#760 - Make our ssh configuration used automatically for all servers

modules/filtermaster/manifests/init.pp

 class filtermaster {
   Cron {
     environment => ['MAILTO=admins@adblockplus.org', 'PYTHONPATH=/opt/sitescripts'],
   }
 
-  class {'ssh':
-    custom_configuration => '
-    MaxSessions 50
-    MaxStartups 50
+  concat::fragment {'sshd_max_limits':
+    target => 'sshd_config',
+    order => '02',

[Wladimir Palant, 2014/07/15 11:56:47]

This doesn't need to be sequential, '50' maybe?

+    content => '
+      MaxSessions 50
+      MaxStartups 50
+    '
+  }
 
-    Match User rsync
-      AllowTcpForwarding no
-      X11Forwarding no
-      AllowAgentForwarding no
-      GatewayPorts no
-      ForceCommand rsync --server --sender -vltprz --delete-excluded . /home/rsync/generated/data/'
+  concat::fragment {'sshd_user_rsync':
+    target => 'sshd_config',
+    content => '

[Wladimir Palant, 2014/07/15 11:56:47]

order => '99'?

[mathias, 2014/07/15 12:03:12]

Either the non-block settings (see your comment above) or block settings should
become sequential. I dislike to do that for both types. Which do you prefer? (I
prefer the former option.)

[Wladimir Palant, 2014/07/15 14:18:35]

I don't really understand your comment. My understanding of sshd_config is that
ordering matters - Match blocks always have to be placed at the end of the file.
It might be that omitting the order parameter will also place the fragment at
the end but the documentation doesn't really say what will happen in that
scenario so I would consider the behavior as undefined. Hence my suggestion to
always use '99' for blocks.

Using '50' instead of '02' was meant simply in case we need to add more
fragments to the generic part. We can have as convention that anything below
'50' is generic whereas '50' and above marks custom configuration.

+      Match User rsync
+        AllowTcpForwarding no
+        X11Forwarding no
+        AllowAgentForwarding no
+        GatewayPorts no
+        ForceCommand rsync --server --sender -vltprz --delete-excluded . /home/rsync/generated/data/
+    '
   }
 
   user {'rsync':
     ensure => present,
     comment => 'Filter list mirror user',
     home => '/home/rsync',
     managehome => true
   }
 
   file {'/home/rsync/update_repos.sh':
@@ skipping 99 matching lines @@
       User['rsync'],
       File['/home/rsync/update_repos.sh']
     ],
     minute  => '8-58/10'
   }
 
   class {'sitescripts':
     sitescriptsini_source => 'puppet:///modules/filtermaster/sitescripts'
   }
 }