New option sshd_ports that obsoletes sshd_port.

Backward compatibility is preserved.

diff --git a/manifests/init.pp b/manifests/init.pp
index 4f8254254d5328649a9e87bc9c5bf534250929a4..abb1490ec56e798e0aee66de0cfa9385d4c9857e 100644 (file)
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -118,8 +118,11 @@
 #                              Valid Values: yes or no
 #                              Default: no
 #
-# sshd_port:                    If you want to specify a different port than the default 22
-#                               Default: 22
+# sshd_port:                    Deprecated, use sshd_ports instead.
+#
+# sshd_ports:                   If you want to specify a list of ports other than the default 22
+#                               Default: [22]
+#
 #
 # sshd_authorized_keys_file:    Set this to the location of the AuthorizedKeysFile (e.g. /etc/ssh/authorized_keys/%u)
 #                               Default: AuthorizedKeysFile    %h/.ssh/authorized_keys
@@ -193,8 +196,14 @@ class sshd {
   case $sshd_permit_empty_passwords {
     '': { $sshd_permit_empty_passwords = 'no' }
   }
-  case $sshd_port {
-    '': { $sshd_port = 22 }
+  if ( $sshd_port != '' ) && ( $sshd_ports != []) {
+      err("Cannot use sshd_port and sshd_ports at the same time.")
+  }
+  if $sshd_port != '' {
+      $sshd_ports = [ $sshd_port ]
+  }
+  elsif $sshd_port == [] {
+      $sshd_ports = [ 22 ]
   }
   case $sshd_authorized_keys_file {
     '': { $sshd_authorized_keys_file = "%h/.ssh/authorized_keys" }
@@ -224,9 +233,12 @@ class sshd {
   }
 
   if $use_nagios {
+    define sshd::nagios {
+        nagios::service{ "ssh_port_${name}": check_command => "check_ssh_port!$name" }
+    }
     case $nagios_check_ssh {
       false: { info("We don't do nagioschecks for ssh on ${fqdn}" ) }
-      default: { nagios::service{ "ssh_port_${sshd_port}": check_command => "check_ssh_port!$sshd_port" } }
+      default: { sshd::nagios($sshd_ports:) }
     }
   }
 

diff --git a/templates/sshd_config/CentOS.erb b/templates/sshd_config/CentOS.erb
index 9d02a3f5980d22c6745a68a150f024ff2baba031..da8bb9a11307f7fed7f8aebfebc470068b47e085 100644 (file)
--- a/templates/sshd_config/CentOS.erb
+++ b/templates/sshd_config/CentOS.erb
@@ -16,11 +16,13 @@
 
 # only protocol 2
 Protocol 2
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>

diff --git a/templates/sshd_config/Debian_etch.erb b/templates/sshd_config/Debian_etch.erb
index 9fef401451a5e18c255479c9c0e806500b61995c..391328b116b61563b23447386d19b0816fe2da80 100644 (file)
--- a/templates/sshd_config/Debian_etch.erb
+++ b/templates/sshd_config/Debian_etch.erb
@@ -6,11 +6,13 @@
 <%- end %>
 
 # What ports, IPs and protocols we listen for
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>

diff --git a/templates/sshd_config/Debian_lenny.erb b/templates/sshd_config/Debian_lenny.erb
index 4bb9c875ab9b47e72a2fa252510820c1af77c1cb..13264cc3f9e2dda2dbcbeb9e0aa5c43b9f250c17 100644 (file)
--- a/templates/sshd_config/Debian_lenny.erb
+++ b/templates/sshd_config/Debian_lenny.erb
@@ -6,11 +6,13 @@
 <%- end %>
 
 # What ports, IPs and protocols we listen for
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>

diff --git a/templates/sshd_config/Debian_squeeze.erb b/templates/sshd_config/Debian_squeeze.erb
index 0b915143b2d4ef6673000da8c0a354f567d9d3ee..439919fdabce723e648aa2b4d21985edef0b6684 100644 (file)
--- a/templates/sshd_config/Debian_squeeze.erb
+++ b/templates/sshd_config/Debian_squeeze.erb
@@ -6,11 +6,13 @@
 <%- end %>
 
 # What ports, IPs and protocols we listen for
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>

diff --git a/templates/sshd_config/Gentoo.erb b/templates/sshd_config/Gentoo.erb
index 291b2eada748431858c669354252ac7d4e57ad73..9058aeade3d550a1c50711ce9f51c0630daa44a4 100644 (file)
--- a/templates/sshd_config/Gentoo.erb
+++ b/templates/sshd_config/Gentoo.erb
@@ -14,11 +14,13 @@
 <%= sshd_head_additional_options %>
 <%- end %>
 
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>

diff --git a/templates/sshd_config/OpenBSD.erb b/templates/sshd_config/OpenBSD.erb
index c0517f44dbc5286083f8b59e6c7b5c535ff3e28d..3d57097b6e9a37085b822277679fcd13ebcd12c6 100644 (file)
--- a/templates/sshd_config/OpenBSD.erb
+++ b/templates/sshd_config/OpenBSD.erb
@@ -12,11 +12,13 @@
 <%= sshd_head_additional_options %>
 <%- end %>
 
-<%- if sshd_port.to_s == 'off' then -%>
+<%- sshd_ports.each do |port| -%>
+<%- if port.to_s == 'off' then -%>
 #Port -- disabled by puppet
 <% else -%>
-Port <%= sshd_port -%>
+Port <%= port -%>
 <% end -%>
+<%- end -%>
 
 # Use these options to restrict which interfaces/protocols sshd will bind to
 <% for address in sshd_listen_address -%>