[chef] openssh-cookbook - extending sshd_config? (was: Re: Re: Append text to beginning of file)

[Alexander Skwar < >]

​Hello Matt

Yes, I understand, that it is much more "Chef'fy" to put a COMPLETE configuration file under Chef. But sometimes, that's not really doable.

As FileEdit doesn't support my request, I worked around that and am not using it for this task ;)

Reg. openssh cookbook. Cool!

We'd have a "generic" sshd_config for all hosts. Could I use this cookbook to *extend* or change an existing sshd_config? For example, I'd like to have

   PermitRootLogin without-password

But for certain hosts (or in certain other cookbooks or so), I'd like to have

   PermitRootLogin no

 

Also, for some systems, I'd like to extend the sshd_config with a "Match group" block (to allow or deny certain groups).

Could I use the openssh-cookbook for this? Could you show me how?

Thanks a lot,

Alexander

​​

2015-09-02 15:55 GMT+02:00 Matthew Moretti < " target="_blank"> >:

Hello Alexander,

The general advice I’ve seen about using Chef to edit configuration files is that you should generally avoid doing so if you can. If you have the option of having Chef be the only entity that manages the file in question, it’s much easier to put Chef in charge of the entire file and use a file or template resource instead.

In the case of ssshd_config, I’ve never had a complaint about the openssh cookbook which uses attributes to build the whole config (nice for wrapper cookbooks, environments, roles, etc.).

To answer your actual question though, it doesn’t look like FileEdit will append to the beginning of a file, no. If that’s definitely what you want to do, you’ll probably have to break out some ruby_blocks and use the slightly lower-level ::File methods.

Hope that helps.

Matt Moretti

On Thu, Aug 27, 2015 at 11:14 AM, Alexander Skwar " target="_blank"> wrote:

Hello

With Chef 11.8.2 and FileEdit and the help of this list :), I've now
got a way to replace text in a file and use the captured text. As it
turned out, I'm not using the captured text at all… Oh, well :)

I am now replacing all old values in a config file (sshd_config, to be
exact). And when a certain config setting wasn't there at all, I
insert a line with the new setting. But it will get appended to the
file; it will be at the end of the file.

That's (maybe…) a problem, as a sshd_config file might have a "Match
…" block at the end.

Is there maybe an easy to way to add text to the BEGINNING of the file? :)

Here (or, for maybe better readability on
http://pastebin.com/1QWfsnFZ) is, what I've got now:

#############################################
# SSH Parameter
{"Protocol" => "2", "LogLevel" => "INFO", "MaxAuthTries" => "4",
"IgnoreRhosts" => "yes", "HostbasedAuthentication" => "no",
"PermitRootLogin" => "no", "PermitEmptyPasswords" => "no", "Banner" =>
"/etc/issue.net"}.each do |param, value|
    cfg_file = "/etc/ssh/sshd_config"

    replace_line_re = /^#{param}.*/
    insert_line_text = replace_line_text = "#{param} #{value}"
    insert_line_re = /^#{replace_line_text}/

    ruby_block "CIS: SSHd Parameter modifizieren. " + param + " => " + value do
        block do
            fe = Chef::Util::FileEdit.new(cfg_file)

            # Alte Werte durch neue Werte ersetzen
            fe.search_file_replace_line(replace_line_re, replace_line_text)

            # Zeile mit neuem Wert am Ende der Datei einfügen - falls
nicht schon vorhanden
            fe.insert_line_if_no_match(insert_line_re, insert_line_text)

            # Datei schreiben
            fe.write_file
        end # of block do
        notifies :reload, "service[ssh]", :delayed
    end # of ruby_block "CIS: SSHd Parameter modifizieren. " + param +
" => " + value do
end # of {"Protocol" => "2", "LogLevel" => "INFO", "MaxAuthTries" =>
"4", "IgnoreRhosts" => "yes", "HostbasedAuthentication" => "no",
"PermitRootLogin" => "no", "PermitEmptyPasswords" => "no", "Banner" =>
"/etc/issue.net"}.each do |param, value|




Thanks so much again,


Alexander
--
=>        Google+ => http://plus.skwar.me         <==
=> Chat (Jabber/Google Talk) => " target="_blank"> <==

​

--

Alexander
-- 
=>        Google+ => http://plus.skwar.me         <==
=> Chat (Jabber/Google Talk) => 
 
 " target="_blank">
  <==