First stab at restricting ssh by purpose.

I assume this will go horribly, horribly wrong
Signed-off-by: Stephen Gran <steve@lobefin.net>

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index ba76308803c8ce8651ed3af5ce0d1ab37d9d16d0..797560bbf86e60f81bf26161e1cad5d87b006954 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -6,7 +6,16 @@
 <%=
 out = []
 
-restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder heininen handel lotti dijkstra luchesi salieri schumann traetta unger rossini draghi jenkins}
+restricted_purposes = {'kvm host', 'central syslog server', 'puppet master', 'jumphost'}
+restrict_ssh = %w{lebrun logtest01 geo1 geo2 geo3 beethoven tchaikovsky schroeder rossini draghi}
+
+if (nodeinfo['ldap'].has_key?('purpose')) then
+       restricted_purposes.each do |purp|
+               if nodeinfo['ldap']['purpose'].include?(purp) then
+                       restrict_ssh << hostname
+               end
+       end
+end
 
 ssh4allowed = []
 ssh6allowed = []