Gabriel Filion [Sun, 17 Jul 2011 04:21:44 +0000 (00:21 -0400)]
Provide a default value for $sshd_shared_ip in sshd::client
Since it's possible to "include sshd::client" without using "include
sshd" (e.g. installing/managing ssh client but not the server) provide a
default value for $sshd_shared_ip also in the sshd::client class.
Gabriel Filion [Sun, 17 Jul 2011 03:49:11 +0000 (23:49 -0400)]
Clean out $ssh_use_strong_ciphers
A tentative option from rhatto using the variable named
$ssh_use_strong_ciphers still has two lines in init.pp
Since the same functionality is provided by the variable
$ssh_hardened_ssl that was merged in the shared repository, rhatto
removed his feature. But there are still two lines left, so simply
remove them.
Micah Anderson [Mon, 21 Feb 2011 17:45:49 +0000 (12:45 -0500)]
remove HostbasedUsesNameFromPacketOnly yes from Debian sshd_config templates. This is not set in the Debian templates by default, and the default is actually no, not yes. If someone wishes to make a configuration variable they can, otherwise head/tail_additional options can be used
Micah Anderson [Sat, 19 Feb 2011 19:12:04 +0000 (14:12 -0500)]
Pull together a more comprehensive README, moving the configurable variables from init.pp into the README, and detailing the other features, and requirements, of the module
I always picked the shared repository version when conflicts arose.
The only exception to this rule was:
I kept my branch's "HostbasedUsesNameFromPacketOnly yes" in order
to be consistent with existing Etch and Lenny templates.
This is not the default Debian setting, but I would find it weird if a host
had this setting changed by Puppet after upgrading to Squeeze.
The right way to proceed would probably be to make this configurable.
Gabriel Filion [Mon, 27 Dec 2010 23:24:43 +0000 (18:24 -0500)]
Enable support for Ubuntu
The sshd class currently has a mechanism to make resources for Ubuntu
similar to the ones for Debian, but the sshd::client class doesn't.
Also, There are no templates for sshd_config on Ubuntu so provide for
them. Since Ubuntu releases almost all use ssh versions that are as
recent as the Debian squeeze one, and the default sshd_config file is
usually the same as on Debian, add a default (Ubuntu.erb) template so
that it fits all Ubuntu releases.
Gabriel Filion [Mon, 31 Jan 2011 02:24:00 +0000 (21:24 -0500)]
Finish fixing ChallengeResponseAuthentication
This value was hardcoded in both the Debian lenny and etch templates.
The lenny template was fixed with commit 167cf532711ac88 but the etch
template was left out.
Fix the etch template so that the ChallengeResponseAuthentication
instruction is not overridden.
Gabriel Filion [Thu, 20 Jan 2011 07:25:32 +0000 (02:25 -0500)]
ssh_authorized_key: use $name for user by default
Currently ssh_authorized_key has some logic about $user being false or
'', but it sets its value to default to 'root'.
So, in order to use the name as the user's name, one has to clear the
user parameter, which is totally redundant.
Since it is sometimes useful to publish multiple keys for a user, the
$user parameter is useful.
To make using ssh_authorized_key for one-key normal users simpler, make
$user default to being empty (which will use $name as the user name).
'root' can always be specified either via the name or by the $user
paramter.
Gabriel Filion [Thu, 20 Jan 2011 01:45:59 +0000 (20:45 -0500)]
Fix ssh_authorized_key
When one uses the $name to define the user that should receive an SSH
key, setting $user to a negative value, ssh_authorized_key currently
creates the authorized_keys file under /home/.ssh/authorized_keys
Fix this by changing ${user} to ${real_user} in the key's path.
Gabriel Filion [Wed, 19 Jan 2011 21:41:18 +0000 (16:41 -0500)]
Fix inclusion for default os
When the os of a client is not one of those that use a specialized
class, (e.g. FreeBSD) the inclusion is currently broken: it tries to
include sshd::default which does not exist.
Micah Anderson [Thu, 16 Dec 2010 01:38:07 +0000 (20:38 -0500)]
remote KerberosGetAFSToken, its actually not a functional configuration option, even though it is listed in the man page, and commented out in the default config file. I filed a bug with debian (#607238)
Micah Anderson [Tue, 14 Dec 2010 18:41:05 +0000 (13:41 -0500)]
"ChallengeResponseAuthentication no" was being hardcoded later in the Debian Lenny sshd_config template, even though we offer it as a variable. With this commit, the variable will actually work, rather than be overriden
projects / puppet-sshd.git / log