Quick version: Set your defaults attributes before the other Hashes as
the template will read in the order of appearance (declaration)
In my opinion a better way would be to do this:
default['openssh']['client']['*'] = {
'global_known_hosts_file' = '/var/lib/sss/pubconf/known_hosts'
'pubkey_authentication' = 'yes'
'verify_host_key_d_n_s' = 'no'
'#verify_host_key_d_n_s:no-_sonst_ist_es_zu_langsam'] = 'no'
'host_key_algorithms' = 'ssh-rsa,ssh-dss'
'proxy_command' = '/usr/bin/sss_ssh_knownhostsproxy -p %p %h'
}
default['openssh']['client']['foo'] = {
'pubkey_authentication' => 'no',
'host_key_algorithms' => 'ssh-dss'
}
default['openssh']['client']['bar'] = {
'host_key_algorithms' => 'ssh-dss'
}
The template for ssh_config[1] iterate over the key just under 'client'
and build the values accordingly.
[1]
https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh_config.erb
Le 2015-09-22 17:00, Alexander Skwar a écrit :
Hi again
Hm. I guess, I'm doing something wrong... Now my ssh_config looks like this:
$ cat /etc/ssh/ssh_config
This file was generated by Chef for host
Do NOT modify this file by hand!
Host *
Host foo
PubkeyAuthentication no
HostKeyAlgorithms ssh-dss
Host bar
HostKeyAlgorithms ssh-dss
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
PubkeyAuthentication yes
VerifyHostKeyDNS no
#VerifyHostKeyDNS:No-SonstIstEsZuLangsam no
HostKeyAlgorithms ssh-rsa,ssh-dss
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
That's clearly not, what I want.
In my own cookbook, I've got this attributes/default.rb file:
default['openssh']['client']['foo'] = {
'pubkey_authentication' => 'no',
'host_key_algorithms' => 'ssh-dss'
}
default['openssh']['client']['bar'] = {
'host_key_algorithms' => 'ssh-dss'
}
default['openssh']['client']['global_known_hosts_file'] = '/var/lib/sss/pubconf/known_hosts'
default['openssh']['client']['pubkey_authentication'] = 'yes'
default['openssh']['client']['verify_host_key_d_n_s'] = 'no'
default['openssh']['client']['#verify_host_key_d_n_s:no-_sonst_ist_es_zu_langsam'] = 'no'
default['openssh']['client']['host_key_algorithms'] = 'ssh-rsa,ssh-dss'
default['openssh']['client']['proxy_command'] = '/usr/bin/sss_ssh_knownhostsproxy -p %p %h'
#default['openssh']['client']['*'] = {}
EOF
I would not have expected, that my "default" settings (eg. proxy_command to take just one example) is below "Host bar". As it is not in any Host hash, I would've expected, that the setting would've been above all the "Host ..." blocks or maybe in the "Host *" block.
How to do it correctly?
When I move my "default lines" ABOVE all the "Host" lines (default['openssh']['client']['foo'] and default['openssh']['client']['bar']), then the generated ssh_config is good. Don't know, but that does not feel right.
Regards,
Alexander
2015-09-22 16:37 GMT+02:00 Alexander Skwar alexanders.mailinglists+nospam@gmail.com:
Hello
In the openssh Cookbook from Supermarket @ openssh versions [2], the attributes file for the "client section" contains this:
default['openssh']['client']['host'] = '*'
See github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57 [3]
SHORT QUESTION: HOW DO I GET RID OF THIS, WITHOUT HAVING TO MODIFY THE OPENSSH/ATTRIBUTES/DEFAULT.RB FILE; IE. FROM MY OWN COOKBOOK, WHICH HAS A "INCLUDE_RECIPE "OPENSSH"" SOMEWHERE.
Because of that, the generated /etc/ssh/ssh_config file contains at least this:
$ cat /etc/ssh/ssh_config
This file was generated by Chef for host
Do NOT modify this file by hand!
Host *
Ie., there's at least a "Host *" entry. And the way I have it now, all my attributes are below that; ie. my ssh_config file reads:
$ cat /etc/ssh/ssh_config
This file was generated by Chef for host
Do NOT modify this file by hand!
Host *
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
PubkeyAuthentication yes
VerifyHostKeyDNS no
#VerifyHostKeyDNS:No-SonstIstEsZuLangsam no
HostKeyAlgorithms ssh-rsa,ssh-dss
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
That's not quite what I want. I don't want that "Host *" line there.
Thanks a lot,
Alexander
=> GOOGLE+ => http://plus.skwar.me [1] <==
=> CHAT (Jabber/Google Talk) => a.skwar@gmail.com <==
--
Alexander
=> GOOGLE+ => http://plus.skwar.me [1] <==
=> CHAT (Jabber/Google Talk) => a.skwar@gmail.com <==
Links:
[1] http://plus.skwar.me/
[2] openssh versions
[3]
https://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57