Resource Type: ssh_authorized_key

Defined in:
core_modules/sshkeys_core/lib/puppet/type/ssh_authorized_key.rb
Providers:
parsed

Summary

Manages SSH authorized keys. Currently only type 2 keys are supported.

Overview

In their native habitat, SSH keys usually appear as a single long line, in the format `<TYPE> <KEY> <NAME/COMMENT>`. This resource type requires you to split that line into several attributes.

To ensure that only the currently approved keys are present, you can purge unmanaged SSH keys on a per-user basis.

This will remove any keys in `~/.ssh/authorized_keys` that aren't being managed with `ssh_authorized_key` resources. See the documentation of the `user` type for more details.

*Autorequires:* If Puppet is managing the user account in which this SSH key should be installed, the `ssh_authorized_key` resource will autorequire that user.

Examples:

Thus, a key that appears in your `~/.ssh/id_rsa.pub` file like this…


ssh-rsa AAAAB3Nza[...]qXfdaQ== nick@magpie.example.com

…would translate to the following resource:


ssh_authorized_key { 'nick@magpie.example.com':
  ensure => present,
  user   => 'nick',
  type   => 'ssh-rsa',
  key    => 'AAAAB3Nza[...]qXfdaQ==',
}

Do this with the `user` resource type's `purge_ssh_keys` attribute:


user { 'nick':
  ensure         => present,
  purge_ssh_keys => true,
}

Properties

  • ensure (defaults to: present)

    The basic property that the resource should be in.

    Supported values:
    • present
    • absent
  • key

    The public key itself; generally a long string of hex characters. The `key` attribute may not contain whitespace.

    Make sure to omit the following in this attribute (and specify them in other attributes):

    • Key headers, such as 'ssh-rsa' — put these in the `type` attribute.

    • Key identifiers / comments, such as 'joe@joescomputer.local' — put these in the `name` attribute/resource title.

  • options

    Key options; see sshd(8) for possible values. Multiple values should be specified as an array. For example, you could use the following to install a SSH CA that allows someone with the 'superuser' principal to log in as root

    ssh_authorized_key { 'Company SSH CA':
  ensure  => present,
  user    => 'root',
  type    => 'ssh-ed25519',
  key     => 'AAAAC3NzaC[...]CeA5kG',
  options => [ 'cert-authority', 'principals=\"superuser\"' ],
}
  • target (defaults to: absent)

    The absolute filename in which to store the SSH key. This property is optional and should be used only in cases where keys are stored in a non-standard location, for instance when not in `~user/.ssh/authorized_keys`. The parent directory must be present if the target is in a privileged path.

  • type

    The encryption type used.

    Supported values:
    • ssh-dss
    • ssh-rsa
    • ecdsa-sha2-nistp256
    • ecdsa-sha2-nistp384
    • ecdsa-sha2-nistp521
    • ssh-ed25519
    • sk-ecdsa-sha2-nistp256@openssh.com
    • sk-ssh-ed25519@openssh.com
    • ssh-rsa-cert-v01@openssh.com
    • ssh-ed25519-cert-v01@openssh.com
    • ssh-dss-cert-v01@openssh.com
    • ecdsa-sha2-nistp256-cert-v01@openssh.com
    • ecdsa-sha2-nistp384-cert-v01@openssh.com
    • ecdsa-sha2-nistp521-cert-v01@openssh.com
    • dsa (alias for: ssh-dss)
    • ed25519 (alias for: ssh-ed25519)
    • rsa (alias for: ssh-rsa)
    • ecdsa-sk (alias for: sk-ecdsa-sha2-nistp256@openssh.com)
    • ed25519-sk (alias for: sk-ssh-ed25519@openssh.com)
  • user

    The user account in which the SSH key should be installed. The resource will autorequire this user if it is being managed as a `user` resource.

Parameters

  • drop_privileges (defaults to: true)

    Whether to drop privileges when writing the key file. This is useful for creating files in paths not writable by the target user. Note the possible security implications of managing file ownership and permissions as a privileged user.

    Supported values:
    • true
    • false
    • yes
    • no
  • name (namevar)

    The SSH key comment. This can be anything, and doesn't need to match the original comment from the `.pub` file.

    Due to internal limitations, this must be unique across all user accounts; if you want to specify one key for multiple users, you must use a different comment for each instance.

  • provider

    The specific backend to use for this `ssh_authorized_key` resource. You will seldom need to specify this — Puppet will usually discover the appropriate provider for your platform.