wcooley / puppet-user_ssh_pubkey

Facts of users' SSH public keys and type to create keypairs

Puppet module: user_ssh_pubkey

Generate user SSH keys on nodes and make public keys available as facts. These facts can then be collected as exported resources to populate ssh_authorized_key resources.

Note that, with this workflow, the agent will have to run twice before the keys are available -- facts are collected before resources are created, so the first time through the keypair will be generated and the second time the public key will be available as a fact.

Note, that, also populating the user_ssh_pubkey external fact is (currently) unimplemented.

Facts

Facts with the following formats are created, which correspond with the parameters for the ssh_authorized_key type:

• <username>_ssh(rsa|dsa|ecdsa|ed25519)key
• <username>_ssh(rsa|dsa|ecdsa|ed25519)key_comment
• <username>_ssh(rsa|dsa|ecdsa|ed25519)key_type

The list of users whose public keys are to be collected as facts is configured by the user_ssh_pubkey fact, which can be set using external facts. For example:

$ cat /etc/facter/facts.d/user_ssh_pubkey.yaml
---
user_ssh_pubkey: jensenb,alice,bob

Type

Type user_ssh_pubkey can be used to generate DSA or RSA keys on nodes. Parameters are consistent with parameters for ssh_authorized_key where possible.

Currently this is implemented as a Puppet defined type, which results in an exec type which runs ssh-keygen.

Keys are generated with null passphrases.

Parameters

• name The SSH key comment. Ideally this would be something like "$user/ssh-$type@$::fqdn"; if so, the user and type parameters can be left unspecified.

• user namevar The user in whose home directory to create the key.

• target The absolute filename base to store the private and public keys in. This parameter should generally be avoided, as it breaks the facts.

• type The key type: "dsa", "rsa", "ecdsa", "ed25519". Note that semantics of this parameter are different from the *_type fact and "type" parameter for ssh_authorized_key.

• user The user account in which the SSH key should be generated.

• bits The number of bits in the key. See ssh-keygen(1) for limits.

Example

For the source or client node, generate an SSH key, collect the fact and create an exported ssh_authorized_key resource:

user_ssh_pubkey { "repocloner/ssh-rsa@${::fqdn}": }

file { '/etc/facter/facts.d/user_ssh_pubkey.txt':
  ensure  => present,
  content => "user_ssh_pubkey=repocloner\n",
  owner   => 'root',
  group   => 'root',
  mode    => '0644',
}

if $::repocloner_sshrsakey {
  @@ssh_authorized_key { $::repocloner_sshrsakey_comment:
    ensure => present,
    key    => $::repocloner_sshrsakey,
    user   => 'repocloner',
    type   => $::repocloner_sshrsakey_type,
    tag    => [ 'repocloner-ssh-key' ],
  }
}

If the client node's name is used in the name (comment) of the user_ssh_pubkey, then exported resources from multiple client nodes can be generated.

For the target or server node, collect the exported resource:

Ssh_authorized_key <<| tag == 'repocloner-ssh-key' |>>

One could also use user parameter instead of a tag for selecting the exported resources instead of a tag.

License

Apache 2.0

Contact

Wil Cooley <wcooley(at)nakedape.cc>

Support

Please log tickets and issues at our Github issues.

puppet-user_ssh_pubkey's Issues

Puppet 4 compatibility

Puppet agent v3.7.2 with puppetserver v2.3.1

user_ssh_pubkey module throws error :
Error 400 on SERVER: Illegal variable name, The given name 'C_comment' does not conform to the naming rule /^((::)?[a-z]\w_)((::)?[a-z]\w*)$/

According to Puppet documentation: Puppet 3.7 deprecates the use of uppercase letters for the first non-$ character of a variable name.

Provide some usage examples

It would be nice to have some examples in the documentation.

user_ssh_pubkey { "postgres/ssh-rsa@${::fqdn}": }

file { '/etc/facter/facts.d/user_ssh_pubkey.yaml':
  ensure  => present,
  mode    => '0644',
  owner   => 'root',
  group   => 'root',
  content => '---\nuser_ssh_pubkey: postgres\n',
}

Also how to collect the exported fact on another node would be useful.

Support generating user keys node-side

My goal is for the keys to be unique to the nodes and the master to be ignorant of the nodes' private keys. Currently I find no modules on Puppet Forge for generating SSH keys for users on nodes, only managing both public and private on the master. I need to be able to generate the keys in order to accomplish this and this module seems like the ideal place (despite the repository being called "facter-").

Handle non-existence of user gracefully

Facter crashes if a user listed in the external fact user_ssh_pubkey does not exist. Need to handle exception from getpwnam gracefully.

Support structured fact for configuration fact `user_ssh_pubkey`

Currently the configuration fact user_ssh_pubkey is a comma-delimited list, which makes managing the fact more challenging. Facter 2.0 can represent facts as arrays, which would be nicer for managing the fact itself.

Support ECDSA keys

ECDSA keys have a basename like id_ecdsa and a keytype matching ecdsa-.*.

Whitespace in key comment is a problem

Right now I'm splitting all the fields based on whitespace without limit; should limit to 3 fields.