Merge branch 'master' into windows-compatibility

Author: saz

.github/workflows/ci.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   puppet:
     name: Puppet

.github/workflows/labeler.yml

@@ -8,6 +8,10 @@ name: "Pull Request Labeler"
 on:
   pull_request_target: {}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   labeler:
     permissions:

.github/workflows/prepare_release.yml

@@ -11,6 +11,10 @@ on:
         description: 'Module version to be released. Must be a valid semver string without leading v. (1.2.3)'
         required: false
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release_prep:
     uses: 'voxpupuli/gha-puppet/.github/workflows/prepare_release.yml@v3'

.github/workflows/release.yml

@@ -10,6 +10,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release

.msync.yml

@@ -2,4 +2,4 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-modulesync_config_version: '9.4.0'
+modulesync_config_version: '10.3.0'

Gemfile

@@ -4,10 +4,8 @@
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
 group :test do
-  gem 'voxpupuli-test', '~> 9.0',   :require => false
-  gem 'coveralls',                  :require => false
-  gem 'simplecov-console',          :require => false
-  gem 'puppet_metadata', '~> 4.0',  :require => false
+  gem 'voxpupuli-test', '~> 13.0',  :require => false
+  gem 'puppet_metadata', '~> 5.0',  :require => false
 end
 
 group :development do
@@ -16,17 +14,15 @@ group :development do
 end
 
 group :system_tests do
-  gem 'voxpupuli-acceptance', '~> 3.0',  :require => false
+  gem 'voxpupuli-acceptance', '~> 4.0',  :require => false
 end
 
 group :release do
-  gem 'voxpupuli-release', '~> 3.0',  :require => false
+  gem 'voxpupuli-release', '~> 5.0',  :require => false
 end
 
 gem 'rake', :require => false
-gem 'facter', ENV['FACTER_GEM_VERSION'], :require => false, :groups => [:test]
 
-puppetversion = ENV['PUPPET_GEM_VERSION'] || [">= 7.24", "< 9"]
-gem 'puppet', puppetversion, :require => false, :groups => [:test]
+gem 'openvox', ENV.fetch('OPENVOX_GEM_VERSION', [">= 7", "< 9"]), :require => false, :groups => [:test]
 
 # vim: syntax=ruby

REFERENCE.md

@@ -555,6 +555,7 @@ The following parameters are available in the `ssh::server` class:
 * [`sshd_config_mode`](#-ssh--server--sshd_config_mode)
 * [`host_priv_key_user`](#-ssh--server--host_priv_key_user)
 * [`host_priv_key_group`](#-ssh--server--host_priv_key_group)
+* [`host_priv_key_mode`](#-ssh--server--host_priv_key_mode)
 * [`config_user`](#-ssh--server--config_user)
 * [`config_group`](#-ssh--server--config_group)
 * [`manage_config_permissions`](#-ssh--server--manage_config_permissions)
@@ -634,6 +635,12 @@ Data type: `Boolean`
 
 Whether to manage user and group ownership for the sshd config file
 
+##### <a name="-ssh--server--host_priv_key_mode"></a>`host_priv_key_mode`
+
+Data type: `Stdlib::Filemode`
+
+Mode of the private host key
+
 ##### <a name="-ssh--server--default_options"></a>`default_options`
 
 Data type: `Hash`

Rakefile

@@ -1,30 +1,22 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-# Attempt to load voxpupuli-test (which pulls in puppetlabs_spec_helper),
-# otherwise attempt to load it directly.
 begin
   require 'voxpupuli/test/rake'
 rescue LoadError
-  begin
-    require 'puppetlabs_spec_helper/rake_tasks'
-  rescue LoadError
-  end
+  # only available if gem group test is installed
 end
 
-# load optional tasks for acceptance
-# only available if gem group releases is installed
 begin
   require 'voxpupuli/acceptance/rake'
 rescue LoadError
+  # only available if gem group acceptance is installed
 end
 
-# load optional tasks for releases
-# only available if gem group releases is installed
 begin
   require 'voxpupuli/release/rake_tasks'
 rescue LoadError
-  # voxpupuli-release not present
+  # only available if gem group releases is installed
 else
   GCGConfig.user = 'saz'
   GCGConfig.project = 'puppet-ssh'

data/AIX.yaml

@@ -3,8 +3,7 @@ ssh::server::sshd_dir: '/etc/ssh'
 ssh::server::sshd_binary: '/usr/sbin/sshd'
 ssh::server::sshd_config: '/etc/ssh/sshd_config'
 ssh::server::sshd_config_mode: '0644'
-ssh::server::ssh_config: '/etc/ssh/ssh_config'
-ssh::server::ssh_known_hosts: '/etc/ssh/ssh_known_hosts'
+ssh::client::ssh_config: '/etc/ssh/ssh_config'
 ssh::server::service_name: 'sshd'
 ssh::sftp_server_path: '/usr/sbin/sftp-server'
 ssh::server::host_priv_key_group: 0

data/common.yaml

@@ -28,6 +28,7 @@ ssh::server::config_user: 0
 ssh::server::config_group: 0
 ssh::server::host_priv_key_user: 0
 ssh::server::host_priv_key_group: 0
+ssh::server::host_priv_key_mode: '0600'
 ssh::validate_sshd_file             : false
 ssh::collect_enabled                : true   # Collect sshkey resources
 ssh::server::issue_net              : '/etc/issue.net'