Restrict access in Puppet - part 1
This time we're going to lock the server down a bit with Puppet. Now that we have our own user, let's force login using a public key we'll create for the user.
Eventually I also want to create a self signed certificate for the user to use with their public key to access resources via HTTPS with client certificates wrap the whole certificate up in a pkcs12 file and email it to them. I won't get into that yet.
I was going to write the framework myself, even had a skeleton all laid out - I'd decided on two classes, the keystore which would handle creating, storing and revoking keys and later certificates and a user class for creating users.
The first thing I did was create a new keystore.pp file, the ssh::auth package made that pretty easy:
Then I needed to do was create a keystore. The keystore is just the host you nominate to control all your client and server keys. To do that in nodes.pp I properly named my only node and stopped using the default and added a couple of new includes.
Run puppet and you should end up with a directory
ready to store keys.
I decided I'd update my user package by removing some files and putting the user class into the init.pp file. I had too many files in there that just didn't seem to be doing anything.
Then I added a create method in the user class in my init.pp file:
This code defines a new method called create, and realises all the required resources, finally it generates a new key for the user.
Now we need to update our node to create ourselves a user using this new method
The last step is to copy the private and public key down to a machine.
It's important that you test ssh logins to this host using the new keys. Otherwise you risk locking yourself out for good!
I think that's probably a good place for me to call it a night - tomorrow I'll be locking down sshd so that only users with keys can login.
- create <user> creates a new user with the given username.
- clientkey <user> [filename] installs the key for a given user, optionally set a filename. I already have some keys
- serverkey <user> [login_as] installs the key into the authorized_keys allowing users to login to this server. Defaults to logging in as the same user as the key 'owner' if the. I also need to use my key to login as another user, the git and svn users for example.
# wget http://projects.reductivelabs.com/attachments/download/935/auth.pp -O ./modules/user/manifests/auth.pp
modules/user/manifests/keystore.pp
class user::keystore {
include ssh::auth::keymaster
}manifests/nodes.pp
node build {
include sudo, user, ssh::auth, user::keystore
}/var/lib/keys
# puppet -v --modulepath=/etc/puppet/modules /etc/puppet/manifests/site.pp
# rm modules/user/manifests/virtual.pp # rm modules/user/manifests/unixadmins.pp
modules/users/manifests/init.pp
import "*"
class user {
define create {
@user { "$title":
ensure => "present",
gid => "$title",
home => "/home/$title",
shell => "/bin/bash",
managehome => true,
require => [Group["$title"]],
}
@file { "/home/$title":
ensure => "directory",
mode => 700,
owner => "$title",
group => "$title",
}
@file { "/home/$title/.ssh":
ensure => "directory",
mode => 600,
owner => "$title",
group => "$title",
}
@group { "$title":
ensure => "present",
}
realize User[$title]
realize Group[$title]
realize File["/home/$title"]
realize File["/home/$title/.ssh"]
ssh::auth::key{"$title":}
}
define client_key ($ensure = "", $filename = "") {
ssh::auth::client{"$title": ensure=>$ensure, filename=>$filename}
}
define server_key ($ensure = "", $user = "") {
ssh::auth::server{"$title": ensure=>$ensure, user=>$user}
}
}manifests/nodes.pp
node my-server {
include sudo, ssh::auth, ssh::auth::keymaster, user
user::create{"andrewmccall":}
user::client_key{"andrewmccall":}
user::server_key{"andrewmccall":}
}