X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/3a4d52bd4c0f8e6ae7679145846b7bc7845d8ace..22bfa5e6f8152e492f21ae2c972a164474cfdd61:/cookbooks/openssh/recipes/default.rb diff --git a/cookbooks/openssh/recipes/default.rb b/cookbooks/openssh/recipes/default.rb index 90ac311b6..78df22c5e 100644 --- a/cookbooks/openssh/recipes/default.rb +++ b/cookbooks/openssh/recipes/default.rb @@ -1,15 +1,15 @@ # -# Cookbook Name:: openssh +# Cookbook:: openssh # Recipe:: default # -# Copyright 2010, OpenStreetMap Foundation. -# Copyright 2008-2009, Opscode, Inc. +# Copyright:: 2010, OpenStreetMap Foundation. +# Copyright:: 2008-2009, Opscode, Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -23,29 +23,35 @@ include_recipe "networking" package "openssh-client" package "openssh-server" +template "/etc/ssh/sshd_config.d/chef.conf" do + source "sshd_config.conf.erb" + owner "root" + group "root" + mode 0o644 + notifies :restart, "service[ssh]" + only_if { Dir.exist?("/etc/ssh/sshd_config.d") } +end + service "ssh" do - if node[:lsb][:release].to_f >= 14.04 - provider Chef::Provider::Service::Upstart - end - action [ :enable, :start ] + action [:enable, :start] supports :status => true, :restart => true, :reload => true end hosts = search(:node, "networking:interfaces").sort_by { |n| n[:hostname] }.collect do |node| - names = [ node[:hostname] ] + name = node.name.split(".").first - node.interfaces(:role => :external).each do |interface| - names |= [ "#{node[:hostname]}.openstreetmap.org" ] - names |= [ "#{node[:hostname]}.#{interface[:zone]}.openstreetmap.org" ] - end + names = [name] unless node.interfaces(:role => :internal).empty? - names |= [ "#{node[:hostname]}.#{node[:networking][:roles][:external][:zone]}.openstreetmap.org" ] + names.unshift("#{name}.#{node[:networking][:roles][:external][:zone]}.openstreetmap.org") + end + + unless node.interfaces(:role => :external).empty? + names.unshift("#{name}.openstreetmap.org") end keys = { - "rsa" => node[:keys][:ssh][:host_rsa_public], - "dsa" => node[:keys][:ssh][:host_dsa_public] + "ssh-rsa" => node[:keys][:ssh][:host_rsa_public] } if node[:keys][:ssh][:host_ecdsa_public] @@ -54,23 +60,20 @@ hosts = search(:node, "networking:interfaces").sort_by { |n| n[:hostname] }.coll keys[ecdsa_type] = node[:keys][:ssh][:host_ecdsa_public] end + if node[:keys][:ssh][:host_ed25519_public] + keys["ssh-ed25519"] = node[:keys][:ssh][:host_ed25519_public] + end + Hash[ - :names => names.sort, + :names => names, :addresses => node.ipaddresses.sort, :keys => keys ] end -template "/etc/ssh/ssh_config" do - source "ssh_config.erb" - mode 0644 - owner "root" - group "root" -end - template "/etc/ssh/ssh_known_hosts" do source "ssh_known_hosts.erb" - mode 0444 + mode 0o444 owner "root" group "root" backup false @@ -84,5 +87,5 @@ firewall_rule "accept-ssh" do source "net" dest "fw" proto "tcp:syn" - dest_ports "ssh" + dest_ports node[:openssh][:port] end