From: Stephen Gran <steve@lobefin.net>
Date: Thu, 22 Dec 2011 10:31:57 +0000 (+0000)
Subject: First stab at restricting ssh by purpose.
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=d892d0b75a53c834aa87e4fd6e57d8b3d76a10a1;p=mirror%2Fdsa-puppet.git

First stab at restricting ssh by purpose.

I assume this will go horribly, horribly wrong
Signed-off-by: Stephen Gran <steve@lobefin.net>
---

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index ba7630880..797560bbf 100644
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -6,7 +6,16 @@
 <%=
 out = []
 
-restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder heininen handel lotti dijkstra luchesi salieri schumann traetta unger rossini draghi jenkins}
+restricted_purposes = {'kvm host', 'central syslog server', 'puppet master', 'jumphost'}
+restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder rossini draghi}
+
+if (nodeinfo['ldap'].has_key?('purpose')) then
+	restricted_purposes.each do |purp|
+		if nodeinfo['ldap']['purpose'].include?(purp) then
+			restrict_ssh << hostname
+		end
+	end
+end
 
 ssh4allowed = []
 ssh6allowed = []