Otdfbt

I look for a solution to create the ssh host keys for my puppet clients on the puppetmaster.
I did some research and found http://jsosic.wordpress.com/2012/12/04/managing-ssh-host-keys-with-puppet/, but I couldn't get it working. Is there a more elegant solution to handle that or a full example of that?

I know it's possible to generate the host keys on the clients and back them up to the puppetmaster, but I'd really prefer to generate them directly on the master.

Edit:

I created a module 'ssh'.

The content of init.pp is:

class ssh::server 
 if generate('/etc/puppet/modules/ssh/scripts/generate_host_keys.sh',
$keys_dir) 
 include ssh::server::keys
 


class ssh::server::keys 
 file '/etc/ssh/ssh_host_rsa_key.pub':
 ensure => file,
 owner => root,
 group => root,
 mode => '0644',
 source => [
 'puppet:///private/ssh/ssh_host_rsa_key.pub',
 'puppet:///modules/ssh/ssh_host_rsa_key.pub',
 ],
 require => Package['openssh-server'],
 notify => Service[$service_name],
 

The content of the generate_host_keys.sh is the following:

#!/bin/bash

# check arg0: dir for keys
[ -z "$1" ] && echo "Please specify directory for key generation" && exit 1
KEYSDIR="$1"

# set umask
umask 0022

# create directory tree if it does not exist
[ ! -d "$KEYSDIR" ] && mkdir -p $KEYSDIR

#
# functions stolen from CentOS 6 sshd init script
#

# Some functions to make the below more readable
KEYGEN=/usr/bin/ssh-keygen
RSA1_KEY=$1/ssh_host_key
RSA_KEY=$1/ssh_host_rsa_key
DSA_KEY=$1/ssh_host_dsa_key

# source function library
. /etc/rc.d/init.d/functions

fips_enabled() 
 if [ -r /proc/sys/crypto/fips_enabled ]; then
 cat /proc/sys/crypto/fips_enabled
 else 
 echo 0
 fi


do_rsa1_keygen() 
 if [ ! -s $RSA1_KEY -a `fips_enabled` -eq 0 ]; then
 echo -n $"Generating SSH1 RSA host key: "
 rm -f $RSA1_KEY
 if test ! -f $RSA1_KEY && $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
 chmod 600 $RSA1_KEY
 chmod 644 $RSA1_KEY.pub
 success $"RSA1 key generation"
 echo
 else 
 failure $"RSA1 key generation"
 echo
 exit 1
 fi
 fi


do_rsa_keygen() 
 if [ ! -s $RSA_KEY ]; then
 echo -n $"Generating SSH2 RSA host key: "
 rm -f $RSA_KEY
 if test ! -f $RSA_KEY && $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
 chmod 600 $RSA_KEY
 chmod 644 $RSA_KEY.pub
 success $"RSA key generation"
 echo
 else 
 failure $"RSA key generation"
 echo
 exit 1
 fi
 fi


do_dsa_keygen() 
 if [ ! -s $DSA_KEY ]; then
 echo -n $"Generating SSH2 DSA host key: "
 rm -f $DSA_KEY
 if test ! -f $DSA_KEY && $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
 chmod 600 $DSA_KEY
 chmod 644 $DSA_KEY.pub
 success $"DSA key generation"
 echo
 else
 failure $"DSA key generation"
 echo
 exit 1
 fi
 fi


# main
do_rsa1_keygen
do_rsa_keygen
do_dsa_keygen
chmod -R 644 $KEYSDIR/*
exit 0

manifests/site.pp looks like that

node 'mynode':
 include ssh::server

Running puppet agent --test on the client produce the following output:

Info: Retrieving plugin
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to execute generator /etc/puppet/modules/ssh/scripts/generate_host_keys.sh: Execution of '/etc/puppet/modules/ssh/scripts/generate_host_keys.sh ' returned 1: at /etc/puppet/modules/ssh/manifests/init.pp:2 on node nodename
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

Thanks,

Paul

1. Try to add /usr/bin/env as the first parameter of the generate function:
   if generate('/usr/bin/env','/etc/puppet/modules/ssh/scripts/generate_host_keys.sh', $keys_dir) {




2. Verify that your script returns 0 on exit, non-zero return code will make the parser throw an Error 400