1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
class openssh {
# root account authorized_keys will be symlinked
# if you want to add symlink on other accounts, use $symlink_users parameter
class ssh_keys_from_ldap($symlink_users = [],
$config = '') inherits server {
File ['/etc/ssh/sshd_config'] {
content => template('openssh/sshd_config','openssh/sshd_config_ldap')
}
package { 'python-ldap': }
$pubkeys_directory = '/var/lib/pubkeys'
file { $pubkeys_directory:
ensure => directory,
}
file { "$pubkeys_directory/root":
ensure => directory,
mode => '0700',
}
file { "$pubkeys_directory/root/authorized_keys":
ensure => link
target => "/root/.ssh/authorized_keys",
mode => '0700',
}
define symlink_user() {
file { "$pubkeys_directory/$name":
ensure => directory,
owner => $name,
group => $name,
mode => '0700',
}
file { "$pubkeys_directory/$name/authorized_keys":
# FIXME : fragile approximation for $HOME
ensure => link,
target => "/home/$name/.ssh/authorized_keys",
mode => '0700',
}
}
symlink_user { $symlink_users: }
$ldap_pwfile = '/etc/ldap.secret'
$ldap_servers = get_ldap_servers()
local_script { 'ldap-sshkey2file.py':
content => template('openssh/ldap-sshkey2file.py'),
require => Package['python-ldap']
}
cron { 'sshkey2file':
command => '/usr/local/bin/ldap-sshkey2file.py',
hour => '*',
minute => '*/10',
user => 'root',
environment => 'MAILTO=root',
require => Local_script['ldap-sshkey2file.py'],
}
}
}
|
