From d892d0b75a53c834aa87e4fd6e57d8b3d76a10a1 Mon Sep 17 00:00:00 2001 From: Stephen Gran Date: Thu, 22 Dec 2011 10:31:57 +0000 Subject: [PATCH] First stab at restricting ssh by purpose. I assume this will go horribly, horribly wrong Signed-off-by: Stephen Gran --- modules/ferm/templates/me.conf.erb | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb index ba7630880..797560bbf 100644 --- a/modules/ferm/templates/me.conf.erb +++ b/modules/ferm/templates/me.conf.erb @@ -6,7 +6,16 @@ <%= out = [] -restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder heininen handel lotti dijkstra luchesi salieri schumann traetta unger rossini draghi jenkins} +restricted_purposes = {'kvm host', 'central syslog server', 'puppet master', 'jumphost'} +restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder rossini draghi} + +if (nodeinfo['ldap'].has_key?('purpose')) then + restricted_purposes.each do |purp| + if nodeinfo['ldap']['purpose'].include?(purp) then + restrict_ssh << hostname + end + end +end ssh4allowed = [] ssh6allowed = [] -- 2.20.1