summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorJoey Hess2014-11-24 00:51:36 -0400
committerJoey Hess2014-11-24 00:51:36 -0400
commit8d1814a8847f0e498be39a31863e9dd6ffe7e4aa (patch)
tree5817e35badeff0554d2eba369a79d680adc5b381 /src
parent9ac4e94625c77f6d799f9fd6f2ba0e6bbb133697 (diff)
move property to ssh module
Diffstat (limited to 'src')
-rw-r--r--src/Propellor/Property/OS.hs10
-rw-r--r--src/Propellor/Property/Ssh.hs13
2 files changed, 15 insertions, 8 deletions
diff --git a/src/Propellor/Property/OS.hs b/src/Propellor/Property/OS.hs
index ed9a31e1..3290f3ba 100644
--- a/src/Propellor/Property/OS.hs
+++ b/src/Propellor/Property/OS.hs
@@ -13,10 +13,9 @@ import Propellor
import qualified Propellor.Property.Chroot as Chroot
import qualified Propellor.Property.Debootstrap as Debootstrap
import qualified Propellor.Property.File as File
+import qualified Propellor.Property.Ssh as Ssh
import Utility.FileMode
-import Utility.PosixFiles
-
-- | Replaces whatever OS was installed before with a clean installation
-- of the OS that the Host is configured to have.
--
@@ -95,15 +94,10 @@ rootSshAuthorized :: Property
rootSshAuthorized = check (doesDirectoryExist oldloc) $
property (newloc ++ " copied from old OS") $ do
ks <- liftIO $ lines <$> readFile oldloc
- ensureProperty $
- newloc `File.containsLines` ks
- `requires` File.dirExists (takeDirectory newloc)
- `onChange` File.mode newloc mode
+ ensureProperties (map (Ssh.authorizedKey "root") ks)
where
newloc = "/root/.ssh/authorized_keys"
oldloc = oldOsDir ++ newloc
- -- ssh requires the file mode be locked down
- mode = combineModes [ownerWriteMode, ownerReadMode]
-- Installs an appropriate kernel from the OS distribution.
kernelInstalled :: Property
diff --git a/src/Propellor/Property/Ssh.hs b/src/Propellor/Property/Ssh.hs
index 4ecdf23e..5d326b83 100644
--- a/src/Propellor/Property/Ssh.hs
+++ b/src/Propellor/Property/Ssh.hs
@@ -3,6 +3,7 @@ module Propellor.Property.Ssh (
permitRootLogin,
passwordAuthentication,
hasAuthorizedKeys,
+ authorizedKey,
restarted,
randomHostKeys,
hostKeys,
@@ -155,6 +156,8 @@ knownHost hosts hn user = property desc $
return FailedChange
-- | Makes a user have authorized_keys from the PrivData
+--
+-- This removes any other lines from the file.
authorizedKeys :: UserName -> Context -> Property
authorizedKeys user context = withPrivData (SshAuthorizedKeys user) context $ \get ->
property (user ++ " has authorized_keys") $ get $ \v -> do
@@ -167,6 +170,16 @@ authorizedKeys user context = withPrivData (SshAuthorizedKeys user) context $ \g
, File.ownerGroup (takeDirectory f) user user
]
+-- | Ensures that a user's authorized_keys contains a line.
+-- Any other lines in the file are preserved as-is.
+authorizedKey :: UserName -> String -> Property
+authorizedKey user l = property (user ++ " has autorized_keys line " ++ l) $ do
+ f <- liftIO $ dotFile "authorized_keys" user
+ ensureProperty $
+ f `File.containsLine` l
+ `requires` File.dirExists (takeDirectory f)
+ `onChange` File.mode f (combineModes [ownerWriteMode, ownerReadMode])
+
-- | Makes the ssh server listen on a given port, in addition to any other
-- ports it is configured to listen on.
--