augeas, sshd and multiple onlyif requirements

[Chris]

Hi all,

I'm trying to insert a ClientAliveInterval setting into sshd_config with
augeas. Some servers have a "Match User" line (so the new setting needs
to come before the "Match User" line), and some don't. Some already have
a ClientAliveInterval setting, and some don't.

My first attempt was this:

augeas{'sshd-config-client-alive-interval':
context => '/files/etc/ssh/sshd_config',
changes => [
'ins ClientAliveInterval before Match',
'set ClientAliveInterval 3600',
],
onlyif => [
'match ClientAliveInterval size == 0',
'match Match size > 0',
],
}

But it's not checking both onlyif requirements before trying to add the
new setting. Reversing the order tries to add it to configs with the
option already set which also causes a failure.


I've read a few posts that suggest putting both match requirements into
one setting, but I can't get the syntax right.

augeas{'sshd-config-client-alive-interval':
context => '/files/etc/ssh/sshd_config',
changes => [
'ins ClientAliveInterval before Match',
'set ClientAliveInterval 3600',
],
onlyif => [
'match "/files/etc/ssh/sshd_config[(match
/files/etc/ssh/sshd_config include ClientAliveInterval) size == 0 and
(match /files/etc/ssh/sshd_config include Match) size > 0]" size > 0',
],
}

Any help, suggestions, alternatives would be greatly appreciated.

Using augeas 1.0.0 from scientific linux 6, puppet 2.7.

Thanks!
--
Postgresql & php tutorials
http://www.designmagick.com/

[John Warburton]

On 10 October 2014 13:34, Chris <dma...@gmail.com> wrote:

Any help, suggestions, alternatives would be greatly appreciated.

Stop using Augeas and start using templates

Here's an extreme example from the the most popular SSH module on the forge - https://github.com/saz/puppet-ssh/blob/master/templates/sshd_config.erb, although I find Garrett's easier to read if you were new to templating - https://github.com/ghoneycutt/puppet-module-ssh/blob/master/templates/sshd_config.erb

John

[Chris]

On 10/10/14 16:29, John Warburton wrote:
> On 10 October 2014 13:34, Chris <dma...@gmail.com

> <mailto:dma...@gmail.com>> wrote:
>
>
> Any help, suggestions, alternatives would be greatly appreciated.
>
>
> Stop using Augeas and start using templates

> <https://docs.puppetlabs.com/guides/templating.html>

I didn't want to go that far, so I persisted with the other approach.

Instead of doing this:

augeas{'sshd-config-client-alive-interval':
context => '/files/etc/ssh/sshd_config',
changes => [
'ins ClientAliveInterval before Match',
'set ClientAliveInterval 3600',
],
onlyif => [
'match ClientAliveInterval size == 0',
'match Match size > 0',
],
}

I did this:

augeas{'sshd-config-client-alive-interval':
context => '/files/etc/ssh/sshd_config',
changes => [

'rm ClientAliveInterval', # Make sure it's gone so it won't be
set multiple times

'ins ClientAliveInterval before Match',
'set ClientAliveInterval 3600',
],
onlyif => [

'match Match size > 0',
],
}

and augeas is smart enough (much smarter than me) to only run that once
(subsequent runs don't keep removing it and re-adding it).

Cheers,