init.sls 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127
  1. #
  2. # SSH configuration
  3. #
  4. {% set node_config = salt['pillar.get']('nodes:' ~ grains.id) %}
  5. # Install ssh server
  6. ssh:
  7. pkg.installed:
  8. - name: 'openssh-server'
  9. service.running:
  10. - enable: True
  11. - reload: True
  12. # Enforce pubkey auth (disable password auth) and reload server on config change
  13. /etc/ssh/sshd_config:
  14. file.managed:
  15. - source:
  16. - salt://ssh/sshd_config.{{ grains.os }}.{{ grains.oscodename }}
  17. - salt://ssh/sshd_config
  18. - user: root
  19. - group: root
  20. - mode: 644
  21. - watch_in:
  22. - service: ssh
  23. {% set users = ['root'] %}
  24. {% for user, user_config in node_config.get('ssh', {}).items() if user not in ['host'] and user not in users %}
  25. {% do users.append(user) %}
  26. {% endfor %}
  27. {% for user in users %}
  28. {% set path = '/' + user %}
  29. {% if user not in ['root'] %}
  30. {% set path = '/home' + path %}
  31. {% endif %}
  32. {# Create user if not present#}
  33. ssh-{{ user }}:
  34. user.present:
  35. - name: {{ user }}
  36. - shell: /bin/bash
  37. - home: {{ path }}
  38. - createhome: True
  39. - gid_from_name: True
  40. - system: False
  41. {# Create .ssh dir #}
  42. {{ path }}/.ssh:
  43. file.directory:
  44. - user: {{ user }}
  45. - group: {{ user }}
  46. - mode: 700
  47. - require:
  48. - user: ssh-{{ user }}
  49. {# Create authorized_keys for user (MASTER + host specific) #}
  50. {{ path }}/.ssh/authorized_keys:
  51. file.managed:
  52. - source: salt://ssh/authorized_keys.tmpl
  53. - template: jinja
  54. username: {{ user }}
  55. - user: {{ user }}
  56. - group: {{ user }}
  57. - mode: 644
  58. - require:
  59. - file: {{ path }}/.ssh
  60. {% if user in node_config.get('ssh', {}) %}
  61. {% set user_config = node_config.get('ssh:' + user, {}) %}
  62. {# Add SSH-Keys for user #}
  63. {{ path }}/.ssh/id_rsa:
  64. file.managed:
  65. - contents_pillar: nodes:{{ grains.id }}:ssh:{{ user }}:privkey
  66. - user: {{ user }}
  67. - group: {{ user }}
  68. - mode: 600
  69. - require:
  70. - file: {{ path }}/.ssh
  71. {{ path }}/.ssh/id_rsa.pub:
  72. file.managed:
  73. - contents_pillar: nodes:{{ grains.id }}:ssh:{{ user }}:pubkey
  74. - user: {{ user }}
  75. - group: {{ user }}
  76. - mode: 644
  77. - require:
  78. - file: {{ path }}/.ssh
  79. {% endif %}
  80. {% endfor %}
  81. # Manage host keys
  82. {% for key in node_config.get('ssh', {}).get('host', {}) if key in ['dsa', 'ecdsa', 'ed25519', 'rsa'] %}
  83. /etc/ssh/ssh_host_{{ key }}_key:
  84. file.managed:
  85. - contents_pillar: nodes:{{ grains.id }}:ssh:host:{{ key }}:privkey
  86. - mode: 600
  87. - watch_in:
  88. - service: ssh
  89. /etc/ssh/ssh_host_{{ key }}_key.pub:
  90. file.managed:
  91. - contents_pillar: nodes:{{ grains.id }}:ssh:host:{{ key }}:pubkey
  92. - mode: 644
  93. - watch_in:
  94. - service: ssh
  95. {% endfor %}
  96. # Manage known-hosts
  97. {% set type = 'ed25519' %}
  98. {% for host_name, host_config in salt['pillar.get']('nodes').items() if host_config.get('ssh', {}).get('host', {}).get(type, False) %}
  99. {% set hosts = [ host_name ] + host_config.ssh.host.get('aliases', []) %}
  100. {% set host_external = host_name|replace('.in.','.') %}
  101. {% for iface, iface_config in host_config.get('ifaces', {}).items() if iface_config.get('vrf', 'none') == 'vrf_external' and host_external not in hosts %}
  102. {% do hosts.append(host_external) %}
  103. {% endfor %}
  104. {% for host in hosts %}
  105. {{ host }}-{{ type }}:
  106. ssh_known_hosts.present:
  107. - name: {{ host }}
  108. - key: {{ host_config.ssh.host.get(type, {}).pubkey.split(' ')[1] }}
  109. - enc: {{ type }}
  110. - require:
  111. - pkg: ssh
  112. {% endfor %}
  113. {% endfor %}