ssh_auth
The ssh_auth.* family of state modules.
| Module | Summary |
|---|---|
ssh_auth.absent | Ensure an SSH public key is absent from a user's authorized_keys. |
ssh_auth.present | Ensure an SSH public key is present in a user's authorized_keys. |
All states also accept the full set of requisite parameters and Salt-parity state attributes — see Dependencies & Requisites.
Family Parameters
These parameters are declared once by the family's shared parameter components — every member that exposes one accepts the identical contract.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
user | string | No | (none) | account whose authorized_keys is managed; user or config is required |
config | string | No | (none) | explicit authorized_keys path; user or config is required (config takes precedence over the user's home) |
ssh_auth.absent
Ensure an SSH public key is absent from a user's authorized_keys.
Source: pkg/state/modules/ssh_auth/ssh_auth_absent.go
ssh_auth.absent ensures an SSH public key line is NOT present in a user's authorized_keys. The key is given as name (defaulting to the state ID) and matched on its BLOB (the base64 body), so a bare blob or a full key line both identify the same authorized line. The managed file is resolved from config when set or the user's home directory — one of user or config is required.
Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
name | string | No | State ID | public key blob (or full key line) to remove; matched on the blob; defaults to the state ID |
ssh_auth.absent also accepts the family parameters user, config — see Family Parameters.
Effects
Check
Resolves the authorized_keys path (from config, or the user's home) and reads it (a non-not-exist read error fails the phase). Reports no change when the file does not exist or no line carries the key blob; otherwise reports a change.
Apply
Reads authorized_keys and, when a line carries the key blob, memoizes the prior content for revert and rewrites the file with every matching line removed. A missing file or an already-absent key is a clean no-op. Reports the path and user in its details.
Revert
Restores the authorized_keys content this run's Apply captured before removing the key (with 0600 mode). A fresh instance (a standalone revert) recorded nothing and is an explicit clean no-op — it never rewrites a user's authorized_keys it did not touch.
Examples
Revoke a key for a user
name is the key blob to remove; matched on the blob.
AAAAB3NzaC1yc2EAAAADAQABAAAB...:
ssh_auth.absent:
- user: deployRevoke a key ad hoc
The bare positional argument is the key blob; user is a key=value.
zester 'web*' ssh_auth.absent AAAAB3Nza... user=deploySee Also
ssh_auth.present
Ensure an SSH public key is present in a user's authorized_keys.
Source: pkg/state/modules/ssh_auth/ssh_auth_present.go
ssh_auth.present ensures an SSH public key line is present in a user's authorized_keys, creating ~/.ssh (0700) and authorized_keys (0600) as needed. The key is given as name (defaulting to the state ID): a bare base64 blob is combined with enc (default ssh-rsa) and an optional comment, while a full "ssh-… AAAA… comment" line is used verbatim. Idempotency keys on the key BLOB, so re-running with a changed comment or encoding replaces the matching line rather than duplicating it. The managed file is the target user's authorized_keys, resolved from config when set or the account's home directory otherwise — one of user or config is required.
Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
name | string | No | State ID | public key blob (the base64 body) or a full key line; defaults to the state ID |
enc | string | No | ssh-rsa | key encoding/type (ssh-rsa, ssh-ed25519, …); defaults to ssh-rsa; ignored when name is a full key line |
comment | string | No | (none) | optional trailing comment on the key line |
ssh_auth.present also accepts the family parameters user, config — see Family Parameters.
Effects
Check
Resolves the authorized_keys path (from config, or the user's home) and reads it (a non-not-exist read error fails the phase). Reports a change when no line carries the desired key blob, or when the matching line differs from the desired line (a changed comment or encoding).
Apply
Ensures ~/.ssh exists (0700), reads authorized_keys, memoizes its prior content (or that it did not exist) for revert, and rewrites it so a single line carries the key blob — replacing any existing line for the same blob and deduplicating, or writing the file (0600) when absent. An already-present identical line is a clean no-op. Reports the path and user in its details.
Revert
Restores what this run's Apply changed: an authorized_keys that pre-existed is rewritten with its captured prior content and 0600 mode; a file this instance created is removed. A fresh instance (a standalone revert) recorded nothing and is an explicit clean no-op — it never rewrites a user's authorized_keys it did not touch.
Examples
Authorize a key for a user
name is the key blob; enc defaults to ssh-rsa; comment labels the line.
AAAAB3NzaC1yc2EAAAADAQABAAAB...:
ssh_auth.present:
- user: deploy
- comment: deploy@ciAuthorize a full ed25519 key line
A full "ssh-… AAAA… comment" line is used verbatim; enc/comment are ignored.
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... alice@laptop:
ssh_auth.present:
- user: aliceAuthorize a key ad hoc
The bare positional argument is the key blob; user/enc/comment are key=values.
zester 'web*' ssh_auth.present AAAAB3Nza... user=deploy enc=ssh-rsa