mattkirby/puppet-zpr — pull request #4 by mattkirby (2014-12-30 23:29:52+00:00)
Title: Add ssh forced commands to limit zpr_user capabilities

Without this change the zpr_proxy user has the ability to gain
privileges to more than the rsync command with relative ease.
Additionally, all hosts creating the user generate a ssh key, even if
the key is not used. The job run from the worker runs without
strict host key checking, which is not sound practice. An exec is used
to manage volume permissions. Batchmode is not set even though rsync
jobs are to run unattended.

This commit addresses these issues by implementing ssh forced commands
to call a script that checks input and only allows running sudo rsync.
It fails if a user attempts to do anything with sudoers or
authorized_keys, or if commands are chained with ;, & or |. Ssh key
generation for the zpr_proxy now only happens for the source user.
Targets do not need to generate a key. Nostricthostchecking ssh option
is removed from the rsync job, and batchmode yes is added. Sshkey is
added to get the host key and IP from targets which the source user
collects. A file resource is added to replace the exec to chown volume.
Str2bool is placed in front of $::is_pe to guarantee a boolean return
value on all puppet versions.