Menu

Chef Supermarket

Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

View our collection of guides, documentation, and articles

Cookbooks
Advanced Options

Select Badges

Select Supported Platforms

Select Status

RSS

sshd (13) Versions 2.0.0

Installs/Configures sshd

Policyfile
Berkshelf
Knife 
cookbook 'sshd', '= 2.0.0', :supermarket
cookbook 'sshd', '= 2.0.0'
knife supermarket install sshd
knife supermarket download sshd
README
Dependencies
Changelog
Quality 50%

sshd Cookbook

Cookbook Version

Description

This cookbook maintains the openssh server.

Unlike other sshd cookbooks, this cookbook respects the default settings of the
current operating systems, unless these settings are explicitly overwritten.

This cookbook takes (or at least tries to) the default sshd configruation of the
distribution you are using as a default. Then you can overwrite specific
settings.

See below for the default settings.

Attributes

You can specify the package that installs sshd, using the following attribute.
There's defaults for most linux distributions.

node['sshd']['package']      # Package to install openssh-server

The following settings will be filled in using the defaults of the distribution you're using, unless you overwrite it in your node configuration / resource

node['sshd']['sshd_path']        # Path to sshd executable
node['sshd']['config_file']      # Path to sshd_config
node['sshd']['sshd_config_mode'] # File mode of sshd_config
node['sshd']['service_name']     # OpenSSH service name

You can specify every configuration option that openssh-server supports in the
sshd_config attribute. The settings you specify will be merged with the
distributions default settings.

node['sshd']['sshd_config']['Port'] = 22

Conditional blocks are defined using hashes

node['sshd']['sshd_config']['Match']['User fred']['X11Forwarding'] = 'no'
node['sshd']['sshd_config']['Match'] = {
  'User john' => {
    'ChrootDirectory' => '/srv',
    'ForceCommand' => 'internal-sftp',
    'AllowTcpForwarding' => 'no',
    'X11Forwarding' => 'no'
  }
}

Some configuration options can be specified multiple times. You can reflect this
using an array

node['sshd']['sshd_config']['HostKey'] = %w(key1 key2)

Recipes

default

Runs the install recipe, then configures openssh-server according to the node attributes.

install

Just installs openssh-server without configuring it, as well as enabling and starting the daemon.

Resources

You can also maintain openssh-server using the resource. This is the
recommended way.

To use the resource, make sure your metadata.rb includes

depends 'sshd'

openssh_server

To install and configure openssh-server from other recipes, use the following resource:

openssh_server node['sshd']['config_file']

or, if you need a configuration which differs from the default

openssh_server '/etc/sshd_config' do
  sshd_config(
    Port: 1234,
    X11Forward: 'no'
  )
end

The resource accepts all configuration options sshd_config supports.

openssh_server node['sshd']['config_file'] do
  sshd_config(
    Port:        1234
    X11Forward:  'yes'

    # To specify an option multiple times, use an array
    HostKey:     %w(/etc/ssh/ssh_host_dsa_key /etc/ssh/ssh_host_rsa_key)

    # For conditional blocks, use a hash
    Match:       {
                    'User fred' => { 'X11Forwarding' => 'no' },
                    'User john' => {
                      'ChrootDirectory' => '/srv',
                      'ForceCommand' => 'internal-sftp',
                      'AllowTcpForwarding' => 'no',
                      'X11Forwarding' => 'no'
                    }
                 }
end

In case you need it, you can also use a custom template to use for sshd_config

openssh_server node['sshd']['config_file'] do
  cookbook 'mycookbook'
  source   'mytemplate.erb'
end

Default sshd_config settings

The following options are set by default

Port 22
Protocol 2
AcceptEnv LANG LC_*
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
PasswordAuthentication yes
ChallengeResponseAuthentication no
X11Forwarding yes
UsePAM yes

Plus, on debian/ubuntu machines

SyslogFacility AUTH
GSSAPIAuthentication no
Subsystem sftp /usr/lib/openssh/sftp-server

And on centos/compatible machines

SyslogFacility AUTHPRIV
GSSAPIAuthentication yes
Subsystem sftp /usr/libexec/openssh/sftp-server

Contributing

You fixed a bug, or added a new feature? Yippie!

  1. Fork the repository on Github
  2. Create a named feature branch (like add\_component\_x)
  3. Write your change
  4. Write tests for your change (if applicable)
  5. Run the tests, ensuring they all pass
  6. Submit a Pull Request using Github

Contributions of any sort are very welcome!

License and Authors

Authors: Chris Aumann me@chr4.org
Contributors: Jeremy Olliver, Andy Thompson, Peter Walz, Kevin Olbrich, Johnny Martin

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

base_install Applicable Versions
base_install 0.2.6
duosecurity Applicable Versions
duosecurity 1.2.0
duosecurity 1.3.0
duosecurity 1.3.1
duosecurity 1.3.3
duosecurity 1.3.4
duosecurity 1.3.5
duosecurity 1.3.6
duosecurity 1.3.7
duosecurity 1.3.8
duosecurity 1.4.0
duosecurity 1.4.1
duosecurity 2.0.0
duosecurity 2.0.1
duosecurity 2.1.0
duosecurity 2.1.1
duosecurity 3.0.0
duosecurity 3.0.1
scrutinizer-whitelist Applicable Versions
scrutinizer-whitelist 1.1.0

sshd CHANGELOG

This file is used to list changes made in each version of the sshd cookbook.

2.0.0

  • Migrate definition to resource (finally!)
  • Migrate test suite to inspec
  • Make everything ready for Chef-13

NOTE: If you upgrade from version 1.x.x and you were using a wrapper cookbook, make sure you update your configuration accordingly. For more details, have a look at the examples in README.md:

# Old notation
openssh_server '/etc/sshd_config' do
  Port 1234
  X11Forward 'no'
end

# New notation
openssh_server '/etc/sshd_config' do
  sshd_config(
    Port: 1234,
    X11Forward: 'no'
  )
end

Detailed CHANGELOG:

  • Fixed rubocop linting issues
  • Fixed travis file
  • Removed minitest and associated files
  • Removed test-kitchen gem
  • Added kitchen-inspec gem
  • Updated kitchen-vagrant gem
  • Created tests using kitchen-inspec gem
    • Tests default attributes and new_resource attrs.
  • Created Matcher for custom resource openssh_server
  • Added TESTING.md file for supermarket compliance
  • Configured tests to work for delivery
  • Added Ubuntu {16,18}.04
  • Added Debian 8 and 9
  • Removed Ubuntu {12.x, 13.x}
  • Removed CentOS 5
  • Removed Debian 5 and 6

1.3.1

  • Add support to set sshd_config file mode, default to 600 on RHEL

1.3.0

  • The install recipe was removed, package installation migrated to the default recipe.
  • Duplicate service resource warning was mitingated by removing the (probably useless) service definition in the install recipe.
  • Fix issue with sshd binary path on rhel. (Thanks Peter Walz)
  • Add support for multiple Port options (Thanks Kevin Olbrich)
  • Fix an issue when both Port and ListenAddress is specified (Thanks Kevin Olbrich)
  • Remove a workaround for chef-client < 11.14 that was overseen in the 1.2.0 release.

1.2.1

  • Use attribute bracket syntax (required for Chef 13)

1.2.0

  • Remove workaround for chef-client < 11.14, as it breaks Ubuntu Xenial 16.04 LTS

1.1.3

  • Fixes a bug in configuration test

1.1.2

  • Check sshd_config before restarting sshd service

1.1.1

  • Fix default XMODIFIERS for RHEL
  • Add default attributes for OS X

1.1.0

  • Add workaround to set service provider to Upstart on recent Ubuntus (until chef-client is fixed)

1.0.1

  • Add support for Ed25519 HostKeys

1.0.0

  • Initial release of sshd

Collaborator Number Metric 
            
2.0.0 failed this metric
Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.

Contributing File Metric 
            
2.0.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Foodcritic Metric 
            
2.0.0 failed this metric
FC108: Resource should not define a property named 'name': sshd/resources/openssh_server.rb:23
FC120: Do not set the name property directly on a resource: sshd/recipes/default.rb:34
Run with Foodcritic Version 14.3.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any

No Binaries Metric 
            
2.0.0 passed this metric

Testing File Metric 
            
2.0.0 passed this metric

Version Tag Metric 
            
2.0.0 passed this metric

Chris Aumann Chris Aumann

Details

View Source View Issues

Updated October 29, 2018 Created on

Supported Platforms

  • centos >= 0.0.0
  • debian >= 0.0.0
  • ubuntu >= 0.0.0
  • redhat >= 0.0.0

License

GPL-3.0-or-later

Required Chef Infra Client

(>= 12.7)

Download Cookbook