1. Overview
2. Module Description - What the module does and why it is useful
3. Backwards incompatibility
4. Setup - The basics of getting started with ssh
   • What ssh affects
   • Setup requirements
   • Beginning with ssh
5. Usage - Configuration options and additional functionality
6. Reference - An under-the-hood peek at what the module is doing and how
7. Limitations - OS compatibility, etc.
8. Development - Guide for contributing to the module
9. Contributors

##Overview

This is a puppet module to manage openssh, including management of hostkeys and a global known_hosts file. Works on puppet >= 2.7 and Debian- aswell as RedHat-based systems.

##Module description

openssh is an integral part of most linux infrastructures and this module provides a way to manage it. Apart from package installation, configuration and service management, it supports two ways to manage a global known_hosts file:

• based on storeconfig/puppetdb, by collecting the keys created with the package installation
• based on keys generated by the module, cached on the server and rolled out by puppet (enduring re-provisioning and working without storeconfig)

This module has just gone through a refactoring, from the module previously written for my employer (credativ/puppet-ssh-hiera). It is no longer compatible to that module, since some of its distinct features (user management) and specifics have been removed and/or changed. This module is no longer using the params_lookup function, nor is it managing anything except ssh.

• openssh package
• openssh configuration
• openssh hostkey
• openssh service
• /etc/ssh/ssh_known_hosts

If you just want a client installed, you can run include '::ssh::client'.

If you just want a server being installed and managed with default option, you can include '::ssh::server'.

If you need to customize options, such as the ListenAddress of the server or other configurations, you need to pass an options hash or use the appropriate parameters for a few often used cases.

class { '::ssh::server':
  permit_root_login => 'yes',
  listen_address    => '192.168.1.1',
  options           => $options_hash
}

Refer to the template to see what keys can be used in the options hash. Its also possible to specify an own template via the config_template parameter.

This module does not have specific requirements, except if you want it to generate and manage the hostkeys of the system. Then its required to mkdir a directory /etc/puppet/ssh on your puppetmaster host and give it appropriate permissions so that puppetmaster can create and write files.

##Usage

You can include the classes you need and configure it via the parameters it supports. Please see the class docs for supported parameters and their meaning.

Currently only installs a ssh-client.

Installs and configures openssh-server, manages configuration and service by default and optionally hostkeys.

The module includes a parser function ssh_keygen which can create and cache ssh keys on the server. Its used internally by the module if the module is configured to manage the hostkey.

The module contains the following public clases:

• ssh::client
• ssh::server

The following classes are currently not meant to be used directly, but used by the ssh::server class (depending on the parameters given).

• ssh::known_hosts
• ssh::known_hosts::storeconfig
• ssh::hostkey

This module has been tested and is used primarily on Debian-based systems. Other systems are supported but cannot be guaranted.

I happily accept bug reports and pull requests via github.

This module is written and being maintained by

Patrick Schoenfeld <[email protected]>.

It has been based on the module credativ/puppet-ssh-hiera, previously written for my employer and maintained together with my colleagues. It contains contributions from at least the following authors:

• Damian Lukowski
• Arnd Hannemann
• Alexander Wirt
• Tomas Barton
• Simon Page