First stab at restricting ssh by purpose.

I assume this will go horribly, horribly wrong
Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index ba76308..797560b 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -6,7 +6,16 @@
 <%=
 out = []
 
-restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder heininen handel lotti dijkstra luchesi salieri schumann traetta unger rossini draghi jenkins}
+restricted_purposes = {'kvm host', 'central syslog server', 'puppet master', 'jumphost'}
+restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder rossini draghi}
+
+if (nodeinfo['ldap'].has_key?('purpose')) then
+       restricted_purposes.each do |purp|
+               if nodeinfo['ldap']['purpose'].include?(purp) then
+                       restrict_ssh << hostname
+               end
+       end
+end
 
 ssh4allowed = []
 ssh6allowed = []