Boolean $ssh_manage_config = true, + ) { # default facts $fqdn = $facts['networking']['fqdn'] @@ -32,6 +35,7 @@ class confdroid_ssh::params ( $ssh_etc_path = '/etc/ssh' $sshd_service = 'sshd' $sshd_config_path = "${ssh_etc_path}/sshd_config" + $sshd_custom_path = "${ssh_etc_path}/sshd_config.d" $sshd_config_erb = 'confdroid_ssh/ssh_config.erb' # includes must be last diff --git a/templates/ssh_custom_conf.erb b/templates/ssh_custom_conf.erb new file mode 100644 index 0000000..a6d7920 --- /dev/null +++ b/templates/ssh_custom_conf.erb @@ -0,0 +1,7 @@ +############################################################################### +##### DO NOT EDIT THIS FILE MANUALLY # +##### This file is managed by Puppet. Any changes to this file will be # +##### overwritten. The file is built via parameters, so any changes should # +##### be made in the Puppet manifest parameters. # +############################################################################### + From 80cf3c0d47fbc0c5c92f40cccd569e81ee39afc6 Mon Sep 17 00:00:00 2001 From: 12ww1160 <12ww1160@confdroid.com> Date: Sun, 5 Apr 2026 15:40:23 +0200 Subject: [PATCH 3/3] OP#561 add custom conf file --- README.md | 2 +- manifests/main/files.pp | 20 +++++++++++++------- manifests/params.pp | 3 +++ 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 8f82905..7da0eb5 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ ## Features - install required binaries -- manage configuration based on parameters +- manage local custom configuration based on parameters, overriding the defaults - manage service - (optional) manage firewall diff --git a/manifests/main/files.pp b/manifests/main/files.pp index 43bca54..f464f53 100644 --- a/manifests/main/files.pp +++ b/manifests/main/files.pp @@ -10,8 +10,8 @@ class confdroid_ssh::main::files ( file { $sshd_config_path: ensure => file, path => $sshd_config_path, - owner => 'root', - group => 'root', + owner => $sshd_user, + group => $sshd_user, mode => '0640', selrange => s0, selrole => object_r, @@ -21,11 +21,17 @@ class confdroid_ssh::main::files ( } if $ssh_manage_config { - file { "${ssh_etc_path}/sshd_config.d": - ensure => directory, - owner => 'root', - group => 'root', - mode => '0755', + file { $sshd_custom_conf: + ensure => file, + path => $sshd_custom_conf, + owner => $sshd_user, + group => $sshd_user, + mode => '0755', + selrange => s0, + selrole => object_r, + seltype => etc_t, + seluser => system_u, + content => template($sshd_custom_erb), } } } diff --git a/manifests/params.pp b/manifests/params.pp index 522f7b6..cf54a25 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -8,6 +8,7 @@ # @param [String] ssh_fw_port port to use for SSHD and in fw # @param [String] ssh_fw_order order of firewall rule # @param [String] ssh_source_range source range for firewall rule +# @param [Boolean] ssh_manage_config whether to manage the configuration ############################################################################## class confdroid_ssh::params ( @@ -36,6 +37,8 @@ class confdroid_ssh::params ( $sshd_service = 'sshd' $sshd_config_path = "${ssh_etc_path}/sshd_config" $sshd_custom_path = "${ssh_etc_path}/sshd_config.d" + $sshd_custom_conf = "${sshd_custom_path}/10-custom.conf" + $sshd_custom_erb = 'confdroid_ssh/ssh_custom_conf.erb' $sshd_config_erb = 'confdroid_ssh/ssh_config.erb' # includes must be last