propellor-5.10.1: property-based host configuration management in haskell

Safe Haskell | None
Language | Haskell98

Propellor.Property.Ssh

Contents

- Daemon configuration
- Host keys
- User keys and configuration

Synopsis

- installed :: Property UnixLike
- restarted :: Property DebianLike
- type PubKeyText = String
- data SshKeyType
  - = SshRsa
  - | SshDsa
  - | SshEcdsa
  - | SshEd25519
- sshdConfig :: FilePath
- type ConfigKeyword = String
- setSshdConfigBool :: ConfigKeyword -> Bool -> Property DebianLike
- setSshdConfig :: ConfigKeyword -> String -> Property DebianLike
- data RootLogin
  - = RootLogin Bool
  - | WithoutPassword
  - | ForcedCommandsOnly
- permitRootLogin :: RootLogin -> Property DebianLike
- passwordAuthentication :: Bool -> Property DebianLike
- noPasswords :: Property DebianLike
- listenPort :: Port -> RevertableProperty DebianLike DebianLike
- randomHostKeys :: Property DebianLike
- hostKeys :: IsContext c => c -> [(SshKeyType, PubKeyText)] -> Property (HasInfo + DebianLike)
- hostKey :: IsContext c => c -> SshKeyType -> PubKeyText -> Property (HasInfo + DebianLike)
- hostPubKey :: SshKeyType -> PubKeyText -> Property (HasInfo + UnixLike)
- getHostPubKey :: Propellor (Map SshKeyType PubKeyText)
- userKeys :: IsContext c => User -> c -> [(SshKeyType, PubKeyText)] -> Property (HasInfo + UnixLike)
- userKeyAt :: IsContext c => Maybe FilePath -> User -> c -> (SshKeyType, PubKeyText) -> Property (HasInfo + UnixLike)
- knownHost :: [Host] -> HostName -> User -> Property UnixLike
- unknownHost :: [Host] -> HostName -> User -> Property UnixLike
- authorizedKeysFrom :: User -> (User, Host) -> Property UnixLike
- unauthorizedKeysFrom :: User -> (User, Host) -> Property UnixLike
- authorizedKeys :: IsContext c => User -> c -> Property (HasInfo + UnixLike)
- authorizedKey :: User -> String -> RevertableProperty UnixLike UnixLike
- hasAuthorizedKeys :: User -> IO Bool
- getUserPubKeys :: User -> Propellor [(SshKeyType, PubKeyText)]

# Documentation

installed :: Property UnixLike Source #

restarted :: Property DebianLike Source #

type PubKeyText = String Source #

The text of a ssh public key, for example, "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB3BJ2GqZiTR2LEoDXyYFgh/BduWefjdKXAsAtzS9zeI"

data SshKeyType Source #

Constructors

SshRsa |
SshDsa |
SshEcdsa |
SshEd25519 |

Instances

Bounded SshKeyType Source # |
Instance details Defined in Propellor.Types.PrivData Methods minBound :: SshKeyType maxBound :: SshKeyType
Enum SshKeyType Source # |

Instance details

Defined in Propellor.Types.PrivData

Methods

succ :: SshKeyType -> SshKeyType

pred :: SshKeyType -> SshKeyType

toEnum :: Int -> SshKeyType

fromEnum :: SshKeyType -> Int

enumFrom :: SshKeyType -> [SshKeyType]

enumFromThen :: SshKeyType -> SshKeyType -> [SshKeyType]

enumFromTo :: SshKeyType -> SshKeyType -> [SshKeyType]

enumFromThenTo :: SshKeyType -> SshKeyType -> SshKeyType -> [SshKeyType]

Eq SshKeyType Source # |
Instance details Defined in Propellor.Types.PrivData Methods (==) :: SshKeyType -> SshKeyType -> Bool (/=) :: SshKeyType -> SshKeyType -> Bool
Ord SshKeyType Source # |
Instance details Defined in Propellor.Types.PrivData Methods compare :: SshKeyType -> SshKeyType -> Ordering (<) :: SshKeyType -> SshKeyType -> Bool (<=) :: SshKeyType -> SshKeyType -> Bool (>) :: SshKeyType -> SshKeyType -> Bool (>=) :: SshKeyType -> SshKeyType -> Bool max :: SshKeyType -> SshKeyType -> SshKeyType min :: SshKeyType -> SshKeyType -> SshKeyType
Read SshKeyType Source # |
Instance details Defined in Propellor.Types.PrivData Methods readsPrec :: Int -> ReadS SshKeyType readList :: ReadS [SshKeyType] readPrec :: ReadPrec SshKeyType readListPrec :: ReadPrec [SshKeyType]
Show SshKeyType Source # |
Instance details Defined in Propellor.Types.PrivData Methods showsPrec :: Int -> SshKeyType -> ShowS show :: SshKeyType -> String showList :: [SshKeyType] -> ShowS

# Daemon configuration

sshdConfig :: FilePath Source #

type ConfigKeyword = String Source #

setSshdConfigBool :: ConfigKeyword -> Bool -> Property DebianLike Source #

setSshdConfig :: ConfigKeyword -> String -> Property DebianLike Source #

data RootLogin Source #

Constructors

RootLogin Bool | allow or prevent root login
WithoutPassword | disable password authentication for root, while allowing other authentication methods
ForcedCommandsOnly | allow root login with public-key authentication, but only if a forced command has been specified for the public key

permitRootLogin :: RootLogin -> Property DebianLike Source #

passwordAuthentication :: Bool -> Property DebianLike Source #

noPasswords :: Property DebianLike Source #

Configure ssh to not allow password logins.

To prevent lock-out, this is done only once root's authorized_keys is in place.

listenPort :: Port -> RevertableProperty DebianLike DebianLike Source #

Makes the ssh server listen on a given port, in addition to any other ports it is configured to listen on.

Revert to prevent it listening on a particular port.

# Host keys

randomHostKeys :: Property DebianLike Source #

Blows away existing host keys and make new ones. Useful for systems installed from an image that might reuse host keys. A flag file is used to only ever do this once.

hostKeys :: IsContext c => c -> [(SshKeyType, PubKeyText)] -> Property (HasInfo + DebianLike) Source #

Installs the specified list of ssh host keys.

The corresponding private keys come from the privdata.

Any host keys that are not in the list are removed from the host.

hostKey :: IsContext c => c -> SshKeyType -> PubKeyText -> Property (HasInfo + DebianLike) Source #

Installs a single ssh host key of a particular type.

The public key is provided to this function; the private key comes from the privdata;

hostPubKey :: SshKeyType -> PubKeyText -> Property (HasInfo + UnixLike) Source #

Indicates the host key that is used by a Host, but does not actually configure the host to use it. Normally this does not need to be used; use `hostKey` instead.

getHostPubKey :: Propellor (Map SshKeyType PubKeyText) Source #

# User keys and configuration

userKeys :: IsContext c => User -> c -> [(SshKeyType, PubKeyText)] -> Property (HasInfo + UnixLike) Source #

Sets up a user with the specified public keys, and the corresponding private keys from the privdata.

The public keys are added to the Info, so other properties like `authorizedKeysFrom` can use them.

userKeyAt :: IsContext c => Maybe FilePath -> User -> c -> (SshKeyType, PubKeyText) -> Property (HasInfo + UnixLike) Source #

Sets up a user with the specified pubic key, and a private key from the privdata.

A FilePath can be specified to write the key to somewhere other than the default locations. Allows a user to have multiple keys for different roles.

When the FilePath is relative, is put inside the User's ~.ssh directory.

knownHost :: [Host] -> HostName -> User -> Property UnixLike Source #

Puts some host's ssh public key(s), as set using `hostPubKey` or `hostKey` into the known_hosts file for a user.

unknownHost :: [Host] -> HostName -> User -> Property UnixLike Source #

Reverts `knownHost`

authorizedKeysFrom :: User -> (User, Host) -> Property UnixLike Source #

Ensures that a local user's authorized_keys contains lines allowing logins from a remote user on the specified Host.

The ssh keys of the remote user can be set using `userKeys`

Any other lines in the authorized_keys file are preserved as-is.

unauthorizedKeysFrom :: User -> (User, Host) -> Property UnixLike Source #

Reverts `authorizedKeysFrom`

authorizedKeys :: IsContext c => User -> c -> Property (HasInfo + UnixLike) Source #

Makes a user have authorized_keys from the PrivData

This removes any other lines from the file.

authorizedKey :: User -> String -> RevertableProperty UnixLike UnixLike Source #

Ensures that a user's authorized_keys contains a line. Any other lines in the file are preserved as-is.

hasAuthorizedKeys :: User -> IO Bool Source #

getUserPubKeys :: User -> Propellor [(SshKeyType, PubKeyText)] Source #