salt/doc/man/salt-ssh.1
Daniel Wozniak d9343cca65
Merge forward 3004.2 (#62200)
* Check only ssh-rsa encyption for set_known_host

* Windows test fix

* Fix pre-commit

* add CentOS Stream to _OS_FAMILY_MAP, fix #59161

* added changelog and test

* fix syntax

* Use centosstream 8 for testing

* Use ? for matching spaces

Technically this isn't *quite* right as 'CentOSyStream' would also
match, but it's pretty reasonable:

- OS grains shouldn't ever be that kind of close
- This test is only swapping out spaces, and only for the os grain. That
  would mean there would have to be two OSes with grains that only
  differ by one having a space where another one has any other
  character.
- This test really isn't even about matching grains, we're just using
  compound matching and that's a reasonable one to use.

* Add centos stream when detecting package manager name

* Fix pre-commit

* Remove tests for fedora 32/33 EOL

* Remove tests for fedora 32/33 EOL

* Remove tests for fedora 33 EOL

* Use centosstream 8 for testing

* Use ? for matching spaces

Technically this isn't *quite* right as 'CentOSyStream' would also
match, but it's pretty reasonable:

- OS grains shouldn't ever be that kind of close
- This test is only swapping out spaces, and only for the os grain. That
  would mean there would have to be two OSes with grains that only
  differ by one having a space where another one has any other
  character.
- This test really isn't even about matching grains, we're just using
  compound matching and that's a reasonable one to use.

* 3002.9: Fix pre-commit

* 3003.5 Fix pre-commit

* [3002.9] Replace use of 'sl' with 'paper' for Arch tests, due to 'sl' having key issues

* Remove mojave testing

* Remove mojave and high sierra testing

* Remove mojave testing

* [3002.9] Fix cloud vultr size issue

* Update package name to aspnetcore-runtime-6.0 for redhat 8 pkg tests

* Update package name to aspnetcore-runtime-6.0 for redhat 8 pkg tests

* change amazon linux AMI

* Migrate `unit.modules.test_gpg` to PyTest

* Don't leave any `gpg-agent`'s running behind

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Start a background process to generate entropy.

Some tests have failed because of not enough entropy which then makes
the test timeout.

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* A different approach at generating entropy

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Turn entropy generation into a helper

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* change amazon linux AMI

* change amazon linux AMI

* [3004.2] Fix cloud vultr size issue

* Fix cloud requirements

* Skip pam tests on windows

* Update ami to try to get the tests running

* Update amis to try to get the tests running

* Fixing test_publish_to_pubserv_ipc_tcp, moving the call to socket.socket into the while loop.

* Add static requirements for 3.8 and 3.9 on Windows

* Fix requirements

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* The whole CI process is already slower than GH Actions, no caches.

* Pre-commit must not run with ``PIP_EXTRA_INDEX_URL`` set.

* Lint fixes

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Compile cloud requirements

* Run add requirements files for 3.8 and 3.9

* Fix docs and cloud requirements

* [3003.5] Fix cloud vultr size issue

* Windows test fix

* Skip test if docker not running

* [3003.5] Fix pre-commit

* Update Markup and contextfunction imports for jinja versions >=3.1.

* update bootstrap to 2022.03.15

* update bootstrap to 2022.03.15

* skipping tests/pytests/integration/modules/test_virt.py on 3002.x and 3003.x branches.

* Windows test fix

* Skip PAM tests on Windows

Windows has no ctypes with the PAM bits, so we should go ahead and skip
on Windows.

* Skip PAM auth tests on Windows

Windows lacks the correct bits, so...

* Fix pre-commit

* Skipping tests since they're also skipped on the master branch

Fixes #403

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Skip test that only runs because the patch binary is now available.

The feature though, was only added in 3004.

Fixes #404

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Skip test which is only supposed to run in Linux

Fixes https://github.com/saltstack/salt-priv/issues/405

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* GPG tests do not work on windows yet

* Fix tests

* Fix pre-commit

* skip tests.integration.modules.test_mac_brew_pkg.BrewModuleTest.test_list_upgrades and tests.integration.modules.test_state.StateModuleTest.test_get_file_from_env_in_top_match on Mac OS.

* skip tests.integration.modules.test_mac_brew_pkg.BrewModuleTest.test_list_upgrades and tests.integration.modules.test_state.StateModuleTest.test_get_file_from_env_in_top_match on Mac OS.

* Removing skip, moving it to different PR.

* Skipping tests on 3002.9.

* test fix

* Do not run patch tests on 3003.5. Feature not added till 3004

* skipping tests/pytests/integration/modules/test_virt.py on 3002.x and 3003.x branches.

* Fix pre-commit

* [3004.2] Update freebsd ami

* Bump the git version for freebsd CI tests

* removing versions that are no longer available from the tests.pytests.scenarios.compat.test_with_versions tests.

* Skip tests on windows when NOT using static requirements

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* removing versions that are no longer available from the tests.pytests.scenarios.compat.test_with_versions tests.

* test_issue_36469_tcp causes a fatal python error when run on Mac OS, so skipping.

* Fix tests

* Fix pre-commit

* Do not run patch tests on 3003.5. Feature not added till 3004

* Skip archive tar tests on windows

* [3002.9] Skip archive tar tests on windows

* GPG tests do not work on windows yet

* Skip test which is only supposed to run in Linux

Fixes https://github.com/saltstack/salt-priv/issues/405

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Skip test that only runs because the patch binary is now available.

The feature though, was only added in 3004.

Fixes #404

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Skipping tests since they're also skipped on the master branch

Fixes #403

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Fix pre-commit

* Fix pre-commit

* Fix pre-commit

* Fix pre-commit

* retry sdb.get if it returns None

None is an entirely valid return - see EtcdClient.get in
salt/utils/etcd_util.py

* drop py2/six

* fix etcd sdb.set as well

* Fix etdcd-sdb test failure

If docker container is up and running, but etcd isn't responding yet
it's possible that we get some failing tests. This should wait a
reasonable amount of time for things to come up. Or just skip the test.

* Fix etdcd-sdb test failure

If docker container is up and running, but etcd isn't responding yet
it's possible that we get some failing tests. This should wait a
reasonable amount of time for things to come up. Or just skip the test.

* Skip the tests from unit/transport/test_zero.py that are hanging on Mac.

* skip tests in tests/pytests/unit/states/test_archive.py for 3002.9

* 3002.9 Skipping  CA permissions tests on Windows, similar to 3003.5 and 3004.2

* change skipif to skip

* Rollback Windows AMIs to use Python 3.7

* Rollback AMI's to Python 3.7... fix tests

* Fix failing test_archive tests

* Build using pyenv

* Add symlinks to openssl and rpath

* Add shasum for zeromq 4.3.4

* Fix docs on scripts

* Build zeromq earlier, fix symlinks

* Bring 61446 to 3004.1 branch

* Add changelog and tests

* Fix schedule test flakiness

* Retry with new port if in use

* fixing failing tests, ensuring that the correct path is used.

* fixing failing tests, ensuring that the correct path is used.

* fixing failing tests, ensuring that the correct path is used.

* Re-enable tiamat-pip on windows

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

* Bump duration time for windwos for test_retry_option_success

* Skip test cauing hangs

* go go pylint disable

* more pre-commit

* oh lint

* so many weird hook failures

* Add unit tests for PAM auth CVE

We could add functional tests if it's important enough, but this is the
narrowest place to test.

* Fix PAM auth CVE

Credit to @ysf

Previously we weren't checking the result of PAM_ACCT_MGMT.

* pylint disable

* rewrite hook changes

* Skip PAM auth tests on Windows

Since Windows ends out lacking the correct bits, no need to run tests
there.

* pre-commit fixes

* docs 3004.2 release

* Fix bug in tcp transport

* Fix the test_zeromq_filtering test

* skip test_npm_install_url_referenced_package on centos 7 and 8.

* Swapping CentOS Linux-8 for CentOS Stream-8

* Update build scripts to use pyenv

* Fix tests on MacOS

* Fix bug in tcp transport

* Fix test failures

* Update release notes and man pages for 3003.5

* Add 3002.9 changelog, release notes, man pages

* Update doc/topics/releases/3002.9.rst

Co-authored-by: Megan Wilhite <mwilhite@vmware.com>

* Fix requirements

* Fix imports

* Test fixup

* Fix merge warts

* fix merge wart in changelog

* Fix merge warts in tests

Co-authored-by: krionbsd <krion@FreeBSD.org>
Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>
Co-authored-by: Alexander Kriventsov <akriventsov@nic.ru>
Co-authored-by: Megan Wilhite <mwilhite@vmware.com>
Co-authored-by: Wayne Werner <wwerner@vmware.com>
Co-authored-by: Gareth J. Greenaway <gareth@saltstack.com>
Co-authored-by: David Murphy < dmurphy@saltstack.com>
Co-authored-by: Twangboy <leesh@vmware.com>
Co-authored-by: MKLeb <calebb@vmware.com>
Co-authored-by: Pedro Algarvio <pedro@algarvio.me>
Co-authored-by: Pedro Algarvio <palgarvio@vmware.com>
Co-authored-by: Thomas Phipps <tphipps@vmware.com>
Co-authored-by: Frode Gundersen <frogunder@gmail.com>
Co-authored-by: Alyssa Rock <alyssa.rock@gmail.com>
Co-authored-by: Alyssa Rock <43180546+barbaricyawps@users.noreply.github.com>
2022-06-29 10:10:06 -06:00

368 lines
9.5 KiB
Groff

.\" Man page generated from reStructuredText.
.
.TH "SALT-SSH" "1" "May 12, 2022" "3004.2" "Salt"
.SH NAME
salt-ssh \- salt-ssh Documentation
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.SH SYNOPSIS
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
salt\-ssh \(aq*\(aq [ options ] sys.doc
salt\-ssh \-E \(aq.*\(aq [ options ] sys.doc cmd
.ft P
.fi
.UNINDENT
.UNINDENT
.SH DESCRIPTION
.sp
Salt SSH allows for salt routines to be executed using only SSH for transport
.SH OPTIONS
.INDENT 0.0
.TP
.B \-\-version
Print the version of Salt that is running.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-versions\-report
Show program\(aqs dependencies and version number, and then exit
.UNINDENT
.INDENT 0.0
.TP
.B \-h, \-\-help
Show the help message and exit
.UNINDENT
.INDENT 0.0
.TP
.B \-c CONFIG_DIR, \-\-config\-dir=CONFIG_dir
The location of the Salt configuration directory. This directory contains
the configuration files for Salt master and minions. The default location
on most systems is \fB/etc/salt\fP\&.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-hard\-crash
Raise any original exception rather than exiting gracefully. Default: False.
.UNINDENT
.INDENT 0.0
.TP
.B \-r, \-\-raw, \-\-raw\-shell
Execute a raw shell command.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-roster
Define which roster system to use, this defines if a database backend,
scanner, or custom roster system is used. Default is the flat file roster.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-roster\-file
Define an alternative location for the default roster file location. The
default roster file is called \fBroster\fP and is found in the same directory
as the master config file.
.sp
New in version 2014.1.0.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-refresh, \-\-refresh\-cache
Force a refresh of the master side data cache of the target\(aqs data. This
is needed if a target\(aqs grains have been changed and the auto refresh
timeframe has not been reached.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-max\-procs
Set the number of concurrent minions to communicate with. This value
defines how many processes are opened up at a time to manage connections,
the more running process the faster communication should be, default
is 25.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-extra\-filerefs=EXTRA_FILEREFS
Pass in extra files to include in the state tarball.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-min\-extra\-modules=MIN_EXTRA_MODS
One or comma\-separated list of extra Python modulesto be included
into Minimal Salt.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-thin\-extra\-modules=THIN_EXTRA_MODS
One or comma\-separated list of extra Python modulesto be included
into Thin Salt.
.UNINDENT
.INDENT 0.0
.TP
.B \-v, \-\-verbose
Turn on command verbosity, display jid.
.UNINDENT
.INDENT 0.0
.TP
.B \-s, \-\-static
Return the data from minions as a group after they all return.
.UNINDENT
.INDENT 0.0
.TP
.B \-w, \-\-wipe
Remove the deployment of the salt files when done executing.
.UNINDENT
.INDENT 0.0
.TP
.B \-W, \-\-rand\-thin\-dir
Select a random temp dir to deploy on the remote system. The dir
will be cleaned after the execution.
.UNINDENT
.INDENT 0.0
.TP
.B \-t, \-\-regen\-thin, \-\-thin
Trigger a thin tarball regeneration. This is needed if custom
grains/modules/states have been added or updated.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-python2\-bin=PYTHON2_BIN
Path to a python2 binary which has salt installed.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-python3\-bin=PYTHON3_BIN
Path to a python3 binary which has salt installed.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-jid=JID
Pass a JID to be used instead of generating one.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-pre\-flight
Run the ssh_pre_flight script defined in the roster.
By default this script will only run if the thin dir
does not exist on the target minion. This option will
force the script to run regardless of the thin dir
existing or not.
.UNINDENT
.SS Authentication Options
.INDENT 0.0
.TP
.B \-\-priv=SSH_PRIV
Specify the SSH private key file to be used for authentication.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-priv\-passwd=SSH_PRIV_PASSWD
Specify the SSH private key file\(aqs passphrase if need be.
.UNINDENT
.INDENT 0.0
.TP
.B \-i, \-\-ignore\-host\-keys
By default ssh host keys are honored and connections will ask for
approval. Use this option to disable StrictHostKeyChecking.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-no\-host\-keys
Fully ignores ssh host keys which by default are honored and connections
would ask for approval. Useful if the host key of a remote server has
changed and would still error with \-\-ignore\-host\-keys.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-user=SSH_USER
Set the default user to attempt to use when authenticating.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-passwd
Set the default password to attempt to use when authenticating.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-askpass
Interactively ask for the SSH password with no echo \- avoids password
in process args and stored in history.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-key\-deploy
Set this flag to attempt to deploy the authorized ssh key with all
minions. This combined with \-\-passwd can make initial deployment of keys
very fast and easy.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-identities\-only
Use the only authentication identity files configured in the ssh_config
files. See IdentitiesOnly flag in man ssh_config.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-sudo
Run command via sudo.
.UNINDENT
.SS Scan Roster Options
.INDENT 0.0
.TP
.B \-\-scan\-ports=SSH_SCAN_PORTS
Comma\-separated list of ports to scan in the scan roster.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-scan\-timeout=SSH_SCAN_TIMEOUT
Scanning socket timeout for the scan roster.
.UNINDENT
.SS Logging Options
.sp
Logging options which override any settings defined on the configuration files.
.INDENT 0.0
.TP
.B \-l LOG_LEVEL, \-\-log\-level=LOG_LEVEL
Console logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
\fBdebug\fP, \fBinfo\fP, \fBwarning\fP, \fBerror\fP, \fBquiet\fP\&. Default:
\fBwarning\fP\&.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-log\-file=LOG_FILE
Log file path. Default: /var/log/salt/ssh\&.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-log\-file\-level=LOG_LEVEL_LOGFILE
Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
\fBdebug\fP, \fBinfo\fP, \fBwarning\fP, \fBerror\fP, \fBquiet\fP\&. Default:
\fBwarning\fP\&.
.UNINDENT
.SS Target Selection
.sp
The default matching that Salt utilizes is shell\-style globbing around the
minion id. See \fI\%https://docs.python.org/3/library/fnmatch.html#module\-fnmatch\fP\&.
.INDENT 0.0
.TP
.B \-E, \-\-pcre
The target expression will be interpreted as a PCRE regular expression
rather than a shell glob.
.UNINDENT
.SS Output Options
.INDENT 0.0
.TP
.B \-\-out
Pass in an alternative outputter to display the return of data. This
outputter can be any of the available outputters:
.INDENT 7.0
.INDENT 3.5
\fBhighstate\fP, \fBjson\fP, \fBkey\fP, \fBoverstatestage\fP, \fBpprint\fP, \fBraw\fP, \fBtxt\fP, \fByaml\fP, and many others\&.
.UNINDENT
.UNINDENT
.sp
Some outputters are formatted only for data returned from specific functions.
If an outputter is used that does not support the data passed into it, then
Salt will fall back on the \fBpprint\fP outputter and display the return data
using the Python \fBpprint\fP standard library module.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-out\-indent OUTPUT_INDENT, \-\-output\-indent OUTPUT_INDENT
Print the output indented by the provided value in spaces. Negative values
disable indentation. Only applicable in outputters that support
indentation.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-out\-file=OUTPUT_FILE, \-\-output\-file=OUTPUT_FILE
Write the output to the specified file.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-out\-file\-append, \-\-output\-file\-append
Append the output to the specified file.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-no\-color
Disable all colored output
.UNINDENT
.INDENT 0.0
.TP
.B \-\-force\-color
Force colored output
.sp
\fBNOTE:\fP
.INDENT 7.0
.INDENT 3.5
When using colored output the color codes are as follows:
.sp
\fBgreen\fP denotes success, \fBred\fP denotes failure, \fBblue\fP denotes
changes and success and \fByellow\fP denotes a expected future change in configuration.
.UNINDENT
.UNINDENT
.UNINDENT
.INDENT 0.0
.TP
.B \-\-state\-output=STATE_OUTPUT, \-\-state_output=STATE_OUTPUT
Override the configured state_output value for minion
output. One of \(aqfull\(aq, \(aqterse\(aq, \(aqmixed\(aq, \(aqchanges\(aq or
\(aqfilter\(aq. Default: \(aqnone\(aq.
.UNINDENT
.INDENT 0.0
.TP
.B \-\-state\-verbose=STATE_VERBOSE, \-\-state_verbose=STATE_VERBOSE
Override the configured state_verbose value for minion
output. Set to True or False. Default: none.
.UNINDENT
.sp
\fBNOTE:\fP
.INDENT 0.0
.INDENT 3.5
If using \fB\-\-out=json\fP, you will probably want \fB\-\-static\fP as well.
Without the static option, you will get a separate JSON string per minion
which makes JSON output invalid as a whole.
This is due to using an iterative outputter. So if you want to feed it
to a JSON parser, use \fB\-\-static\fP as well.
.UNINDENT
.UNINDENT
.SH SEE ALSO
.sp
\fBsalt(7)\fP
\fBsalt\-master(1)\fP
\fBsalt\-minion(1)\fP
.SH AUTHOR
Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
.\" Generated by docutils manpage writer.
.