Templates for ssh(d).conf files.

Something like this, but the impressive part is the finished sshd that still includes all the stock comments.

Working Output:

[Tue, 07 Feb 2012 15:18:53 -0500] INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 20)
[Tue, 07 Feb 2012 15:18:53 -0500] INFO: template[/etc/ssh/ssh_config] backed up to /var/chef/backup/etc/ssh/ssh_config.chef-20120207151853
[Tue, 07 Feb 2012 15:18:53 -0500] INFO: template[/etc/ssh/ssh_config] removed backup at /var/chef/backup/./etc/ssh/ssh_config.chef-20120206171943
[Tue, 07 Feb 2012 15:18:53 -0500] INFO: template[/etc/ssh/ssh_config] mode changed to 644
[Tue, 07 Feb 2012 15:18:53 -0500] INFO: template[/etc/ssh/ssh_config] updated content
[Tue, 07 Feb 2012 15:18:53 -0500] INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 27)

https://github.com/erniebrodeur/opscode-cookbooks/compare/fd3eb854bceb229ec021435568a8cdc956c36a58...COOK-1014

1) Why did you remove Scientific Linux from the supported list?

2) You make changes to the passenger cookbook in this branch as well. Can we isolate each ticket to a single cookbook and topic?

3) What about using a separate hierarchy level for the attributes to split client and server?

default[:openssh][:client][:Host]
default[:openssh][:server][:Host]

This is more clear than openssh/opensshd.

4) You write to '/etc/ssh/ssh_configd' but on Ubuntu 10.10 (maverick) system, this is '/etc/ssh/sshd_config'

5) You misspell Cipher as Cihper and you have a ruby class named 'Cipher' included on this line inappropriately

Ciphers <%= Ciphers node[:openssh][:Cihpers].join "," %>

6) You list IdentityFile three times

+IdentityFile <%= node[:openssh][:IdentityFile] %>
+IdentityFile <%= node[:openssh][:IdentityFile] %>
+IdentityFile <%= node[:openssh][:IdentityFile] %>

Also, Ruby programmers tend to use lowercase and underscores for variable naming instead of camel case, so you may want to consider standardizing on that.

http://www.troubleshooters.com/codecorn/ruby/rubyrightway.htm#_Underscores

1 and 2 were accidents, I'll clean up my branch, still learning git.

The rest I will get on fixing and resubmit.

As for the casing, I originally had it all lower case (I do know about that) but was trying to standardize it to the config file, not ruby.

I'll go ahead and make the changes to lowercase as well.

1) and 2) we're fixed by me cleaning up my repo (need to learn rebase).

3) has been changed.

4) and 5) amounted out to typos.

6) has been addressed by making a few more variables.

[Wed, 15 Feb 2012 21:26:31 -0500] INFO: Processing package[openssh] action install (openssh::default line 30)
[Wed, 15 Feb 2012 21:26:31 -0500] INFO: Processing template[/etc/ssh/ssh_config] action create (openssh::default line 33)
[Wed, 15 Feb 2012 21:26:31 -0500] INFO: Processing template[/etc/ssh/sshd_config] action create (openssh::default line 40)

I can only test on Arch right now (don't have any ub systems). The actual issue was a typo, not a platform specific one.

Found a case where this isn't working as intended, going to do some more testing against this and re-submit.

Ernie Brodeur - Any update on this? We have a duplicate issue here: COOK-1156, though your implementation is more complete.

@Jtimberman

Sure, I'll finish this today/tomorrow, the issue is that openssh doesn't have 'sane' default values.
My current strategy was to just uncomment all the lines in openssh, but this doesn't work without sane defaults.

I'm not entirely sure how to proceed, I either need to 1) make a fairly complicated template that only produces values that are configured, or 2) some how assemble partials.

Thoughts?

I'd like for the sshd_config file to be generated more dynamically, similar to how I did it here: https://github.com/opscode-cookbooks/openssh/pull/1/files

This way people do not need to edit the cookbook to add/remove settings. They just need to add an attribute.

That looks really good, if you want to apply any changes to my github repo feel free, that way you get attributed for your ideas, then we can submit the combined results.

Else, when I get some time this weekend I'll roll in what I see from you and close this.

Done, quite extensive, check the README.md for changes and you'll see what I added.

I've tested it as far as confirming it will not error on a chef-client and testing the json blobs pasted in the examples.

This looks pretty nice. Any chance I could get you to add DenyUsers, AllowUsers, DenyGroups, and AllowGroups to the list of things configured for sshd_config? (Or I can fork but trail of forks to merge seems not entirely ideal for getting this pulled in)

Aha, I see how this works now. Using it now on centos6 and it's working nicely for me.

Ernie,

It looks like you commented out many of the attributes. Why did you do so?

Because your commits aren't all sequential in the timeline, and the opscode/cookbooks repository is deprecated, it's hard to see these changes. Could you 'git clone' the new opscode-cookbooks/openssl repository, copy your changes there, and commit? That branch would be a lot easier for us to review.

https://github.com/opscode-cookbooks/openssh

@Bryan,

If you read up, I stated where openssh doesn't have sane default values and the server wasn't starting up. I can either remove everything but the default three values (which are the uncommented ones) but I left them commented for reference so people wouldn't have to hunt down values.

Before I rebase my patch again, would you like me to delete them or leave them commented?

Also, why did you link openvpn and not openssh?

Hi Ernie,

I fixed the link in the comment above .

What are the configuration settings that don't have sane defaults? Are sane defaults known such that they could be added as values for those attributes? Since this is going to end up with a vastly different configuration file than what ships with most distributions, I think its perfectly reasonable to set a sane default so that everything works properly.

I'll be on IRC later today if you want to discuss.

@Joshua, I tried to catch up to you half a dozen times or so to discuss this, realistically I don't have time for this right now.

Merge it or close it, the code works other than it's an old patch and will take a bit more effort to merge then you make like.

Ernie Brodeur - I'm sorry! We hadn't looked at this because it wasn't resolved. I'll mark it as such so we pick it up for review and further action. Thank you for your work and effort on this.

Resolving so this gets picked up for review.

I'm going to try to revive this in a new PR, but using this ticket.

I'll check out the other related tickets, and try to commit things that still give proper author attribution to the original contributors. Cheers!

I've merged Ernie's contribution via the old pull request and pushed to master. This will be available in the next release of the openssh cookbook (soon).

Released in v1.0.0