Include ECDSA keys in ssh_known_hosts

diff --git a/cookbooks/openssh/recipes/default.rb b/cookbooks/openssh/recipes/default.rb
index ceb9a679290b37493768464bba9ca51de4981dec..79a2dd1fbddb83e08823fd199b2bd1c839cde0e2 100644 (file)
--- a/cookbooks/openssh/recipes/default.rb
+++ b/cookbooks/openssh/recipes/default.rb
@@ -42,11 +42,19 @@ end.collect do |node|
     names |= [ "#{node[:hostname]}.#{node[:networking][:roles][:external][:zone]}.openstreetmap.org" ]
   end
 
     names |= [ "#{node[:hostname]}.#{node[:networking][:roles][:external][:zone]}.openstreetmap.org" ]
   end
 

+  keys = {
+    "rsa" => node[:keys][:ssh][:host_rsa_public],
+    "dsa" => node[:keys][:ssh][:host_dsa_public]
+  }
+
+  if node[:keys][:ssh][:host_ecdsa_public]
+    keys[node[:keys][:ssh][:host_ecdsa_type]] = node[:keys][:ssh][:host_ecdsa_public]
+  end
+

   Hash[
     :names => names.sort,
     :addresses => node.ipaddresses.sort,
   Hash[
     :names => names.sort,
     :addresses => node.ipaddresses.sort,

-    :rsa => node[:keys][:ssh][:host_rsa_public],
-    :dsa => node[:keys][:ssh][:host_dsa_public]
+    :keys => keys

   ]
 end
 
   ]
 end
 

diff --git a/cookbooks/openssh/templates/default/ssh_known_hosts.erb b/cookbooks/openssh/templates/default/ssh_known_hosts.erb
index d3e92cc433fb47c9d6863097ca9fd509f64c831f..e71e9bb56e1c5bd0d66df529170c3c0d362cadfe 100644 (file)
--- a/cookbooks/openssh/templates/default/ssh_known_hosts.erb
+++ b/cookbooks/openssh/templates/default/ssh_known_hosts.erb
@@ -1,8 +1,9 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
 <% @hosts.each do |host| -%>
 # DO NOT EDIT - This file is being maintained by Chef
 
 <% @hosts.each do |host| -%>

-<%= host[:names].join(",") -%>,<%= host[:addresses].join(",") -%> ssh-rsa <%= host[:rsa] %>
-<%= host[:names].join(",") -%>,<%= host[:addresses].join(",") -%> ssh-dsa <%= host[:dsa] %>
+<% host[:keys].keys.sort.each do |type| -%>
+<%= host[:names].join(",") -%>,<%= host[:addresses].join(",") -%> <%= type %> <%= host[:keys][type] %>
+<% end -%>

 <% end -%>
 apc1,apc1.ucl.openstreetmap.org,10.0.0.49 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAYQDYDLYD52vwCagyebWxujdLw5/jnJ4Nln8g+pXFylT6OJU2R6t+U7mndZUKj1ClCt4AkS77/lEncs8Ie9YM3zzZlN0zsMEmhXzT62wO+0WJkr+hGSlTkMp1iL+dqC9Bk+U=
 apc2,apc2.ucl.openstreetmap.org,10.0.0.50 ssh-rsa AAAAB3NzaC1yc2EAAAACAQEAAAEBANYmUWIbP1bVQEcyeIoKZOvW/cyzmWytUA0u/057WGCMB70UKJrgmhRoArtxm3O4sFYS5b5xzhpcJ6YyYPjs3GMa67lkUBv/mOZEOIM20VeP7biRQf5DLrrSF5cS4A3p+ft7TyFPAuIgywxHQwpnRi7ZtBIPNj6MbRukUYivWrBVQML23O2hfWbwyLWQCTpedycgb1OFYbKC86r73PwW6ZP3Kzv0CDinDL2heEBT/hdeUkeXJCbop6tU3A4bA/obMTmKxsVoT2vEhto3v/bXFAFDQyYidBrOo+CBa3Nbbl+0wAZLBbrjkbQC7gz6TtU70ceLHo/cl8zmIQlHKa8c/Ec=
 <% end -%>
 apc1,apc1.ucl.openstreetmap.org,10.0.0.49 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAYQDYDLYD52vwCagyebWxujdLw5/jnJ4Nln8g+pXFylT6OJU2R6t+U7mndZUKj1ClCt4AkS77/lEncs8Ie9YM3zzZlN0zsMEmhXzT62wO+0WJkr+hGSlTkMp1iL+dqC9Bk+U=
 apc2,apc2.ucl.openstreetmap.org,10.0.0.50 ssh-rsa AAAAB3NzaC1yc2EAAAACAQEAAAEBANYmUWIbP1bVQEcyeIoKZOvW/cyzmWytUA0u/057WGCMB70UKJrgmhRoArtxm3O4sFYS5b5xzhpcJ6YyYPjs3GMa67lkUBv/mOZEOIM20VeP7biRQf5DLrrSF5cS4A3p+ft7TyFPAuIgywxHQwpnRi7ZtBIPNj6MbRukUYivWrBVQML23O2hfWbwyLWQCTpedycgb1OFYbKC86r73PwW6ZP3Kzv0CDinDL2heEBT/hdeUkeXJCbop6tU3A4bA/obMTmKxsVoT2vEhto3v/bXFAFDQyYidBrOo+CBa3Nbbl+0wAZLBbrjkbQC7gz6TtU70ceLHo/cl8zmIQlHKa8c/Ec=