add support for PubkeyAuthentication in sshd_config
diff --git a/README.md b/README.md
index 8150ab4..8512070 100644
--- a/README.md
+++ b/README.md
@@ -556,6 +556,12 @@
- *Default*: 'no'
+sshd_pubkeyauthentication
+-------------------------
+String for PubkeyAuthentication option in sshd_config. Valid values are 'yes' and 'no'.
+
+- *Default*: 'yes'
+
sshd_ignoreuserknownhosts
-------------------------
String for IgnoreUserKnownHosts option in sshd_config. Valid values are 'yes' and 'no'. Specifies whether sshd(8) should ignore the user's ~/.ssh/known_hosts during RhostsRSAAuthentication or HostbasedAuthentication.
diff --git a/manifests/init.pp b/manifests/init.pp
index 20ffc4c..57b26f2 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -81,6 +81,7 @@
$sshd_config_hostkey = 'USE_DEFAULTS',
$sshd_listen_address = undef,
$sshd_hostbasedauthentication = 'no',
+ $sshd_pubkeyauthentication = 'yes',
$sshd_ignoreuserknownhosts = 'no',
$sshd_ignorerhosts = 'yes',
$manage_service = true,
@@ -561,6 +562,8 @@
validate_re($sshd_hostbasedauthentication, '^(yes|no)$', "ssh::sshd_hostbasedauthentication may be either 'yes' or 'no' and is set to <${sshd_hostbasedauthentication}>.")
+ validate_re($sshd_pubkeyauthentication, '^(yes|no)$', "ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to <${sshd_pubkeyauthentication}>.")
+
validate_re($sshd_ignoreuserknownhosts, '^(yes|no)$', "ssh::sshd_ignoreuserknownhosts may be either 'yes' or 'no' and is set to <${sshd_ignoreuserknownhosts}>.")
validate_re($sshd_ignorerhosts, '^(yes|no)$', "ssh::sshd_ignorerhosts may be either 'yes' or 'no' and is set to <${sshd_ignorerhosts}>.")
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index f0b59ce..c38a380 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -391,6 +391,7 @@
:sshd_config_subsystem_sftp => '/opt/ssh/bin/sftp',
:sshd_kerberos_authentication => 'no',
:sshd_password_authentication => 'no',
+ :sshd_pubkeyauthentication => 'no',
:sshd_allow_tcp_forwarding => 'no',
:sshd_x11_forwarding => 'no',
:sshd_use_pam => 'no',
@@ -478,6 +479,7 @@
it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommand \/path\/to\/command$/) }
it { should contain_file('sshd_config').with_content(/^AuthorizedKeysCommandUser asdf$/) }
it { should contain_file('sshd_config').with_content(/^HostbasedAuthentication no$/) }
+ it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication no$/) }
it { should contain_file('sshd_config').with_content(/^IgnoreUserKnownHosts no$/) }
it { should contain_file('sshd_config').with_content(/^IgnoreRhosts yes$/) }
it { should contain_file('sshd_config').with_content(/^ChrootDirectory \/chrootdir$/) }
@@ -2468,6 +2470,38 @@
end
end
+ describe 'with parameter sshd_pubkeyauthentication' do
+ let :facts do
+ default_facts.merge(
+ {
+ }
+ )
+ end
+
+ ['yes','no'].each do |value|
+ context "specified as valid #{value} (as #{value.class})" do
+ let(:params) { { :sshd_pubkeyauthentication => value } }
+
+ it { should contain_file('sshd_config').with_content(/^PubkeyAuthentication #{value}$/) }
+ end
+ end
+
+ ['YES',true,2.42,['array'],a = { 'ha' => 'sh' }].each do |value|
+ context "specified as invalid value #{value} (as #{value.class})" do
+ let(:params) { { :sshd_pubkeyauthentication => value } }
+ if value.is_a?(Array)
+ value = value.join
+ end
+
+ it do
+ expect {
+ should contain_class('ssh')
+ }.to raise_error(Puppet::Error,/ssh::sshd_pubkeyauthentication may be either 'yes' or 'no' and is set to/)
+ end
+ end
+ end
+ end
+
describe 'with parameter sshd_ignoreuserknownhosts' do
let :facts do
default_facts.merge(
diff --git a/spec/fixtures/sshd_config_debian b/spec/fixtures/sshd_config_debian
index ae66a64..355ce91 100644
--- a/spec/fixtures/sshd_config_debian
+++ b/spec/fixtures/sshd_config_debian
@@ -49,6 +49,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/spec/fixtures/sshd_config_rhel b/spec/fixtures/sshd_config_rhel
index ebc70aa..d73a8a8 100644
--- a/spec/fixtures/sshd_config_rhel
+++ b/spec/fixtures/sshd_config_rhel
@@ -49,6 +49,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/spec/fixtures/sshd_config_sles_12_x86_64 b/spec/fixtures/sshd_config_sles_12_x86_64
index e2574ec..c56fde8 100644
--- a/spec/fixtures/sshd_config_sles_12_x86_64
+++ b/spec/fixtures/sshd_config_sles_12_x86_64
@@ -49,6 +49,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/spec/fixtures/sshd_config_solaris b/spec/fixtures/sshd_config_solaris
index 045b680..11b261a 100644
--- a/spec/fixtures/sshd_config_solaris
+++ b/spec/fixtures/sshd_config_solaris
@@ -47,6 +47,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/spec/fixtures/sshd_config_suse_i386 b/spec/fixtures/sshd_config_suse_i386
index e2574ec..c56fde8 100644
--- a/spec/fixtures/sshd_config_suse_i386
+++ b/spec/fixtures/sshd_config_suse_i386
@@ -49,6 +49,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/spec/fixtures/sshd_config_suse_x86_64 b/spec/fixtures/sshd_config_suse_x86_64
index f4640e0..1a91c74 100644
--- a/spec/fixtures/sshd_config_suse_x86_64
+++ b/spec/fixtures/sshd_config_suse_x86_64
@@ -49,6 +49,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
diff --git a/templates/sshd_config.erb b/templates/sshd_config.erb
index 59b57f4..821feb9 100644
--- a/templates/sshd_config.erb
+++ b/templates/sshd_config.erb
@@ -68,6 +68,7 @@
#RSAAuthentication yes
#PubkeyAuthentication yes
+PubkeyAuthentication <%= @sshd_pubkeyauthentication %>
#AuthorizedKeysFile .ssh/authorized_keys
<% if @sshd_config_authkey_location -%>
AuthorizedKeysFile <%= @sshd_config_authkey_location %>
