Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the supermarket mailing list.

Select Badges

Select Supported Platforms


openssh (19) Versions 2.1.0

Installs and configures OpenSSH client and daemon

cookbook 'openssh', '~> 2.1.0'
cookbook 'openssh', '~> 2.1.0', :supermarket
knife cookbook site install openssh
knife cookbook site download openssh

openssh Cookbook

Build Status Cookbook Version

Installs and configures OpenSSH client and daemon.



  • Debian/Ubuntu
  • RHEL/CentOS/Scientific/Oracle
  • Fedora
  • FreeBSD
  • openSUSE


  • Chef 12.1+


  • iptables



Installs openssh packages, manages the sshd config file, and starts/enables the sshd service.


Creates an iptables firewall rule to allow inbound SSH connections.


Apply the default recipe to the node's run_list to ensure that the openssh packages are installed, sshd is configured, and the service is started and enabled

Attributes List

The attributes list is dynamically generated, and lines up with the default openssh configs.

This means anything located in sshd_config or ssh_config can be used in your node attributes.

  • If the option can be entered more then once, use an Array, otherwise, use a String. If the option is host-specific use a Hash (please see below for more details).
  • Each attribute is stored as ruby case, and converted to camel case for the config file on the fly.
  • The current default attributes match the stock ssh_config and sshd_config provided by openssh.
  • The namespace for sshd_config is node['openssh']['server'].
  • Likewise, the namespace for ssh_config is node['openssh']['client'].
  • An attribute can be an Array, a Hash or a String.
  • If it is an Array, each item in the array will get it's own line in the config file.
  • Hash attributes are meant to used with ssh_config namespace to create host-specific configurations. The keys of the Hash will be used as the Host entries and their associated entries as the configuration values.
  • All the values in openssh are commented out in the attributes/default.rb file for a base starting point.
  • There is one special attribute name, which is match. This is not included in the default template like the others. node['openssh']['server']['match'] must be a Hash, where the key is the match pattern criteria and the value should be a Hash of normal keywords and values. The same transformations listed above apply to these keywords. See examples below.

Dynamic ListenAddress

Pass in a Hash of interface names, and IP address type(s) to bind sshd to. This will expand to a list of IP addresses which override the default node['openssh']['server']['listen_address'] value.

Examples and Common usage

These can be mixed and matched in roles and attributes. Please note, it is possible to get sshd into a state that it will not run. If this is the case, you will need to login via an alternate method and debug sshd like normal.

No Password logins

This requires use of identity files to connect

"openssh": {
  "server": {
    "password_authentication": "no"

Change sshd Port

"openssh": {
  "server": {
    "port": "14188"


"openssh": {
  "server": {
    "match": {
      "Address": {
        "password_authentication": "yes"
      "Group admins": {
        "permit_tunnel": "yes",
        "max_sessions": "20"

Enable X Forwarding

"openssh": {
  "server": {
    "x11_forwarding": "yes"

Bind to a specific set of address (this example actually binds to all).

Not to be used with node['openssh']['listen_interfaces'].

"openssh": {
  "server": {
    "address_family": "any",
      "listen_address": [ "", "::" ]

Bind to the addresses tied to a set of interfaces.

"openssh": {
  "listen_interfaces": {
    "eth0": "inet",
    "eth1": "inet6"

Host-specific configurations with hashes.

You can use a Hash with node['openssh']['client'] to configure different values for different hosts.

"client": {
  "*": {
    "g_s_s_a_p_i_authentication": "yes",
    "send_env": "LANG LC_*",
    "hash_known_hosts": "yes"
  "localhost": {
    "user_known_hosts_file": "/dev/null",
    "strict_host_key_checking": "no"
  "": {
    "user_known_hosts_file": "/dev/null",
    "strict_host_key_checking": "no"
  "other*": {
    "user_known_hosts_file": "/dev/null",
    "strict_host_key_checking": "no"

The keys are used as values with the Host entries. So, the configuration fragment shown above generates:

Host *
SendEnv LANG LC_*
HashKnownHosts yes
GSSAPIAuthentication yes
Host localhost
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
Host other*
StrictHostKeyChecking no
UserKnownHostsFile /dev/null

License & Authors

Author: Cookbook Engineering Team (

Copyright: 2008-2016, Chef Software, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

iptables >= 1.0

Contingent cookbooks

amoeba_basenode Applicable Versions
cafe-core Applicable Versions
common_auth Applicable Versions
duo-unix Applicable Versions
gitlab Applicable Versions
gitlab-shell Applicable Versions
gitlabhq Applicable Versions
google-authenticator Applicable Versions
linux-basic Applicable Versions
linux_basic Applicable Versions
mw_server_base Applicable Versions
nmdbase Applicable Versions
openldap Applicable Versions
openssh-lpk Applicable Versions
paramount Applicable Versions
platformstack Applicable Versions
realmd-sssd Applicable Versions
sftp Applicable Versions
sparkleshare Applicable Versions
stack-base Applicable Versions
survivor Applicable Versions
ut_base Applicable Versions
zenoss Applicable Versions

openssh Cookbook CHANGELOG

This file is used to list changes made in each version of the openssh cookbook.

2.1.0 (2016-09-18)

  • Add support for multiple sshd ports.
  • Switch to kitchen-dokken for integration testing in Travis CI
  • EL7 intentionally lacks of auto-gen'd DSA key
  • Fix commented default for ciphers and macs
  • Add chef_version metadata
  • Remove hostnames from the templates
  • Basic Mac OS support
  • Avoid node.set deprecation warnings
  • Require Chef 12.1+
  • Fix inspec tests
  • Remove the service provider logic that isn't necessary in Chef 12
  • Set the sftp subsystem on Ubuntu

2.0.0 (2016-03-18)

  • Don't set the Roaming No directive on RHEL systems before 7.0 as they ship with a sshd release which does not handle this directive
  • Depend on the newer iptables cookbook, which bumps the required Chef release for this cookbook to 12.0+

1.6.1 (2016-01-20)

  • Restored sshd restarting post config change

1.6.0 (2016-01-14)

  • Removed the default['openssh']['rootgroup'] attribute and instead use root_group which was introduced in Chef 11.6.0
  • UseRoaming no is now set in the client config to resolve CVE-2016-0777 and CVE-2016-0778
  • Converted bats integration test to 2 suites of Inspec tests
  • Added a libary to sort sshd_config entries while keeping port at the top to prevent sshd from failing to start

1.5.2 (2015-06-29)

  • Use the complete path to sshd when verifying the config file since sbin may not be in the path

1.5.0 (2015-06-24)

  • Perform a config syntax check before restarting the sshd so we don't break remote access to hosts
  • Add support for Ubuntu 15.04+ with systemd
  • Added a chefignore file
  • Added Gitter badge for asking questions in a Gitter chat room

1.4.0 (2015-05-01)

  • 42 - Fixed support for SmartOS
  • 46 - Correct ArchLinux service name
  • 43 - Correct OpenSSH server package name on RHEL, Fedora
  • 31 - Allow included iptables rule to use the same port number if defined in attributes.
  • 41 - Fix default recipe order
  • 47 - Fix up iptables rule
  • 49 - Fixed the print_last_log attribute in the Readme
  • Updated Test Kitchen config with all supported platforms
  • Updated Test Kitchen / Foodcritic / Rubocop / Berkshelf depedencies in the Gemfile
  • Replaced Travis Ruby 1.9.3/2.0.0 testing with 2.1.5/2.2.0
  • Resolved all Rubocop warnings

v1.3.4 (2014-04-23)

  • [COOK-4576] - No way to override AuthorizedKeysFile
  • [COOK-4584] - Use Upstart on Ubuntu 12.04
  • [COOK-4585] - skip match block in template if empty or unset
  • [COOK-4586] OpenSSH Gentoo support



  • COOK-3995 - sshd_config template needs ordering
  • COOK-3910 - ssh fails to start in Ubuntu 13.10
  • COOK-2073 - Add support for Match block






  • COOK-3304 - Fix error setting Dynamic ListenAddresses



  • [COOK-2647]: port_ssh iptables template has no corresponding recipe


  • [COOK-2225] - Add platform_family suse


  • [COOK-1954] - Fix attribute camel case to match man sshd_config
  • [COOK-1889] - SSH restarting on each chef run due to template changes


  • [COOK-1663] - Configurable ListenAddress based off list of interface names
  • [COOK-1685] - Make default sshd_config value more robust


  • [COOK-1014] - Templates for ssh(d).conf files.


  • Current public release

Collaborator Number Metric

2.1.0 passed this metric

Foodcritic Metric

2.1.0 passed this metric