{"id":15167098,"url":"https://github.com/lkubb/salt-openssh-formula","last_synced_at":"2026-02-07T05:33:08.165Z","repository":{"id":180339558,"uuid":"662534931","full_name":"lkubb/salt-openssh-formula","owner":"lkubb","description":"Manage OpenSSH with Salt. Includes modules to create and use a private SSH CA, very similar to `x509_v2`.","archived":false,"fork":false,"pushed_at":"2024-11-13T23:28:12.000Z","size":176,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-12T02:52:30.247Z","etag":null,"topics":["certificate-authority","certificates","openssh","salt","salt-formula","saltstack","saltstack-formula","ssh"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lkubb.png","metadata":{"files":{"readme":"docs/README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-07-05T10:42:46.000Z","updated_at":"2024-11-13T23:28:16.000Z","dependencies_parsed_at":"2024-02-17T19:30:41.000Z","dependency_job_id":"d5a59757-ac00-4966-8a33-12bf610ab62e","html_url":"https://github.com/lkubb/salt-openssh-formula","commit_stats":null,"previous_names":["lkubb/salt-openssh-formula"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/lkubb/salt-openssh-formula","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkubb%2Fsalt-openssh-formula","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkubb%2Fsalt-openssh-formula/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkubb%2Fsalt-openssh-formula/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkubb%2Fsalt-openssh-formula/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lkubb","download_url":"https://codeload.github.com/lkubb/salt-openssh-formula/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lkubb%2Fsalt-openssh-formula/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29187221,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-07T05:07:31.176Z","status":"ssl_error","status_checked_at":"2026-02-07T05:06:15.227Z","response_time":63,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificate-authority","certificates","openssh","salt","salt-formula","saltstack","saltstack-formula","ssh"],"created_at":"2024-09-27T05:24:37.100Z","updated_at":"2026-02-07T05:33:08.146Z","avatar_url":"https://github.com/lkubb.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":".. _readme:\n\nOpenSSH Formula\n===============\n\n|img_sr| |img_pc|\n\n.. |img_sr| image:: https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg\n   :alt: Semantic Release\n   :scale: 100%\n   :target: https://github.com/semantic-release/semantic-release\n.. |img_pc| image:: https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit\u0026logoColor=white\n   :alt: pre-commit\n   :scale: 100%\n   :target: https://github.com/pre-commit/pre-commit\n\nManage OpenSSH with Salt. Includes modules to create and use a private SSH CA, very similar to ``x509_v2``.\n\n.. contents:: **Table of Contents**\n   :depth: 1\n\nGeneral notes\n-------------\n\nSee the full `SaltStack Formulas installation and usage instructions\n\u003chttps://docs.saltproject.io/en/latest/topics/development/conventions/formulas.html\u003e`_.\n\nIf you are interested in writing or contributing to formulas, please pay attention to the `Writing Formula Section\n\u003chttps://docs.saltproject.io/en/latest/topics/development/conventions/formulas.html#writing-formulas\u003e`_.\n\nIf you want to use this formula, please pay attention to the ``FORMULA`` file and/or ``git tag``,\nwhich contains the currently released version. This formula is versioned according to `Semantic Versioning \u003chttp://semver.org/\u003e`_.\n\nSee `Formula Versioning Section \u003chttps://docs.saltproject.io/en/latest/topics/development/conventions/formulas.html#versioning\u003e`_ for more details.\n\nIf you need (non-default) configuration, please refer to:\n\n- `how to configure the formula with map.jinja \u003cmap.jinja.rst\u003e`_\n- the ``pillar.example`` file\n- the `Special notes`_ section\n\nSpecial notes\n-------------\n* This formula includes custom modules that apply the principle of the official ``x509_v2`` modules to OpenSSH certificates.\n\nConfiguration\n-------------\nAn example pillar is provided, please see `pillar.example`. Note that you do not need to specify everything by pillar. Often, it's much easier and less resource-heavy to use the ``parameters/\u003cgrain\u003e/\u003cvalue\u003e.yaml`` files for non-sensitive settings. The underlying logic is explained in `map.jinja`.\n\n\nAvailable states\n----------------\n\nThe following states are found in this formula:\n\n.. contents::\n   :local:\n\n\n``openssh``\n^^^^^^^^^^^\n*Meta-state*.\n\nThis includes everything from the `openssh.server`_ and\n`openssh.client`_ meta states.\n\n\n``openssh.server``\n^^^^^^^^^^^^^^^^^^\n*Meta-state*.\n\nThis installs the OpenSSH server package,\nmanages its global configuration plus host keys/certificates\nas well as per-user authorized keys and trusted user CA keys.\nWill also manage (start/stop) the service, depending on the value in\n``openssh:server:running``.\n\n\n``openssh.server.authorized_keys``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nManages OpenSSH authorized keys.\nIf ``TrustedUserCAKeys`` has been specified in the server\nconfiguration (``openssh:server:config``), all CA keys from\n``openssh:server:trusted_user_ca_keys`` will be serialized\ninto the corresponding file as well.\nHas a dependency on `openssh.server.package`_.\n\n\n``openssh.server.config``\n^^^^^^^^^^^^^^^^^^^^^^^^^\nManages the OpenSSH service configuration, including\nAuthorizedPrincipalsFile and moduli if ``openssh:server:moduli``\nwas set to true.\nHas a dependency on `openssh.server.package`_.\n\n\n``openssh.server.keys``\n^^^^^^^^^^^^^^^^^^^^^^^\nManages OpenSSH host private/public keys and certificates.\nHas a dependency on `openssh.server.package`_.\n\n\n``openssh.server.package``\n^^^^^^^^^^^^^^^^^^^^^^^^^^\nInstalls the OpenSSH server package only.\n\n\n``openssh.server.service``\n^^^^^^^^^^^^^^^^^^^^^^^^^^\nStarts the OpenSSH service and enables it at boot time.\nHas a dependency on `openssh.server.config`_.\n\n\n``openssh.client``\n^^^^^^^^^^^^^^^^^^\n*Meta-state*.\n\nThis installs the OpenSSH client package,\nmanages its global configuration plus globally\ntrusted host certificate authorities and\nmanages per-user client keys and certificates.\n\n\n``openssh.client.config``\n^^^^^^^^^^^^^^^^^^^^^^^^^\nManages the OpenSSH client configuration.\nHas a dependency on `openssh.client.package`_.\n\n\n``openssh.client.keys``\n^^^^^^^^^^^^^^^^^^^^^^^\nManages OpenSSH user private/public keys and certificates.\nHas a dependency on `openssh.client.package`_.\n\n\n``openssh.client.package``\n^^^^^^^^^^^^^^^^^^^^^^^^^^\nInstalls the OpenSSH client package only.\n\n\n``openssh.client.trusted_cas``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nManages **globally** trusted OpenSSH certificate authorities for host certificates.\nHas a dependency on `openssh.client.package`_.\n\n\n``openssh.clean``\n^^^^^^^^^^^^^^^^^\n*Meta-state*.\n\nUndoes everything performed in the `openssh.server`_ and\n`openssh.client`_ meta states.\n\n\n``openssh.server.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^\n*Meta-state*.\n\nUndoes everything performed in the ``openssh.server`` meta-state\nin reverse order, i.e.\nstops the OpenSSH server,\nremoves host keys and certificates,\nremoves per-user authorized keys,\nremoves trusted client certificate authorities,\nremoves the global OpenSSH server configuration file and then\nuninstalls the package.\n\n\n``openssh.server.authorized_keys.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves managed OpenSSH authorized keys and trusted user CA keys.\n\n\n``openssh.server.config.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves the configuration of the OpenSSH service, including\nAuthorizedPrincipalsFile, and has a dependency on\n`openssh.server.service.clean`_.\nDoes not remove managed moduli.\n\n\n``openssh.server.keys.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves managed OpenSSH host private/public keys and certificates.\nHas a dependency on `openssh.server.service.clean`_.\n\n\n``openssh.server.package.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves the OpenSSH server package.\nHas a dependency on `openssh.server.config.clean`_.\n\n\n``openssh.server.service.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nStops the OpenSSH service and disables it at boot time.\n\n\n``openssh.client.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^\n*Meta-state*.\n\nUndoes everything performed in the ``openssh.client`` meta-state\nin reverse order, i.e.\n**removes per-user client keys** and certificates,\nremoves globally trusted host certificate authorities,\nremoves the global OpenSSH client configuration file and then\nuninstalls the package.\n\n\n``openssh.client.config.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves the configuration of the OpenSSH client.\n\n\n``openssh.client.keys.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves managed OpenSSH user private/public keys and certificates.\n\n\n``openssh.client.package.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves the OpenSSH client package.\nHas a dependency on `openssh.client.config.clean`_.\n\n\n``openssh.client.trusted_cas.clean``\n^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nRemoves globally trusted OpenSSH certificate authorities for host certificates.\n\n\n\nContributing to this repo\n-------------------------\n\nCommit messages\n^^^^^^^^^^^^^^^\n\n**Commit message formatting is significant!**\n\nPlease see `How to contribute \u003chttps://github.com/saltstack-formulas/.github/blob/master/CONTRIBUTING.rst\u003e`_ for more details.\n\npre-commit\n^^^^^^^^^^\n\n`pre-commit \u003chttps://pre-commit.com/\u003e`_ is configured for this formula, which you may optionally use to ease the steps involved in submitting your changes.\nFirst install  the ``pre-commit`` package manager using the appropriate `method \u003chttps://pre-commit.com/#installation\u003e`_, then run ``bin/install-hooks`` and\nnow ``pre-commit`` will run automatically on each ``git commit``. ::\n\n  $ bin/install-hooks\n  pre-commit installed at .git/hooks/pre-commit\n  pre-commit installed at .git/hooks/commit-msg\n\nState documentation\n~~~~~~~~~~~~~~~~~~~\nThere is a script that semi-autodocuments available states: ``bin/slsdoc``.\n\nIf a ``.sls`` file begins with a Jinja comment, it will dump that into the docs. It can be configured differently depending on the formula. See the script source code for details currently.\n\nThis means if you feel a state should be documented, make sure to write a comment explaining it.\n\nReferences\n----------\n* https://infosec.mozilla.org/guidelines/openssh\n* https://stribika.github.io/2015/01/04/secure-secure-shell.html\n* https://ssh-comparison.quendi.de/\n* https://www.linode.com/docs/guides/advanced-ssh-server-security/\n* https://smallstep.com/blog/clever-uses-of-ssh-certificate-templates/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flkubb%2Fsalt-openssh-formula","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flkubb%2Fsalt-openssh-formula","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flkubb%2Fsalt-openssh-formula/lists"}