There's a small but subtle difference between your Puppet code and what you
did in augtool:
On Tuesday, May 13, 2014 9:37:33 PM UTC-7, jwil...@gmail.com wrote:
>
> Hi!
>
> I'm trying to update /etc/ssh/sshd_config on a Vagrant vm using the puppet
> provider. When I do:
>
> ins PermitRootLogin after /files/etc/ssh/sshd_config/#comment[. =
> 'PermitRootLogin yes']
>
> in augtool, it works fine.
>
> But nothing I try in my puppet rules works. I've tried a few variants,
> including:
>
The problem is that Puppet implicitly does a 'save' after the changes it
makes - if you issue a 'save' in augtool after the insert you mention
above, you'll also get an error. The problem is that you've created a
'PermitRootLogin node, but that has no value attached to it; augtool knows
that that's not valid syntax for sshd_config and refuses to save the file.
You'd have to do the following in augtool:
augtool> ins PermitRootLogin after /files/etc/ssh/sshd_config/#comment[. =
'PermitRootLogin yes']
augtool> save
error: Failed to execute command
saving failed (run 'print /augeas//error' for details)
augtool> set /files/etc/ssh/sshd_config/PermitRootLogin yes
augtool> save
and add that 'set' command to your changes array in the Puppet resource.
You'll also need to make sure that those changes (especially the 'ins')
only happen if there is no PermitRootLogin entry yet, otherwise Puppet will
add one on every run; you can use the 'onlyif' param for the augeas
resource for that. All in all you'd wind up with something like this
(untested) code:
# Create and set PermitRootLogin if it doesn't exist
# We need to insert + set to make sure the resource produces a
syntactically correct sshd_config
augeas {'sshd_ins_root_login':
incl => '/etc/ssh/sshd_config',
lens => 'Sshd.lns',
context => '/files/etc/ssh/sshd_config',
changes => [
"ins PermitRootLogin after #comment[.='PermitRootLogin yes']",
"set PermitRootLogin yes"
],
onlyif => "match PermitRootLogin size == 0"
}
# Set an existing PermitRootLogin to 'yes'
augeas {'sshd_set_root_login':
incl => '/etc/ssh/sshd_config',
lens => 'Sshd.lns',
context => '/files/etc/ssh/sshd_config',
changes => [
"set PermitRootLogin yes"
],
after => Augeas[sshd_ins_root_login]
}
Having said that, you should check out the augeasproviders module
(https://forge.puppetlabs.com/domcleal/augeasproviders) which uses Augeas
internally but hides some of these gymnastics from the user.
Also, it would be awesome if somebody wrote a type that makes it possible
for users to say 'make sure there is a subtree that looks a certain way'
idempotently rather than forcing users to figure that all out with the raw
augeas resource, something like
augeas::tree { sshd_root_login:
lens => 'Sshd.lns',
file => ...,
context => '/files/etc/ssh/sshd_config',
after => "#comment[.='PermitRootLogin yes']",
entries => [
"PermitRootLogin = yes"
]
}
The idea is that the above should do the same as the two augeas resources
above.
David
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/d9218f7e-4448-4d65-914a-acdcdaffd006%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
