1

I look for a solution to create the ssh host keys for my puppet clients on the puppetmaster. I did some research and found http://jsosic.wordpress.com/2012/12/04/managing-ssh-host-keys-with-puppet/, but I couldn't get it working. Is there a more elegant solution to handle that or a full example of that?

I know it's possible to generate the host keys on the clients and back them up to the puppetmaster, but I'd really prefer to generate them directly on the master.

Edit:

I created a module 'ssh'.

The content of init.pp is:

class ssh::server {
  if generate('/etc/puppet/modules/ssh/scripts/generate_host_keys.sh',
$keys_dir) {
    include ssh::server::keys
  }
}

class ssh::server::keys {
  file { '/etc/ssh/ssh_host_rsa_key.pub':
    ensure  => file,
    owner   => root,
    group   => root,
    mode    => '0644',
    source  => [
      'puppet:///private/ssh/ssh_host_rsa_key.pub',
      'puppet:///modules/ssh/ssh_host_rsa_key.pub',
    ],
    require => Package['openssh-server'],
    notify  => Service[$service_name],
  }
}

The content of the generate_host_keys.sh is the following:

#!/bin/bash

# check arg0: dir for keys
[ -z "$1" ] && echo "Please specify directory for key generation" && exit 1
KEYSDIR="$1"

# set umask
umask 0022

# create directory tree if it does not exist
[ ! -d "$KEYSDIR" ] && mkdir -p $KEYSDIR

#
# functions stolen from CentOS 6 sshd init script
#

# Some functions to make the below more readable
KEYGEN=/usr/bin/ssh-keygen
RSA1_KEY=$1/ssh_host_key
RSA_KEY=$1/ssh_host_rsa_key
DSA_KEY=$1/ssh_host_dsa_key

# source function library
. /etc/rc.d/init.d/functions

fips_enabled() {
  if [ -r /proc/sys/crypto/fips_enabled ]; then
    cat /proc/sys/crypto/fips_enabled
  else  
    echo 0
  fi
}

do_rsa1_keygen() {
  if [ ! -s $RSA1_KEY -a `fips_enabled` -eq 0 ]; then
    echo -n $"Generating SSH1 RSA host key: "
    rm -f $RSA1_KEY
    if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
      chmod 600 $RSA1_KEY
      chmod 644 $RSA1_KEY.pub
      success $"RSA1 key generation"
      echo
    else  
      failure $"RSA1 key generation"
      echo
      exit 1
    fi
  fi
}

do_rsa_keygen() {
  if [ ! -s $RSA_KEY ]; then
    echo -n $"Generating SSH2 RSA host key: "
    rm -f $RSA_KEY
    if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
      chmod 600 $RSA_KEY
      chmod 644 $RSA_KEY.pub
      success $"RSA key generation"
      echo
    else 
      failure $"RSA key generation"
      echo
      exit 1
    fi
  fi
}

do_dsa_keygen() {
  if [ ! -s $DSA_KEY ]; then
    echo -n $"Generating SSH2 DSA host key: "
    rm -f $DSA_KEY
    if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
      chmod 600 $DSA_KEY
      chmod 644 $DSA_KEY.pub
      success $"DSA key generation"
      echo
    else
      failure $"DSA key generation"
      echo
      exit 1
    fi
  fi
}

# main
do_rsa1_keygen
do_rsa_keygen
do_dsa_keygen
chmod -R 644 $KEYSDIR/*
exit 0

manifests/site.pp looks like that

node { 'mynode':
  include ssh::server
}

Running puppet agent --test on the client produce the following output:

Info: Retrieving plugin
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to execute generator /etc/puppet/modules/ssh/scripts/generate_host_keys.sh: Execution of '/etc/puppet/modules/ssh/scripts/generate_host_keys.sh ' returned 1:  at /etc/puppet/modules/ssh/manifests/init.pp:2 on node nodename
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

Thanks,

Paul

5
  • What does "couldn't get it working" mean? What did you try, what did you expect to happen, what happened instead?
    – Jenny D
    Jun 5, 2013 at 7:28
  • sorry, I forgot to paste that :( I added it now.
    – Paul
    Jun 5, 2013 at 7:39
  • 1
    Where is $keys_dir getting set?
    – Zoredache
    Jun 5, 2013 at 9:16
  • Are there some better solution to do that? I don't tink this one is very clean. I'm just migrating from BCfg2 and look basically for a replacement for this module: docs.bcfg2.org/server/plugins/generators/sshbase.html @Zoredache
    – Paul
    Jun 7, 2013 at 3:27
  • I think you'd want to take advantage of Puppet's Exported Resources (see puppet.com/docs/puppet/5.3/lang_exported.html) they even use ssh keys as an example. Aug 12, 2018 at 4:47

1 Answer 1

0
  1. Try to add /usr/bin/env as the first parameter of the generate function:
    if generate('/usr/bin/env','/etc/puppet/modules/ssh/scripts/generate_host_keys.sh', $keys_dir) {

  2. Verify that your script returns 0 on exit, non-zero return code will make the parser throw an Error 400

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.