simp / pupmod-simp-ssh Goto Github PK

The tests introduced in 7177ed0 are not valid rspec tests.

Also, the tests didn't seem to fire off in the GitLab CI job so we should look into that.

This is definitely a good way to ensure the host key has the appropriate mode, however, if a particular host key isn't called out in the config, the file's mode will be unchanged. Specifically /etc/ssh/ssh_host_ecdsa_key and ssh_host_ed25519_key by default will exist, but not have the more restrictive mode applied to them.

It should remove any unmanaged files within /etc/ssh/sshd_config.d/ if configured to tidy the directory. The module doesn't currently make or manage anything within that directory so this will likely just be a tidy_sshd_config_d parameter that will be set to false by default (to not mess with existing configurations).

Currently if the file doesn't exist for any reason, the class will throw an error because it's trying to source a file that could very potentially not exist on the system.

We should attempt to source from /usr/share/zoneinfo/${facts['timezone']}, but only if /etc/localtime doesn't exist.

File.exists? was removed in Ruby 3.

Remediating this on a system not already set up with simp could easily cause issues for systems that rely on their AuthorizedKeysFile being in a specific location. What we add won't change base functionality whatsoever, but will give us an option to turn off moving this location away from what users might already have setup.

I can't set RekeyLimit 1G 1h via ssh::client::host_config_entry, it returns an error
Could not evaluate: Failed to save Augeas tree to file. See debug logs for details.

I was able to fix this by changing both simp/pupmod-simp-ssh and voxpupuli/puppet-augeasproviders_ssh to take an array for RekeyLimit and then passing in rekeylimit: [1G, 1h].

I can submit some PRs if this is not just user error on my part and if that fix is reasonable.