diff options
| author | Georg Pfuetzenreuter | 2023-01-27 11:48:51 +0100 |
|---|---|---|
| committer | Georg Pfuetzenreuter | 2023-01-27 11:48:51 +0100 |
| commit | b7ec9e683fd299b088d59c84e669eccd372aa7f3 (patch) | |
| tree | e23a9ce4be37b8134d9bf14c1046d5ecf73ad540 /pillar | |
| parent | f949c0aba0bd9863474a35e1613eb23554acc449 (diff) | |
| parent | 698234c0402eeff37517869695c75682a3fad332 (diff) | |
| download | salt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.tar.gz salt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.tar.bz2 salt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.zip | |
Merge pull request 'Manage common SSH server' (#6) from ssh into production
Reviewed-on: https://git.com.de/LibertaCasa/salt/pulls/6
Diffstat (limited to 'pillar')
| -rw-r--r-- | pillar/formulas.yaml | 1 | ||||
| -rw-r--r-- | pillar/global/init.sls | 1 | ||||
| -rw-r--r-- | pillar/global/macros.jinja | 17 | ||||
| -rw-r--r-- | pillar/global/ssh.sls | 31 |
4 files changed, 50 insertions, 0 deletions
diff --git a/pillar/formulas.yaml b/pillar/formulas.yaml index a9095f1..18da508 100644 --- a/pillar/formulas.yaml +++ b/pillar/formulas.yaml @@ -1,3 +1,4 @@ - postfix - salt - users +- openssh diff --git a/pillar/global/init.sls b/pillar/global/init.sls index 98536a3..ed05b4c 100644 --- a/pillar/global/init.sls +++ b/pillar/global/init.sls @@ -2,6 +2,7 @@ include: - role.salt.common - role.salt.minion - .mta + - .ssh managed_header_pound: | ### This file is managed via https://git.com.de/LibertaCasa/salt diff --git a/pillar/global/macros.jinja b/pillar/global/macros.jinja new file mode 100644 index 0000000..3cc8848 --- /dev/null +++ b/pillar/global/macros.jinja @@ -0,0 +1,17 @@ +{%- macro listeners() -%} +{%- set listen_ips = [] -%} +{%- set legal6s = ('fd29', '2a01:4f8:11e:2200') -%} +{%- for ip in salt['network.ip_addrs']() -%} +{%- if salt['network.is_private'](ip) -%} +{%- do listen_ips.append(ip) -%} +{%- endif -%} +{%- endfor -%} +{%- for ip in salt['network.ip_addrs6']() -%} +{%- if ip.startswith(legal6s) -%} +{%- do listen_ips.append(ip) -%} +{%- endif -%} +{%- endfor -%} +{%- for ip in listen_ips %} +- {{ ip }} +{%- endfor %} +{%- endmacro -%} diff --git a/pillar/global/ssh.sls b/pillar/global/ssh.sls new file mode 100644 index 0000000..bd960bd --- /dev/null +++ b/pillar/global/ssh.sls @@ -0,0 +1,31 @@ +{%- from slspath ~ '/../global/macros.jinja' import listeners -%} +{#- +{%- from '/tmp/salt-libertacasa/pillar/global/macros.jinja' import listeners with context -%} +#} +{%- set host = grains['host'] -%} + +sshd_config: + ConfigBanner: | + ### This file is managed via https://git.com.de/LibertaCasa/salt + ### Manual changes will be overwritten + ListenAddress: {{ listeners() | indent }} + Protocol: 2 + SyslogFacility: AUTH + LogLevel: FATAL + HostKey: + - /etc/ssh/{{ host }} + HostKeyAlgorithms: ssh-ed25519-cert-v01@openssh.com + HostCertificate: /etc/ssh/{{ host }}-cert.pub + TrustedUserCAKeys: /etc/ssh/user_ca + PasswordAuthentication: 'no' + LoginGraceTime: 1m + PermitRootLogin: 'no' + StrictModes: 'yes' + MaxAuthTries: 1 + MaxSessions: 3 + UsePAM: 'yes' + X11Forwarding: 'no' + PrintMotd: 'yes' + PrintLastLog: 'yes' + Subsystem: sftp /usr/lib/ssh/sftp-server + |