#760 - Make our ssh configuration used automatically for all servers

modules/filtermaster/manifests/init.pp

 class filtermaster {
   Cron {
     environment => ['MAILTO=admins@adblockplus.org', 'PYTHONPATH=/opt/sitescripts'],
   }
 
   concat::fragment {'sshd_max_limits':
     target => 'sshd_config',
-    order => '02',

[Wladimir Palant, 2014/07/15 11:56:47]

This doesn't need to be sequential, '50' maybe?

+    order => '50',
     content => '
       MaxSessions 50
       MaxStartups 50
     '
   }
 
   concat::fragment {'sshd_user_rsync':
     target => 'sshd_config',
+    order => '99',
     content => '

[Wladimir Palant, 2014/07/15 11:56:47]

order => '99'?

[mathias, 2014/07/15 12:03:12]

Either the non-block settings (see your comment above) or block settings should
become sequential. I dislike to do that for both types. Which do you prefer? (I
prefer the former option.)

[Wladimir Palant, 2014/07/15 14:18:35]

I don't really understand your comment. My understanding of sshd_config is that
ordering matters - Match blocks always have to be placed at the end of the file.
It might be that omitting the order parameter will also place the fragment at
the end but the documentation doesn't really say what will happen in that
scenario so I would consider the behavior as undefined. Hence my suggestion to
always use '99' for blocks.

Using '50' instead of '02' was meant simply in case we need to add more
fragments to the generic part. We can have as convention that anything below
'50' is generic whereas '50' and above marks custom configuration.

       Match User rsync
         AllowTcpForwarding no
         X11Forwarding no
         AllowAgentForwarding no
         GatewayPorts no
         ForceCommand rsync --server --sender -vltprz --delete-excluded . /home/rsync/generated/data/
     '
   }
 
   user {'rsync':
@@ skipping 106 matching lines @@
       User['rsync'],
       File['/home/rsync/update_repos.sh']
     ],
     minute  => '8-58/10'
   }
 
   class {'sitescripts':
     sitescriptsini_source => 'puppet:///modules/filtermaster/sitescripts'
   }
 }