That's good info! I wasn't entirely sure how Augeas handled each statement
in the changes block, so I did initially try chaining multiple statements
with Puppet ordering to make sure. I'll give this a shot and see what
happens.
On Thursday, May 15, 2014 1:02:02 PM UTC-4, David Lutterkort wrote:
>
> There's a small but subtle difference between your Puppet code and what
> you did in augtool:
>
> On Tuesday, May 13, 2014 9:37:33 PM UTC-7, jwil...@gmail.com wrote:
>>
>> Hi!
>>
>> I'm trying to update /etc/ssh/sshd_config on a Vagrant vm using the
>> puppet provider. When I do:
>>
>> ins PermitRootLogin after /files/etc/ssh/sshd_config/#comment[. =
>> 'PermitRootLogin yes']
>>
>> in augtool, it works fine.
>>
>> But nothing I try in my puppet rules works. I've tried a few variants,
>> including:
>>
>
> The problem is that Puppet implicitly does a 'save' after the changes it
> makes - if you issue a 'save' in augtool after the insert you mention
> above, you'll also get an error. The problem is that you've created a
> 'PermitRootLogin node, but that has no value attached to it; augtool knows
> that that's not valid syntax for sshd_config and refuses to save the file.
>
> You'd have to do the following in augtool:
>
> augtool> ins PermitRootLogin after /files/etc/ssh/sshd_config/#comment[. =
> 'PermitRootLogin yes']
> augtool> save
> error: Failed to execute command
> saving failed (run 'print /augeas//error' for details)
> augtool> set /files/etc/ssh/sshd_config/PermitRootLogin yes
> augtool> save
>
> and add that 'set' command to your changes array in the Puppet resource.
>
> You'll also need to make sure that those changes (especially the 'ins')
> only happen if there is no PermitRootLogin entry yet, otherwise Puppet will
> add one on every run; you can use the 'onlyif' param for the augeas
> resource for that. All in all you'd wind up with something like this
> (untested) code:
>
> # Create and set PermitRootLogin if it doesn't exist
> # We need to insert + set to make sure the resource produces a
> syntactically correct sshd_config
> augeas {'sshd_ins_root_login':
> incl => '/etc/ssh/sshd_config',
> lens => 'Sshd.lns',
> context => '/files/etc/ssh/sshd_config',
> changes => [
> "ins PermitRootLogin after #comment[.='PermitRootLogin yes']",
> "set PermitRootLogin yes"
> ],
> onlyif => "match PermitRootLogin size == 0"
> }
>
> # Set an existing PermitRootLogin to 'yes'
> augeas {'sshd_set_root_login':
> incl => '/etc/ssh/sshd_config',
> lens => 'Sshd.lns',
> context => '/files/etc/ssh/sshd_config',
> changes => [
> "set PermitRootLogin yes"
> ],
> after => Augeas[sshd_ins_root_login]
> }
>
> Having said that, you should check out the augeasproviders module (
> https://forge.puppetlabs.com/domcleal/augeasproviders) which uses Augeas
> internally but hides some of these gymnastics from the user.
>
> Also, it would be awesome if somebody wrote a type that makes it possible
> for users to say 'make sure there is a subtree that looks a certain way'
> idempotently rather than forcing users to figure that all out with the raw
> augeas resource, something like
>
> augeas::tree { sshd_root_login:
> lens => 'Sshd.lns',
> file => ...,
> context => '/files/etc/ssh/sshd_config',
> after => "#comment[.='PermitRootLogin yes']",
> entries => [
> "PermitRootLogin = yes"
> ]
> }
>
> The idea is that the above should do the same as the two augeas resources
> above.
>
> David
>
--
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/puppet-users/a0fb669f-8089-422e-b7f5-7519ea9547d4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
