propellor/Propellor/Property/Ssh.hs

153 lines
4.5 KiB
Haskell
Raw Normal View History

2014-04-03 06:27:17 +00:00
module Propellor.Property.Ssh (
setSshdConfig,
permitRootLogin,
passwordAuthentication,
hasAuthorizedKeys,
restartSshd,
2014-04-13 07:09:00 +00:00
randomHostKeys,
hostKey,
2014-04-13 06:28:40 +00:00
keyImported,
knownHost,
2014-04-13 07:09:00 +00:00
authorizedKeys
2014-04-03 06:27:17 +00:00
) where
2014-03-31 03:55:59 +00:00
import Propellor
2014-03-31 03:37:54 +00:00
import qualified Propellor.Property.File as File
import Propellor.Property.User
2014-03-31 03:55:59 +00:00
import Utility.SafeCommand
2014-04-13 01:34:25 +00:00
import Utility.FileMode
import System.PosixCompat
sshBool :: Bool -> String
sshBool True = "yes"
sshBool False = "no"
sshdConfig :: FilePath
sshdConfig = "/etc/ssh/sshd_config"
setSshdConfig :: String -> Bool -> Property
2014-04-01 21:32:37 +00:00
setSshdConfig setting allowed = combineProperties "sshd config"
2014-03-30 17:12:33 +00:00
[ sshdConfig `File.lacksLine` (sshline $ not allowed)
, sshdConfig `File.containsLine` (sshline allowed)
2014-03-30 20:11:00 +00:00
]
`onChange` restartSshd
`describe` unwords [ "ssh config:", setting, sshBool allowed ]
where
2014-03-30 05:49:11 +00:00
sshline v = setting ++ " " ++ sshBool v
permitRootLogin :: Bool -> Property
permitRootLogin = setSshdConfig "PermitRootLogin"
passwordAuthentication :: Bool -> Property
passwordAuthentication = setSshdConfig "PasswordAuthentication"
2014-04-13 06:28:40 +00:00
dotDir :: UserName -> IO FilePath
dotDir user = do
h <- homedir user
return $ h </> ".ssh"
dotFile :: FilePath -> UserName -> IO FilePath
dotFile f user = do
d <- dotDir user
return $ d </> f
hasAuthorizedKeys :: UserName -> IO Bool
2014-04-13 06:28:40 +00:00
hasAuthorizedKeys = go <=< dotFile "authorized_keys"
where
2014-04-13 06:28:40 +00:00
go f = not . null <$> catchDefaultIO "" (readFile f)
restartSshd :: Property
2014-03-31 03:55:59 +00:00
restartSshd = cmdProperty "service" ["ssh", "restart"]
2014-03-30 03:45:48 +00:00
2014-04-03 06:27:17 +00:00
-- | Blows away existing host keys and make new ones.
-- Useful for systems installed from an image that might reuse host keys.
-- A flag file is used to only ever do this once.
2014-04-13 07:09:00 +00:00
randomHostKeys :: Property
randomHostKeys = flagFile prop "/etc/ssh/.unique_host_keys"
2014-03-30 03:45:48 +00:00
`onChange` restartSshd
where
2014-04-13 07:09:00 +00:00
prop = Property "ssh random host keys" $ do
void $ liftIO $ boolSystem "sh"
2014-03-30 03:45:48 +00:00
[ Param "-c"
, Param "rm -f /etc/ssh/ssh_host_*"
]
ensureProperty $
cmdProperty "/var/lib/dpkg/info/openssh-server.postinst"
2014-03-31 03:55:59 +00:00
["configure"]
2014-04-13 01:34:25 +00:00
2014-04-13 07:09:00 +00:00
-- | Sets ssh host keys from the site's PrivData.
--
-- (Uses a null username for host keys.)
hostKey :: SshKeyType -> Property
2014-04-13 15:14:43 +00:00
hostKey keytype = combineProperties desc
2014-04-13 07:09:00 +00:00
[ Property desc (install writeFile (SshPubKey keytype "") ".pub")
, Property desc (install writeFileProtected (SshPrivKey keytype "") "")
]
2014-04-13 07:49:24 +00:00
`onChange` restartSshd
2014-04-13 07:09:00 +00:00
where
2014-04-13 07:21:02 +00:00
desc = "known ssh host key (" ++ fromKeyType keytype ++ ")"
2014-04-13 07:09:00 +00:00
install writer p ext = withPrivData p $ \key -> do
2014-04-13 07:28:53 +00:00
let f = "/etc/ssh/ssh_host_" ++ fromKeyType keytype ++ "_key" ++ ext
2014-04-13 07:49:24 +00:00
s <- liftIO $ readFileStrict f
if s == key
then noChange
else makeChange $ writer f key
2014-04-13 07:09:00 +00:00
-- | Sets up a user with a ssh private key and public key pair
-- from the site's PrivData.
2014-04-13 01:34:25 +00:00
keyImported :: SshKeyType -> UserName -> Property
2014-04-13 15:14:43 +00:00
keyImported keytype user = combineProperties desc
2014-04-13 07:09:00 +00:00
[ Property desc (install writeFile (SshPubKey keytype user) ".pub")
, Property desc (install writeFileProtected (SshPrivKey keytype user) "")
2014-04-13 01:43:30 +00:00
]
2014-04-13 01:34:25 +00:00
where
2014-04-13 07:21:02 +00:00
desc = user ++ " has ssh key (" ++ fromKeyType keytype ++ ")"
2014-04-13 07:09:00 +00:00
install writer p ext = do
2014-04-13 01:43:30 +00:00
f <- liftIO $ keyfile ext
2014-04-13 01:34:25 +00:00
ifM (liftIO $ doesFileExist f)
( noChange
2014-04-13 21:16:31 +00:00
, ensureProperty $ combineProperties desc
[ Property desc $
withPrivData p $ \key -> makeChange $
writer f key
, File.ownerGroup f user user
]
2014-04-13 01:34:25 +00:00
)
2014-04-13 01:43:30 +00:00
keyfile ext = do
2014-04-13 01:34:25 +00:00
home <- homeDirectory <$> getUserEntryForName user
2014-04-13 07:09:00 +00:00
return $ home </> ".ssh" </> "id_" ++ fromKeyType keytype ++ ext
fromKeyType :: SshKeyType -> String
fromKeyType SshRsa = "rsa"
fromKeyType SshDsa = "dsa"
2014-04-13 15:58:22 +00:00
fromKeyType SshEcdsa = "ecdsa"
fromKeyType SshEd25519 = "ed25519"
2014-04-13 06:28:40 +00:00
-- | Puts some host's ssh public key into the known_hosts file for a user.
knownHost :: [Host] -> HostName -> UserName -> Property
knownHost hosts hn user = Property desc $
go =<< fromHost hosts hn getSshPubKey
where
desc = user ++ " knows ssh key for " ++ hn
go (Just (Just k)) = do
f <- liftIO $ dotFile "known_hosts" user
2014-04-13 07:28:53 +00:00
ensureProperty $ combineProperties desc
2014-04-13 06:28:40 +00:00
[ File.dirExists (takeDirectory f)
, f `File.containsLine` (hn ++ " " ++ k)
2014-04-13 21:16:31 +00:00
, File.ownerGroup f user user
2014-04-13 06:28:40 +00:00
]
go _ = do
warningMessage $ "no configred sshPubKey for " ++ hn
return FailedChange
2014-04-13 07:09:00 +00:00
-- | Makes a user have authorized_keys from the PrivData
authorizedKeys :: UserName -> Property
authorizedKeys user = Property (user ++ " has authorized_keys") $
2014-04-13 21:16:31 +00:00
withPrivData (SshAuthorizedKeys user) $ \v -> do
2014-04-13 07:09:00 +00:00
f <- liftIO $ dotFile "authorized_keys" user
2014-04-13 21:16:31 +00:00
liftIO $ do
createDirectoryIfMissing True (takeDirectory f)
writeFileProtected f v
ensureProperty $ File.ownerGroup f user user