puppet-ssh/manifests/server/config.pp at 2982cb210f1ea094ec0af7076e19857aaf718d77 · jacobmw/puppet-ssh · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# @summary
#   Managed ssh server configuration
#
# @api private
#
class ssh::server::config {
  assert_private()

  $options = $ssh::server::merged_options
  $include_dir = $ssh::server::include_dir

  case $ssh::server::validate_sshd_file {
    true: {
      $sshd_validate_cmd = "${ssh::server::sshd_binary} -tf %"
    }
    default: {
      $sshd_validate_cmd = undef
    }
  }

  if $ssh::server::use_augeas {
    $options.each |String $k, Hash $v| {
      if $k.downcase == 'subsystem' {
        $_v = $v.match(/(^(\w+)\s+(.*)$)/)
        sshd_config_subsystem { $v[2]:
          command => $v[3],
        }
      } else {
        sshd_config { $k:
          * => $v,
        }
      }
    }
  } else {
    concat { $ssh::server::sshd_config:
      ensure       => present,
      owner        => $ssh::server::config_user,
      group        => $ssh::server::config_group,
      mode         => $ssh::server::sshd_config_mode,
      validate_cmd => $sshd_validate_cmd,
      notify       => Service[$ssh::server::service_name],
    }

    concat::fragment { 'global config':
      target  => $ssh::server::sshd_config,
      content => template("${module_name}/sshd_config.erb"),
      order   => '00',
    }
  }

  if $ssh::server::include_dir {
    file { $ssh::server::include_dir:
      ensure  => directory,
      owner   => $ssh::server::config_user,
      group   => $ssh::server::config_group,
      mode    => $ssh::server::include_dir_mode,
      purge   => $ssh::server::include_dir_purge,
      recurse => $ssh::server::include_dir_purge,
    }

    $ssh::server::config_files.each |$file, $params| {
      ssh::server::config_file { $file:
        * => $params,
      }
    }
  }

  if $ssh::server::use_issue_net {
    if $ssh::server::issue_net_content {
      $issue_net_content_real = $ssh::server::issue_net_content
    } else {
      $issue_net_content_real = template("${module_name}/issue.net.erb")
    }

    file { $ssh::server::issue_net:
      ensure  => file,
      owner   => $ssh::server::config_user,
      group   => $ssh::server::config_group,
      mode    => $ssh::server::sshd_config_mode,
      content => $issue_net_content_real,
      notify  => Service[$ssh::server::service_name],
    }

    concat::fragment { 'banner file':
      target  => $ssh::server::sshd_config,
      content => "Banner ${ssh::server::issue_net}\n",
      order   => '01',
    }
  }
}