Search code examples
sshchef-infraopenssh

In Chef how do I limit SSH to only approved IPs?

I am getting the below error.

I am trying to prevent brute-force attempts. I created an OpenVPN account and now I have a static IP address. That I will switch to when ready to SSH. However I am unsure how to set this correctly in Chef.

FATAL: Chef::Exceptions::ResourceNotFound: resource cookbook_file[/etc/ssh/sshd_config] is configured to notify resource service[openssh-server, openssh-client] with action restart, but service[openssh-server, openssh-client] cannot be found in the resource collection. cookbook_file[/etc/ssh/sshd_config] is defined in /var/chef/cache/cookbooks/sshd/recipes/default.rb:23:in `from_file'

Recipe

apt_package 'openssh-server' do
  action :upgrade
end

service 'openssh-server' do
  action :enable
end

apt_package 'openssh-client' do
  action :upgrade
end

service 'openssh-client' do
  action :enable
end

cookbook_file '/etc/ssh/sshd_config' do
  source 'sshd_config'
  action :create
  notifies :restart, 'service[openssh-server, openssh-client]', :immediately
end

sshd_config file

Include /etc/ssh/ssh_config.d/*.conf

Host *
    SendEnv LANG LC_*
    HashKnownHosts yes
    GSSAPIAuthentication yes

ListenAddress XXX.XXX.XXX.XX
Solution

  • You are trying to notify two resources for two different services in the same line. That's what the error is about. So, its looking for service 'openssh-server, openssh-client' do, and cannot find it.

    The correct way to notify multiple resources is to put each in its own line. Like below:

    service 'openssh-server' do
  action :enable
end

service 'openssh-client' do
  action :enable
end

cookbook_file '/etc/ssh/sshd_config' do
  source 'sshd_config'
  action :create
  notifies :restart, 'service[openssh-server]', :immediately
  notifies :restart, 'service[openssh-client]', :immediately
end