CDIST-TYPE__SSH_AUTHORIZED_KEYS(7)

📦
version 7.0.0 · 8 versions
, in fedora 43, fedora 44

💖 CDIST-TYPE__SSH_AUTHORIZED_KEYS(7) 💖

okay so bestie, welcome to cdist-type__ssh_authorized_keys, part of the cdist fam, version 7.0.0. this is the page for the type that manages ssh authorized_keys files. yes, THE files. the ones that decide who gets in. very main character, honestly. 🗝️✨

🌸 NAME 🌸

cdist-type__ssh_authorized_keys — manages ssh authorized_keys files

no cap, that's literally it. it's giving gatekeeper (affectionate). 🚪👑

✨ DESCRIPTION ✨

So what it does: it adds or removes ssh keys from an authorized_keys file. that's the whole gig. adding keys = letting people in. removing keys = bye bestie 💅

Here's the tea about the plumbing tho:

  • This type uses the __ssh_dot_ssh type to manage the directory that holds the authorized_keys file. cute, right? it's reusing its friend's work. you can disable that feature with the --noparent boolean parameter if you wanna do it yourself.
  • The existence, ownership and permissions of the authorized_keys file itself are also managed. very thorough. very organized. we love a type that handles its own business. 🎀
  • You can turn that off with the --nofile boolean parameter. but then — and I need you to hear me — it's left to the user to make sure the file exists and that ownership and permissions actually work with ssh. that's on you. not us. good luck babe 🫶

🔑 REQUIRED MULTIPLE PARAMETERS 🔑

okay so this one is required AND you can give it multiple times. double threat. iconic.

  • key — an ssh key which shall be managed in this authorized_keys file. Must be a string containing the ssh keytype, base 64 encoded key and optional trailing comment which shall be added to the given authorized_keys file. Can be specified multiple times. fr fr, one --key per key, stack 'em up 🧚

🎀 OPTIONAL PARAMETERS 🎀

the optional girlies. use them or don't, no pressure (there is a little pressure).

  • comment — use this comment instead of the one which may be trailing in each key. so if your key's built-in comment is ugly, override it. glow-up achieved ✨
  • file — an alternative destination file. defaults to ~$owner/.ssh/authorized_keys. you wanna put it somewhere weird? go off. 💅
  • option — an option to set for all authorized_key entries in the key parameter. Can be specified multiple times. See sshd(8) for available options. (yes, ALL the keys. it's a package deal.) 📦
  • owner — the user owning the authorized_keys file. defaults to object_id.
  • state — if the given keys should be 'present' or 'absent'. defaults to 'present'. present = keep them, absent = ghost them 👻

💀 BOOLEAN PARAMETERS 💀

flip them on, flip them off. binary babes.

  • noparent — don't create or change ownership and permissions of the directory containing the authorized_keys file. hands off the folder, basically 🙈
  • nofile — don't manage existence, ownership and permissions of the the authorized_keys file. (yes, the original says "the the". keeping it. it's part of the lore. 😭)
  • remove-unknown — remove undefined keys. this is the clean slate button. if it's not in your config, it's gone. ruthless. obsessed. 🔥
⚠️ careful with --remove-unknown bestie, it removes undefined keys — anything you didn't explicitly declare gets deleted from the file. not a vibe check, it's a vibe yeet.

🌈 EXAMPLES 🌈

okay this is the fun part. real commands, real energy, copied exactly because we do NOT paraphrase commands in this house. 💯

# add your ssh key to remote root's authorized_keys file
__ssh_authorized_keys root \
   --key "$(cat ~/.ssh/id_rsa.pub)"
# same as above, but make sure your key is only key in
# root's authorized_keys file
__ssh_authorized_keys root \
   --key "$(cat ~/.ssh/id_rsa.pub)" \
   --remove-unknown
# allow key to login as user-name
__ssh_authorized_keys user-name \
   --key "ssh-rsa AXYZAAB3NzaC1yc2..."
# allow key to login as user-name with options and expicit comment
__ssh_authorized_keys user-name \
   --key "ssh-rsa AXYZAAB3NzaC1yc2..." \
   --option no-agent-forwarding \
   --option 'from="*.example.com"' \
   --comment 'backup server'
# same as above, but with explicit owner and two keys
# note that the options are set for all given keys
__ssh_authorized_keys some-fancy-id \
   --owner user-name \
   --key "ssh-rsa AXYZAAB3NzaC1yc2..." \
   --key "ssh-rsa AZXYAAB3NzaC1yc2..." \
   --option no-agent-forwarding \
   --option 'from="*.example.com"' \
   --comment 'backup server'
# authorized_keys file in non standard location
__ssh_authorized_keys some-fancy-id \
   --file /etc/ssh/keys/user-name/authorized_keys \
   --owner user-name \
   --key "ssh-rsa AXYZAAB3NzaC1yc2..."
# same as above, but directory and authorized_keys file is created elswhere
__ssh_authorized_keys some-fancy-id \
   --file /etc/ssh/keys/user-name/authorized_keys \
   --owner user-name \
   --noparent \
   --nofile \
   --key "ssh-rsa AXYZAAB3NzaC1yc2..."

like. the last two? one manages everything for you, the other says "I got it from here." character development 🦋

👀 SEE ALSO 👀

go read it if you want the full lore on option. iykyk. 📖

👑 AUTHORS 👑

  • Steven Armstrong <steven-cdist--@--armstrong.cc>

thank you steven, king behavior 🫡

📜 COPYING 📜

Copyright (C) 2012-2014 Steven Armstrong. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

(that's the legal bit, keep it, love it, don't lose it 💜)

ungleich GmbH 2021

and that's the whole page bestie!! this one's from cdist 7.0.0, dated Jul 31 — signed, sealed, and absolutely slaying. go forth and manage those authorized_keys files. mwah 💋 🎀✨🦋

📦 where this page comes from