716 lines
17 KiB
HTML
716 lines
17 KiB
HTML
<!DOCTYPE html>
|
||
<html>
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<title>
|
||
Puppet Class: confdroid_ssh::params
|
||
|
||
— Documentation by YARD 0.9.36
|
||
|
||
</title>
|
||
|
||
<link rel="stylesheet" href="../css/style.css" type="text/css" />
|
||
|
||
<link rel="stylesheet" href="../css/common.css" type="text/css" />
|
||
|
||
<script type="text/javascript">
|
||
pathId = "puppet_classes::confdroid_ssh::params";
|
||
relpath = '../';
|
||
</script>
|
||
|
||
|
||
<script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
|
||
|
||
<script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
|
||
|
||
|
||
</head>
|
||
<body>
|
||
<div class="nav_wrap">
|
||
<iframe id="nav" src="../puppet_class_list.html?1"></iframe>
|
||
<div id="resizer"></div>
|
||
</div>
|
||
|
||
<div id="main" tabindex="-1">
|
||
<div id="header">
|
||
<div id="menu">
|
||
|
||
<a href="../_index.html">Index (c)</a> »
|
||
<span class='title'><span class='object_link'>Puppet Classes</span></span>
|
||
»
|
||
<span class="title">confdroid_ssh::params</span>
|
||
|
||
</div>
|
||
|
||
<div id="search">
|
||
|
||
<a class="full_list_link" id="puppet_class_list_link"
|
||
href="../puppet_class_list.html">
|
||
|
||
<svg width="24" height="24">
|
||
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
||
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
||
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
||
</svg>
|
||
</a>
|
||
|
||
</div>
|
||
<div class="clear"></div>
|
||
</div>
|
||
|
||
<div id="content"><h1>Puppet Class: confdroid_ssh::params</h1>
|
||
<div class="box_info">
|
||
|
||
|
||
<dl>
|
||
<dt>Inherited by:</dt>
|
||
<dd>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Amain_3A_3Adirs.html" title="puppet_classes::confdroid_ssh::main::dirs (puppet_class)">confdroid_ssh::main::dirs</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Amain_3A_3Afiles.html" title="puppet_classes::confdroid_ssh::main::files (puppet_class)">confdroid_ssh::main::files</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Amain_3A_3Aconfig.html" title="puppet_classes::confdroid_ssh::main::config (puppet_class)">confdroid_ssh::main::config</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Amain_3A_3Ainstall.html" title="puppet_classes::confdroid_ssh::main::install (puppet_class)">confdroid_ssh::main::install</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Amain_3A_3Aservice.html" title="puppet_classes::confdroid_ssh::main::service (puppet_class)">confdroid_ssh::main::service</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Aselinux_3A_3Asemanage.html" title="puppet_classes::confdroid_ssh::selinux::semanage (puppet_class)">confdroid_ssh::selinux::semanage</a></span><br/>
|
||
|
||
<span class='object_link'><a href="confdroid_ssh_3A_3Afirewall_3A_3Aiptables.html" title="puppet_classes::confdroid_ssh::firewall::iptables (puppet_class)">confdroid_ssh::firewall::iptables</a></span><br/>
|
||
|
||
</dd>
|
||
</dl>
|
||
|
||
<dl>
|
||
<dt>Defined in:</dt>
|
||
<dd>
|
||
manifests/params.pp
|
||
</dd>
|
||
</dl>
|
||
</div>
|
||
|
||
<h2>Summary</h2>
|
||
Class contains all class parameters for confdroid_ssh
|
||
|
||
<h2>Overview</h2>
|
||
<div class="docstring">
|
||
<div class="discussion">
|
||
|
||
<p>confdroid_ssh::params.pp Module name: confdroid_ssh Author: 12ww1160 (12ww1160@confdroid.com)</p>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
<div class="tags">
|
||
<p class="tag_title">Parameters:</p>
|
||
<ul class="param">
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_reqpackages</span>
|
||
|
||
|
||
<span class='type'>(<tt>Array</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>['openssh','openssh-clients','openssh-server']</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>packages to install</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>pkg_ensure</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'present'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>version to install: ‘present’ or ‘latest’</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_fw_rule</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'present'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>whether set the fw rule to present or absent.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_fw_port</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'22'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>port to use for SSHD and in fw</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_fw_order</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'50'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>order of firewall rule</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_source_range</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'0.0.0.0/0'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>source range for firewall rule</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_manage_config</span>
|
||
|
||
|
||
<span class='type'>(<tt>Boolean</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>true</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>whether to manage the configuration</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_address_family</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'any'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>AddressFamily setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_listen_address</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'0.0.0.0'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>ListenAddress setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_root_login</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'prohibit-password'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>PermitRootLogin setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_strict_modes</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'yes'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>StrictModes setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_max_auth_tries</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'6'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>MaxAuthTries setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_max_sessions</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'10'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>MaxSessions setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_pubkey_auth</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'yes'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>PubkeyAuthentication setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_auth_key_files</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'.ssh/authorized_keys'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>AuthorizedKeysFile setting for sshd_config</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_authorized_principals_file</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'none'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>AuthorizedPrincipalsFile setting for sshd_config. Default is ‘none’ to disable this setting.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_authorized_keys_command</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'none'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>AuthorizedKeysCommand setting for sshd_config. Default is ‘none’ to disable this setting.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_authorized_keys_command_user</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'nobody'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>AuthorizedKeysCommandUser setting for sshd_config. Default is ‘nobody’ to use an unpriviledged user.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_use_specific_hostkey</span>
|
||
|
||
|
||
<span class='type'>(<tt>Boolean</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>false</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>whether to use a specific host key</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_hostkey_type</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'rsa'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>type of host key to use if ssh_use_specific_hostkey is true</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_rekeylimit</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'default none'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>RekeyLimit setting for sshd_config. Default is ‘default none’.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_syslog_facility</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'AUTH'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>SyslogFacility setting for sshd_config. Default is ‘AUTH’.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_log_level</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'INFO'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>LogLevel setting for sshd_config. Default is ‘INFO’.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_password_authentication</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'no'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>PasswordAuthentication setting for sshd_config. Default is ‘no’, which requires key-based authentication. This is a recommended security setting, so passwords do not show up in logs, but can be set to ‘yes’ if password authentication is desired.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_permit_empty_passwords</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'no'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>PermitEmptyPasswords setting for sshd_config. Default is ‘no’, which is a recommended security setting and works in connection with key-based authentication, but can be set to ‘yes’ if password authentication should be allowed and empty passwords should be allowed. Again, this should be used with caution if enabled.</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<span class='name'>ssh_kbd_interactive_auth</span>
|
||
|
||
|
||
<span class='type'>(<tt>String</tt>)</span>
|
||
|
||
|
||
<em class="default">(defaults to: <tt>'no'</tt>)</em>
|
||
|
||
|
||
—
|
||
<div class='inline'>
|
||
<p>setting for sshd_config. Default is ‘no’, which is a recommended security setting together with password authentication, but can be set to ‘yes’ if keyboard-interactive authentication should be allowed. (not recommended)</p>
|
||
</div>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
|
||
|
||
|
||
</div><div class="method_details_list">
|
||
<table class="source_code">
|
||
<tr>
|
||
<td>
|
||
<pre class="lines">
|
||
|
||
|
||
50
|
||
51
|
||
52
|
||
53
|
||
54
|
||
55
|
||
56
|
||
57
|
||
58
|
||
59
|
||
60
|
||
61
|
||
62
|
||
63
|
||
64
|
||
65
|
||
66
|
||
67
|
||
68
|
||
69
|
||
70
|
||
71
|
||
72
|
||
73
|
||
74
|
||
75
|
||
76
|
||
77
|
||
78
|
||
79
|
||
80
|
||
81
|
||
82
|
||
83
|
||
84
|
||
85
|
||
86
|
||
87
|
||
88
|
||
89
|
||
90
|
||
91
|
||
92
|
||
93
|
||
94
|
||
95
|
||
96
|
||
97
|
||
98
|
||
99
|
||
100
|
||
101
|
||
102
|
||
103</pre>
|
||
</td>
|
||
<td>
|
||
<pre class="code"><span class="info file"># File 'manifests/params.pp', line 50</span>
|
||
|
||
class confdroid_ssh::params (
|
||
|
||
Array $ssh_reqpackages = ['openssh','openssh-clients','openssh-server'],
|
||
String $pkg_ensure = 'present',
|
||
|
||
# firewall settings
|
||
String $ssh_fw_rule = 'present',
|
||
String $ssh_fw_port = '22',
|
||
String $ssh_fw_order = '50',
|
||
String $ssh_source_range = '0.0.0.0/0',
|
||
|
||
# sshd configuration
|
||
Boolean $ssh_manage_config = true,
|
||
String $ssh_address_family = 'any',
|
||
String $ssh_listen_address = '0.0.0.0',
|
||
String $ssh_root_login = 'prohibit-password',
|
||
String $ssh_strict_modes = 'yes',
|
||
String $ssh_max_auth_tries = '6',
|
||
String $ssh_max_sessions = '10',
|
||
String $ssh_pubkey_auth = 'yes',
|
||
String $ssh_auth_key_files = '.ssh/authorized_keys',
|
||
String $ssh_authorized_principals_file = 'none',
|
||
String $ssh_authorized_keys_command = 'none',
|
||
String $ssh_authorized_keys_command_user = 'nobody',
|
||
Boolean $ssh_use_specific_hostkey = false,
|
||
String $ssh_hostkey_type = 'rsa',
|
||
String $ssh_rekeylimit = 'default none',
|
||
String $ssh_syslog_facility = 'AUTH',
|
||
String $ssh_log_level = 'INFO',
|
||
String $ssh_password_authentication = 'no',
|
||
String $ssh_permit_empty_passwords = 'no',
|
||
String $ssh_kbd_interactive_auth = 'no'
|
||
|
||
) {
|
||
# default facts
|
||
$fqdn = $facts['networking']['fqdn']
|
||
$hostname = $facts['networking']['hostname']
|
||
$domain = $facts['networking']['domain']
|
||
$os_name = $facts['os']['name']
|
||
$os_release = $facts['os']['release']['major']
|
||
|
||
$sshd_user = 'root'
|
||
$ssh_etc_path = '/etc/ssh'
|
||
$sshd_service = 'sshd'
|
||
$sshd_config_path = "${ssh_etc_path}/sshd_config"
|
||
$sshd_custom_path = "${ssh_etc_path}/sshd_config.d"
|
||
$sshd_custom_conf = "${sshd_custom_path}/10-custom.conf"
|
||
$sshd_custom_erb = 'confdroid_ssh/sshd_custom_conf.erb'
|
||
$sshd_config_erb = 'confdroid_ssh/sshd_config.erb'
|
||
$sshd_root_login_file = "${sshd_custom_path}/01-permitrootlogin.conf"
|
||
|
||
# includes must be last
|
||
include confdroid_ssh::main::config
|
||
}</pre>
|
||
</td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
</div>
|
||
|
||
<div id="footer">
|
||
Generated by <a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>.
|
||
</div>
|
||
|
||
</div>
|
||
</body>
|
||
</html> |