Forge Home


Module to manage OpenSSH with focus on using augeas


7,725 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 1.0.1 (latest)
  • 1.0.0
  • 0.1.11
  • 0.1.10
  • 0.1.9
  • 0.1.8
  • 0.1.7
  • 0.1.6
  • 0.1.5
  • 0.1.4
  • 0.1.3
  • 0.1.2
  • 0.1.1
released Apr 6th 2016
This version is compatible with:
  • Puppet Enterprise >=3.5.0
  • Puppet >=3.5.0
  • ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'fonk-openssh', '1.0.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add fonk-openssh
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install fonk-openssh --version 1.0.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



fonk/openssh — version 1.0.1 Apr 6th 2016


Build Status

Table of Contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Setup - The basics of getting started with openssh
  4. Usage - Configuration options and additional functionality
  5. Reference - An under-the-hood peek at what the module is doing and how
  6. Limitations - OS compatibility, etc.
  7. Development - Guide for contributing to the module


Module to manage OpenSSH with focus on using augeas for configfile modifications to provide compatibility with upstream changes in this files.

Puppetversion: >= 3.5.0

OS: RedHat, Debian

Module Description

This Module installs the openssh server and client and manages the sshd_config. It optionally gathers the hostkeys and provides them for other hosts.


What openssh affects

  • Packages and service for openssh
  • sshd_config
  • system-wide known_hosts file

Setup Requirements

To use spreading of hostkeys you will need a puppetdb-enabled puppetserver

Beginning with openssh

To begin using this module with default parameters, declare the class with include openssh

Any Puppet code that uses anything from the apt module requires that the core apt class be declared.


Simple usage

Install packages, set some defaults, ensure service is running, export all keys to all hosts

class { 'openssh': }

Advanced usage

Because the hash of the config-parameter gets passed comletely to augeas, you can use all options your augeas lens provides in the way your augeas lens specifies it. Here are some examples for that:

Install packages, set some custom values, ensure service is running, export and collect no keys

class { '::openssh':
  config => {
    'X11Forwarding'      => 'no',
    'AllowTcpForwarding' => 'yes',
    'Port'               => '222',
  exporttag  => false,
  collecttag => false,

Even more advanced usage

Install packages, set two listening ports and special parameters for group "no-admin", ensure service is running, export keys with tag "customer_hosts" and collect no keys

class { '::openssh':
  config => {
    'X11Forwarding' => 'no',
    'AllowTcpForwarding' => 'yes',
    'Port[1]'            => '222',
    'Port[2]'            => '333',
    'Match[1]/Condition/Group'          => 'no-admin',
    'Match[1]/Settings/ChrootDirectory' => '/home',
    'Match[1]/Settings/X11Forwarding'   => 'no',
  exporttag  => 'customer_hosts',
  collecttag => false,



  • openssh: Main class that is used to set the variables and includes the other classes

  • openssh::params: Sets defaults for the variables used by this module

  • openssh::install: Installs the packages on the system

  • openssh::config: Cares about the whole openssh-configuration including rollout of known hostkeys

  • openssh::service: Handles the openssh service



  • ensure: Set the ensure-value for the packages. Default: 'present'

  • packages: Name or array of the packages to be installed. Default: osfamily-specific (see params.pp)

  • servicename: Name of the service to be started Default: osfamily-specific (see params.pp)

  • sshd_config: Path to the sshd_config file Default: /etc/ssh/sshd_config

  • sshd_config_def: Default values for sshd_config parameters. This should almost never need to be changed.

  • config: A hash with all options that should get set in sshd_config

  • exporttag: Tag that the exported hostkey get for collecting. If 'false', key won't get exported. Default: managedhosts

  • collecttag: Keys with this tag will get collected. If 'false', keys won't get collected.



If you like to contribute: pull requests are welcome :-)