modules/portforwarder/templates/authorized_keys.erb

   1 ##
   2 ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
   3 ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
   4 ##
   5
   6 <%=
   7
   8 require 'digest/sha1'
   9 def get_local_ip_addr(host)
  10         hash = Digest::SHA1.digest(host)
  11         return '127.101.%d.%d'%[hash[0].ord, hash[1].ord]
  12 end
  13
  14 def getportforwarderkey(host)
  15         key = nil
  16         begin
  17                 facts = YAML.load(File.open("/var/lib/puppet/yaml/facts/#{host}.yaml").read)
  18                 return facts.values['portforwarder_key']
  19         rescue Exception => e
  20         end
  21         return key
  22 end
  23
  24
  25 lines = []
  26 config = YAML.load(File.open('/etc/puppet/modules/portforwarder/misc/config.yaml').read)
  27 config.each_pair do |sourcehost, services|
  28         allowed_ports = []
  29
  30         ##lines << "# sourcehost is #{sourcehost}"
  31         services.each do |service|
  32                 ##lines << "# targethost is #{service['target_host']}, my hostname #{hostname}, fqdn is #{fqdn}"
  33                 next if service['target_host'] != fqdn
  34                 allowed_ports << service['target_port'] if service['target_port']
  35         end
  36
  37         if allowed_ports.length > 0
  38                 sshkey = getportforwarderkey(sourcehost)
  39                 remote_ip = scope.lookupvar('site::allnodeinfo')[sourcehost]['ipHostNumber'].join(',')
  40                 local_bind = get_local_ip_addr(sourcehost)
  41
  42                 lines << "# from #{sourcehost}"
  43                 if sshkey.nil? or remote_ip.nil? or local_bind.nil?
  44                         lines << "# insufficient config values"
  45                 else
  46                         command = "/usr/bin/portforwarder-ssh-wrap #{sourcehost} #{local_bind} #{allowed_ports.join(' ')}"
  47                         lines << "from=\"#{remote_ip}\",command=\"#{command}\",no-pty,no-port-forwarding,no-X11-forwarding,no-agent-forwarding #{sshkey}"
  48                 end
  49         end
  50 end
  51 lines.join("\n")
  52 %>