summaryrefslogtreecommitdiffstats
path: root/pillar
diff options
context:
space:
mode:
authorGeorg Pfuetzenreuter2023-01-27 11:48:51 +0100
committerGeorg Pfuetzenreuter2023-01-27 11:48:51 +0100
commitb7ec9e683fd299b088d59c84e669eccd372aa7f3 (patch)
treee23a9ce4be37b8134d9bf14c1046d5ecf73ad540 /pillar
parentf949c0aba0bd9863474a35e1613eb23554acc449 (diff)
parent698234c0402eeff37517869695c75682a3fad332 (diff)
downloadsalt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.tar.gz
salt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.tar.bz2
salt-b7ec9e683fd299b088d59c84e669eccd372aa7f3.zip
Merge pull request 'Manage common SSH server' (#6) from ssh into production
Reviewed-on: https://git.com.de/LibertaCasa/salt/pulls/6
Diffstat (limited to 'pillar')
-rw-r--r--pillar/formulas.yaml1
-rw-r--r--pillar/global/init.sls1
-rw-r--r--pillar/global/macros.jinja17
-rw-r--r--pillar/global/ssh.sls31
4 files changed, 50 insertions, 0 deletions
diff --git a/pillar/formulas.yaml b/pillar/formulas.yaml
index a9095f1..18da508 100644
--- a/pillar/formulas.yaml
+++ b/pillar/formulas.yaml
@@ -1,3 +1,4 @@
- postfix
- salt
- users
+- openssh
diff --git a/pillar/global/init.sls b/pillar/global/init.sls
index 98536a3..ed05b4c 100644
--- a/pillar/global/init.sls
+++ b/pillar/global/init.sls
@@ -2,6 +2,7 @@ include:
- role.salt.common
- role.salt.minion
- .mta
+ - .ssh
managed_header_pound: |
### This file is managed via https://git.com.de/LibertaCasa/salt
diff --git a/pillar/global/macros.jinja b/pillar/global/macros.jinja
new file mode 100644
index 0000000..3cc8848
--- /dev/null
+++ b/pillar/global/macros.jinja
@@ -0,0 +1,17 @@
+{%- macro listeners() -%}
+{%- set listen_ips = [] -%}
+{%- set legal6s = ('fd29', '2a01:4f8:11e:2200') -%}
+{%- for ip in salt['network.ip_addrs']() -%}
+{%- if salt['network.is_private'](ip) -%}
+{%- do listen_ips.append(ip) -%}
+{%- endif -%}
+{%- endfor -%}
+{%- for ip in salt['network.ip_addrs6']() -%}
+{%- if ip.startswith(legal6s) -%}
+{%- do listen_ips.append(ip) -%}
+{%- endif -%}
+{%- endfor -%}
+{%- for ip in listen_ips %}
+- {{ ip }}
+{%- endfor %}
+{%- endmacro -%}
diff --git a/pillar/global/ssh.sls b/pillar/global/ssh.sls
new file mode 100644
index 0000000..bd960bd
--- /dev/null
+++ b/pillar/global/ssh.sls
@@ -0,0 +1,31 @@
+{%- from slspath ~ '/../global/macros.jinja' import listeners -%}
+{#-
+{%- from '/tmp/salt-libertacasa/pillar/global/macros.jinja' import listeners with context -%}
+#}
+{%- set host = grains['host'] -%}
+
+sshd_config:
+ ConfigBanner: |
+ ### This file is managed via https://git.com.de/LibertaCasa/salt
+ ### Manual changes will be overwritten
+ ListenAddress: {{ listeners() | indent }}
+ Protocol: 2
+ SyslogFacility: AUTH
+ LogLevel: FATAL
+ HostKey:
+ - /etc/ssh/{{ host }}
+ HostKeyAlgorithms: ssh-ed25519-cert-v01@openssh.com
+ HostCertificate: /etc/ssh/{{ host }}-cert.pub
+ TrustedUserCAKeys: /etc/ssh/user_ca
+ PasswordAuthentication: 'no'
+ LoginGraceTime: 1m
+ PermitRootLogin: 'no'
+ StrictModes: 'yes'
+ MaxAuthTries: 1
+ MaxSessions: 3
+ UsePAM: 'yes'
+ X11Forwarding: 'no'
+ PrintMotd: 'yes'
+ PrintLastLog: 'yes'
+ Subsystem: sftp /usr/lib/ssh/sftp-server
+