puppet-module-root

Table of Contents

1. Overview
2. Usage - Configuration options
3. Reference - Parameter and detailed reference to all options

Overview

This module manages the Linux root user.

This module has soft dependencies on the following modules:

• puppetlabs/mailalias_core
• puppetlabs/sshkeys_core

Usage

root

include root

Manage root and define mailaliases, ssh_authorized_keys and set a password.

root::mailaliases:
  - 'root@example.com'
root::password: '$1$Bp8B.dWo$DUVekjsAsU0ttWZmS37P5'
root::ssh_authorized_keys:
  - 'ssh-rsa somelonghash== user@fqdn'

Authorized keys can also be set using a hash.

root::ssh_authorized_keys:
  user@fqdn:
    type: 'ssh-rsa'
    key: 'somelonghash=='

If you wish to merge authorized keys from multiple locations:

lookup_options:
  root::mailaliases:
    merge: unique
  root::ssh_authorized_keys:
    merge: deep
root::mailaliases:
  - 'root@example.com'
root::ssh_authorized_keys:
  user@fqdn:
    type: 'ssh-rsa'
    key: 'somelonghash=='
# Some other Hiera location:
root::mailaliases:
  - 'root@example2.com'
root::ssh_authorized_keys:
  user2@fqdn:
    type: 'ssh-rsa'
    key: 'somelonghash=='

If you use Arrays for resources like root::ssh_authorized_keys then use unique merge instead of deep.

To export a system's root RSA key

root::export_key: true

To generate and export a different root SSH key:

root::generate_key_type: ecdsa-sk
root::export_key_type: "%{lookup('root::generate_key_type')}"

To collect exported root RSA keys from multiple tags

root::collect_exported_keys: true
root::collect_exported_keys_tags:
  - "%{facts.domain}"
  - 'foo'

Add Kerberos principals to /root/.k5login:

root::kerberos_login_principals:
  - user1@EXAMPLE.COM
  - user2@EXAMPLE.COM

Add Kerberos principals and commands to /root/.k5users. Note that user3 and user4 will not have commands defined. The examples also illustrate defining commands as strings or arrays.

root::kerberos_users_commands:
  user1@EXAMPLE.COM:
    - /bin/systemctl
    - /bin/cat
  user2@EXAMPLE.COM: /bin/systemctl /bin/cat
  user3@EXAMPLE.COM: ''
  user4@EXAMPLE.COM: []

If a different module manages Kerberos for root, disable Kerberos in this module:

root::manage_kerberos: false

Set an automatic logout for idle interactive shells (in seconds):

root::logout_timeout: 600

Reference

http://treydock.github.io/puppet-module-root/

Reference

Table of Contents

Classes

Public Classes

• root: Manage root user

Private Classes

• root::kerberos: Private class
• root::key::export: Private class
• root::params: Private class

Defined types

Public Defined types

• root::ssh_authorized_key: Define root user's ssh_authorized_key resources

Private Defined types

• root::key::collect: Private class

Data types

• Root::SSHKeyTypes

Classes

root

Manage root user

Examples

include ::root

Parameters

The following parameters are available in the root class:

• mailaliases
• ssh_authorized_keys
• password
• purge_ssh_keys
• generate_key_type
• export_key
• export_key_type
• export_key_options
• export_key_tag
• collect_exported_keys
• collect_exported_keys_tags
• ssh_private_key
• ssh_private_key_source
• ssh_public_key
• ssh_public_key_source
• logout_timeout
• manage_kerberos
• kerberos_login_principals
• kerberos_users_commands

mailaliases

Data type: Array

An array that defines mailaliases for the root user (defaults to an empty array). When an empty array is given Mailaliases[root] is set to ensure => absent.

Default value: []

ssh_authorized_keys

Data type: Variant[Array, Hash]

Defines ssh_autorized_keys to be passed to the root::ssh_authorized_key defined type. See root::ssh_authorized_key for examples of valid formats

Default value: {}

password

Data type: Optional[Variant[String, Sensitive[String]]]

The password hash used for the root account.

Default value: undef

purge_ssh_keys

Data type: Boolean

Sets if unmanaged SSH keys will be purged for the root account.

Default value: true

generate_key_type

Data type: Root::SSHKeyTypes

Type of SSH key to generate when exporting

Default value: 'rsa'

export_key

Data type: Boolean

Sets if the root SSH RSA key should be created and exported.

Default value: false

export_key_type

Data type: Optional[Root::SSHKeyTypes]

The ssh_authorized_key type that is exported

Default value: $generate_key_type

export_key_options

Data type: Optional[Array]

Options to set for the exported SSH RSA key

Default value: undef

export_key_tag

Data type: String

The tag to use when exporting the root SSH RSA key.

Default value: $facts['networking']['domain']

collect_exported_keys

Data type: Boolean

Sets if the export root SSH RSA keys should be collected.

Default value: false

collect_exported_keys_tags

Data type: Array

Array of tags for root SSH RSA keys to collect.

Default value: [$facts['networking']['domain']]

ssh_private_key

Data type: Stdlib::Absolutepath

Path to root's SSH private key

Default value: '/root/.ssh/id_rsa'

ssh_private_key_source

Data type: Optional[String]

The source for root's SSH RSA private key

Default value: undef

ssh_public_key

Data type: Stdlib::Absolutepath

Path to root's SSH public key

Default value: '/root/.ssh/id_rsa.pub'

ssh_public_key_source

Data type: Optional[String]

The source for root's SSH RSA public key

Default value: undef

logout_timeout

Data type: Optional[Integer[0, default]]

Time (in seconds) before idle interactive terminals will logout

Default value: undef

manage_kerberos

Data type: Boolean

Boolean that sets if Kerberos files should be managed

Default value: true

kerberos_login_principals

Data type: Array

The Kerberos principals to write to /root/.k5login

Default value: []

kerberos_users_commands

Data type: Hash[String[1], Variant[String, Array]]

The Kerberos user principals and commands to write to /root/.k5users

Default value: {}

Defined types

root::ssh_authorized_key

Define root user's ssh_authorized_key resources

Examples

Define ssh_authorized_key using Hash

root::ssh_authorized_key { 'user@fqdn':
  type => 'ssh-rsa',
  key  => 'somelonghash==',
}

Define ssh_authorized_key using name string

root::ssh_authorized_key { 'ssh-rsa somelonghash== user@fqdn': }

Parameters

The following parameters are available in the root::ssh_authorized_key defined type:

• ensure
• key
• options
• type

ensure

Data type: Enum['present','absent']

ssh_authorized_key ensure property

Default value: 'present'

key

Data type: Optional[String[1]]

The SSH key hash

Default value: undef

options

Data type: Optional[Variant[String[1], Array]]

The SSH key options

Default value: undef

type

Data type: Optional[String[1]]

The type of SSH key.

Default value: undef

Data types

Root::SSHKeyTypes

The Root::SSHKeyTypes data type.

Alias of

Enum['dsa', 'rsa', 'ecdsa', 'ecdsa-sk', 'ed25519', 'ed25519-sk']

Change log

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

v6.1.0 (2023-06-16)

Full Changelog

Added

• Note compatibility with stdlib 9.x #28 (jcpunk)

v6.0.0 (2023-05-01)

Full Changelog

Changed

• BREAKING CHANGE: Remove Hiera merge parameters #26 (treydock)
• Support Puppet 8, drop Puppet 6 and Ubuntu 18.04 #25 (treydock)
• Support more root key types, replace root_sshrsakey fact with root_ssh_key.rsa #24 (treydock)
• Drop Debian 9 support #22 (treydock)

Added

• Support EL9 and Ubuntu 22.04 #23 (treydock)
• Modernize unit testing #21 (treydock)

v5.1.2 (2022-06-21)

Full Changelog

Fixed

• Set show_diff to false for SSH public and private keys #18 (treydock)

v5.1.1 (2022-06-06)

Full Changelog

Fixed

• Make sure file ends in new line #17 (jcpunk)

v5.1.0 (2022-05-17)

Full Changelog

Added

• Support Debian and Ubuntu #16 (treydock)
• Make password Sensitive #14 (jcpunk)

v5.0.0 (2022-03-15)

Full Changelog

Changed

• Major updates (Read description) #13 (treydock)

v4.6.0 (2020-10-26)

Full Changelog

Added

• Add booleans for hiera merge #11 (jcpunk)

v4.5.0 (2020-10-21)

Full Changelog

Added

• Add optional root shell timeout #10 (jcpunk)

v4.4.0 (2020-09-18)

Full Changelog

Added

• Support defining /root/.k5login and /root/.k5users #9 (treydock)

v4.3.0 (2020-05-12)

Full Changelog

Added

• Update stdlib dependency range and PDK update #6 (treydock)

v4.2.0 (2019-10-03)

Full Changelog

Added

• Add export_key_options parameter #3 (treydock)

v4.1.1 (2019-05-09)

Full Changelog

Added

• Convert module to PDK #1 (treydock)

Fixed

• Fix dependency cycle #2 (treydock)

v4.1.0 (2019-05-07)

Full Changelog

4.0.0 (2019-03-22)

Full Changelog

3.0.0 (2017-10-26)

Full Changelog

2.0.0 (2017-10-26)

Full Changelog

1.0.0 (2014-05-09)

Full Changelog

v0.0.3 (2013-06-12)

Full Changelog

v0.0.2 (2013-05-14)

Full Changelog

v0.0.1 (2013-05-14)

Full Changelog

* This Changelog was automatically generated by github_changelog_generator