<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none"></style> </head> <body dir="ltr"> <div style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Tahoma, Geneva, sans-serif;"> <p>As it turns out, I guess unquoted strings are allowed in rkhunter.conf. Until I can learn how to write lenses, I think I'll just quote the two strings and move on. :)<br> </p> <div> <p><br> </p> <div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0"> <div style="font-family:Tahoma; font-size:13px">--<br> Kent Brede<br> UNO Linux System Administrator<br> kbrede@unomaha.edu<br> </div> </div> </div> <div style="color: rgb(40, 40, 40);"> <hr tabindex="-1" style="display:inline-block; width:98%"> <div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Raphaël Pinson <raphael.pinson@camptocamp.com><br> <b>Sent:</b> Friday, April 04, 2014 9:29 AM<br> <b>To:</b> Kent Brede<br> <b>Cc:</b> augeas-devel<br> <b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font> <div> </div> </div> <div> <p dir="ltr">So Shellvars.lns will only work if your unquoted lines were wrong. Otherwise you'll need a specific lens (shouldn't be too hard to write).<br> <br> </p> <p dir="ltr">--<br> Raphaël Pinson<br> Infrastructure Developer & Trainer<br> +33 479 26 57 93<br> +33 781 90 00 79</p> <p dir="ltr">Camptocamp France<br> Savoie Technolac<br> BP 352<br> 48, avenue du Lac du Bourget<br> 73372 Le Bourget-du-Lac, Cedex</p> <div class="gmail_quote">Le 4 avr. 2014 16:02, "Kent Brede" <<a href="mailto:kbrede@unomaha.edu">kbrede@unomaha.edu</a>> a écrit :<br type="attribution"> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex"> <div dir="ltr"> <div style="font-size:12pt; font-family:Tahoma,Geneva,sans-serif"> <p>OK, I'm a bit farther on this. I followed the instructions here:<br> </p> <p><br> </p> <p><a href="https://github.com/hercules-team/augeas/wiki/Loading-specific-files#loading-even-less" target="_blank">https://github.com/hercules-team/augeas/wiki/Loading-specific-files#loading-even-less</a><br> </p> <p><br> </p> <p>After doing a "print" I discovered some errors.<br> </p> <p><br> </p> <p>Shellvars doesn't like the following two strings that should be quoted. Apparently EPEL forgot to do that.<br> </p> <p><br> </p> <p>SUSPSCAN_DIRS=/tmp /var/tmp<br> </p> <p>DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps<br> </p> <p><br> </p> <p>After commenting the strings and doing a quick test via Puppet, I verified Shellvars works with this file.<br> </p> <p><br> </p> <p>Also just for completeness, in case someone reads this in the future, this is one way to find parse errors:<br> </p> <p><br> </p> <div>[root@puppet manifests]# augtool --transform "Shellvars.lns incl /etc/rkhunter.conf"</div> <div>augtool> print /augeas/files/etc/rkhunter.conf</div> <div>/augeas/files/etc/rkhunter.conf</div> <div>/augeas/files/etc/rkhunter.conf/path = "/files/etc/rkhunter.conf"</div> <div>/augeas/files/etc/rkhunter.conf/mtime = "1396619823"</div> <div>/augeas/files/etc/rkhunter.conf/lens = "Shellvars.lns"</div> <div>/augeas/files/etc/rkhunter.conf/lens/info = "/usr/share/augeas/lenses/dist/shellvars.aug:163.12-.99:"</div> <div>/augeas/files/etc/rkhunter.conf/error = "parse_failed"</div> <div>/augeas/files/etc/rkhunter.conf/error/pos = "33423"</div> <div>/augeas/files/etc/rkhunter.conf/error/line = "926"</div> <div>/augeas/files/etc/rkhunter.conf/error/char = "13"</div> <div>/augeas/files/etc/rkhunter.conf/error/lens = "/usr/share/augeas/lenses/dist/shellvars.aug:163.12-.99:"</div> <div>/augeas/files/etc/rkhunter.conf/error/message = "Syntax error"<br> </div> <p><br> </p> <p>Thanks for pointing me in the right direction Ralphael. :)<br> </p> <p><br> </p> <div> <div name="divtagdefaultwrapper"> <div style="font-family:Tahoma; font-size:13px">--<br> Kent Brede<br> UNO Linux System Administrator<br> <a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br> </div> </div> </div> <div dir="ltr" style="color:rgb(40,40,40)"> <hr style="display:inline-block; width:98%"> <div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> <a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a> <<a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a>> on behalf of Kent Brede <<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a>><br> <b>Sent:</b> Friday, April 04, 2014 8:02 AM<br> <b>To:</b> <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br> <b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font> <div> </div> </div> <div> <div style="color:#000000; font-size:12pt; font-family:Tahoma,Geneva,sans-serif"> <p>Thanks for the response Raphael. I tried both version 1.0.0 and 1.1.0. I get no information back from augtool. </p> <p><br> </p> <div>[root@firefly ~]# augtool --transform "Shellvars.lns incl /etc/rkhunter.conf"</div> <div>augtool> print /files/etc/rkhunter.conf</div> <div>augtool><br> </div> <div><br> </div> <div>The file is there.<br> </div> <div><br> </div> <div> <div>[root@firefly ~]# ll /etc/rkhunter.conf </div> <div>-rw-r----- 1 root root 39322 May 13 2012 /etc/rkhunter.conf<br> </div> <div><br> </div> <div>The file only contains comments, and options such as:</div> <div><br> </div> <div>SUSPSCAN_THRESH=200<br> </div> SUSPSCAN_DIRS="/tmp /var/tmp"<br> </div> <p> <br> </p> <p>What am I missing?<br> </p> <div> <p><br> </p> <div name="divtagdefaultwrapper"> <div style="font-family:Tahoma; font-size:13px">--<br> Kent Brede<br> UNO Linux System Administrator<br> <a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br> </div> </div> </div> <div style="color:rgb(40,40,40)"> <hr style="display:inline-block; width:98%"> <div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Raphaël Pinson <<a href="mailto:raphael.pinson@camptocamp.com" target="_blank">raphael.pinson@camptocamp.com</a>><br> <b>Sent:</b> Friday, April 04, 2014 4:47 AM<br> <b>To:</b> Kent Brede<br> <b>Cc:</b> <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br> <b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font> <div> </div> </div> <div> <div dir="ltr">Hello Kent, <div><br> </div> <div>You don't need to modify the lens in order to test it againt your file. You can just tell Augeas to use this lens for this file. In Augeas >= 1.0.0, you can use:</div> <div><br> </div> <div> augtool --transform "Shellvars.lns incl <span style="font-family:arial,sans-serif; font-size:13px">/etc/rkhunter.conf"</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">If your file is present in this location, you should see one of these two:</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">* Parsed content in /files/etc/rkhunter.conf</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">* Errors in /augeas/files/etc/rkhunter.conf/error</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">The only case that I can think of where you wouldn't see any of these (besides the file being absent/empty) is if you're using Augeas 0.7.X, which had a bug in parse error reporting.</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">Cheers,</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> <div><span style="font-family:arial,sans-serif; font-size:13px">Raphaël Pinson</span></div> <div><span style="font-family:arial,sans-serif; font-size:13px"><br> </span></div> </div> <div class="gmail_extra"><br> <br> <div class="gmail_quote">On Thu, Apr 3, 2014 at 11:33 PM, Kent Brede <span dir="ltr"> <<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex"> I'm just getting started with Augeas. Decided I'd like to use it for /etc/rkhunter.conf. It looks to me like shellvars.aug should work for the file. I tried a quick test to see if it would work by adding ". incl "/etc/rkhunter.conf"" under "filter_misc" to shellvars.aug. I realize this isn't probably the approved way of going about this.<br> <br> What I don't understand is, why doesn't "augtool print /files/etc/rkhunter.conf" report anything back? I see nothing in /augeas//error.<br> <br> --<br> Kent Brede<br> UNO Linux System Administrator<br> <a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br> <br> _______________________________________________<br> augeas-devel mailing list<br> <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/augeas-devel" target="_blank">https://www.redhat.com/mailman/listinfo/augeas-devel</a><br> </blockquote> </div> <br> <br clear="all"> <div><br> </div> -- <br> <div dir="ltr">Raphaël Pinson <div>Infrastructure Developer & Trainer</div> <div><a href="tel:%2B33%20479%2026%2057%2093" value="+33479265793" target="_blank">+33 479 26 57 93</a> <div><a href="tel:%2B33%20781%2090%2000%2079" value="+33781900079" target="_blank">+33 781 90 00 79</a></div> <div><br> </div> <div>Camptocamp France<br> Savoie Technolac<br> BP 352<br> 48, avenue du Lac du Bourget<br> 73372 Le Bourget du Lac, Cedex<br> <a href="http://www.camptocamp.com" target="_blank">www.camptocamp.com</a><br> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> <br> _______________________________________________<br> augeas-devel mailing list<br> <a href="mailto:augeas-devel@redhat.com">augeas-devel@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/augeas-devel" target="_blank">https://www.redhat.com/mailman/listinfo/augeas-devel</a><br> </blockquote> </div> </div> </div> </div> </body> </html>