<p dir="ltr">As you wish :-)</p>
<p dir="ltr">Did you try with Simplevars.lns by any chance? </p>
<p dir="ltr">--<br>
Raphaël Pinson<br>
Infrastructure Developer & Trainer<br>
+33 479 26 57 93<br>
+33 781 90 00 79</p>
<p dir="ltr">Camptocamp France<br>
Savoie Technolac<br>
BP 352<br>
48, avenue du Lac du Bourget<br>
73372 Le Bourget-du-Lac, Cedex</p>
<div class="gmail_quote">Le 4 avr. 2014 17:23, "Kent Brede" <<a href="mailto:kbrede@unomaha.edu">kbrede@unomaha.edu</a>> a écrit :<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt;font-family:Tahoma,Geneva,sans-serif">
<p>As it turns out, I guess unquoted strings are allowed in rkhunter.conf. Until I can learn how to write lenses, I think I'll just quote the two strings and move on. :)<br>
</p>
<div>
<p><br>
</p>
<div name="divtagdefaultwrapper">
<div style="font-family:Tahoma;font-size:13px">--<br>
Kent Brede<br>
UNO Linux System Administrator<br>
<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br>
</div>
</div>
</div>
<div style="color:rgb(40,40,40)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Raphaël Pinson <<a href="mailto:raphael.pinson@camptocamp.com" target="_blank">raphael.pinson@camptocamp.com</a>><br>
<b>Sent:</b> Friday, April 04, 2014 9:29 AM<br>
<b>To:</b> Kent Brede<br>
<b>Cc:</b> augeas-devel<br>
<b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font>
<div> </div>
</div>
<div>
<p dir="ltr">So Shellvars.lns will only work if your unquoted lines were wrong. Otherwise you'll need a specific lens (shouldn't be too hard to write).<br>
<br>
</p>
<p dir="ltr">--<br>
Raphaël Pinson<br>
Infrastructure Developer & Trainer<br>
<a href="tel:%2B33%20479%2026%2057%2093" value="+33479265793" target="_blank">+33 479 26 57 93</a><br>
<a href="tel:%2B33%20781%2090%2000%2079" value="+33781900079" target="_blank">+33 781 90 00 79</a></p>
<p dir="ltr">Camptocamp France<br>
Savoie Technolac<br>
BP 352<br>
48, avenue du Lac du Bourget<br>
73372 Le Bourget-du-Lac, Cedex</p>
<div class="gmail_quote">Le 4 avr. 2014 16:02, "Kent Brede" <<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a>> a écrit :<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt;font-family:Tahoma,Geneva,sans-serif">
<p>OK, I'm a bit farther on this. I followed the instructions here:<br>
</p>
<p><br>
</p>
<p><a href="https://github.com/hercules-team/augeas/wiki/Loading-specific-files#loading-even-less" target="_blank">https://github.com/hercules-team/augeas/wiki/Loading-specific-files#loading-even-less</a><br>
</p>
<p><br>
</p>
<p>After doing a "print" I discovered some errors.<br>
</p>
<p><br>
</p>
<p>Shellvars doesn't like the following two strings that should be quoted. Apparently EPEL forgot to do that.<br>
</p>
<p><br>
</p>
<p>SUSPSCAN_DIRS=/tmp /var/tmp<br>
</p>
<p>DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps<br>
</p>
<p><br>
</p>
<p>After commenting the strings and doing a quick test via Puppet, I verified Shellvars works with this file.<br>
</p>
<p><br>
</p>
<p>Also just for completeness, in case someone reads this in the future, this is one way to find parse errors:<br>
</p>
<p><br>
</p>
<div>[root@puppet manifests]# augtool --transform "Shellvars.lns incl /etc/rkhunter.conf"</div>
<div>augtool> print /augeas/files/etc/rkhunter.conf</div>
<div>/augeas/files/etc/rkhunter.conf</div>
<div>/augeas/files/etc/rkhunter.conf/path = "/files/etc/rkhunter.conf"</div>
<div>/augeas/files/etc/rkhunter.conf/mtime = "1396619823"</div>
<div>/augeas/files/etc/rkhunter.conf/lens = "Shellvars.lns"</div>
<div>/augeas/files/etc/rkhunter.conf/lens/info = "/usr/share/augeas/lenses/dist/shellvars.aug:163.12-.99:"</div>
<div>/augeas/files/etc/rkhunter.conf/error = "parse_failed"</div>
<div>/augeas/files/etc/rkhunter.conf/error/pos = "33423"</div>
<div>/augeas/files/etc/rkhunter.conf/error/line = "926"</div>
<div>/augeas/files/etc/rkhunter.conf/error/char = "13"</div>
<div>/augeas/files/etc/rkhunter.conf/error/lens = "/usr/share/augeas/lenses/dist/shellvars.aug:163.12-.99:"</div>
<div>/augeas/files/etc/rkhunter.conf/error/message = "Syntax error"<br>
</div>
<p><br>
</p>
<p>Thanks for pointing me in the right direction Ralphael. :)<br>
</p>
<p><br>
</p>
<div>
<div name="divtagdefaultwrapper">
<div style="font-family:Tahoma;font-size:13px">--<br>
Kent Brede<br>
UNO Linux System Administrator<br>
<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br>
</div>
</div>
</div>
<div dir="ltr" style="color:rgb(40,40,40)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b>
<a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a> <<a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a>> on behalf of Kent Brede <<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a>><br>
<b>Sent:</b> Friday, April 04, 2014 8:02 AM<br>
<b>To:</b> <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br>
<b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font>
<div> </div>
</div>
<div>
<div style="color:#000000;font-size:12pt;font-family:Tahoma,Geneva,sans-serif">
<p>Thanks for the response Raphael. I tried both version 1.0.0 and 1.1.0. I get no information back from augtool. </p>
<p><br>
</p>
<div>[root@firefly ~]# augtool --transform "Shellvars.lns incl /etc/rkhunter.conf"</div>
<div>augtool> print /files/etc/rkhunter.conf</div>
<div>augtool><br>
</div>
<div><br>
</div>
<div>The file is there.<br>
</div>
<div><br>
</div>
<div>
<div>[root@firefly ~]# ll /etc/rkhunter.conf </div>
<div>-rw-r----- 1 root root 39322 May 13 2012 /etc/rkhunter.conf<br>
</div>
<div><br>
</div>
<div>The file only contains comments, and options such as:</div>
<div><br>
</div>
<div>SUSPSCAN_THRESH=200<br>
</div>
SUSPSCAN_DIRS="/tmp /var/tmp"<br>
</div>
<p> <br>
</p>
<p>What am I missing?<br>
</p>
<div>
<p><br>
</p>
<div name="divtagdefaultwrapper">
<div style="font-family:Tahoma;font-size:13px">--<br>
Kent Brede<br>
UNO Linux System Administrator<br>
<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br>
</div>
</div>
</div>
<div style="color:rgb(40,40,40)">
<hr style="display:inline-block;width:98%">
<div dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Raphaël Pinson <<a href="mailto:raphael.pinson@camptocamp.com" target="_blank">raphael.pinson@camptocamp.com</a>><br>
<b>Sent:</b> Friday, April 04, 2014 4:47 AM<br>
<b>To:</b> Kent Brede<br>
<b>Cc:</b> <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br>
<b>Subject:</b> Re: [augeas-devel] rkhunter.conf</font>
<div> </div>
</div>
<div>
<div dir="ltr">Hello Kent,
<div><br>
</div>
<div>You don't need to modify the lens in order to test it againt your file. You can just tell Augeas to use this lens for this file. In Augeas >= 1.0.0, you can use:</div>
<div><br>
</div>
<div> augtool --transform "Shellvars.lns incl <span style="font-family:arial,sans-serif;font-size:13px">/etc/rkhunter.conf"</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">If your file is present in this location, you should see one of these two:</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">* Parsed content in /files/etc/rkhunter.conf</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">* Errors in /augeas/files/etc/rkhunter.conf/error</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">The only case that I can think of where you wouldn't see any of these (besides the file being absent/empty) is if you're using Augeas 0.7.X, which had a bug in parse error reporting.</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">Cheers,</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px">Raphaël Pinson</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Apr 3, 2014 at 11:33 PM, Kent Brede <span dir="ltr">
<<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I'm just getting started with Augeas. Decided I'd like to use it for /etc/rkhunter.conf. It looks to me like shellvars.aug should work for the file. I tried a quick test to see if it would work by adding ". incl "/etc/rkhunter.conf"" under "filter_misc"
to shellvars.aug. I realize this isn't probably the approved way of going about this.<br>
<br>
What I don't understand is, why doesn't "augtool print /files/etc/rkhunter.conf" report anything back? I see nothing in /augeas//error.<br>
<br>
--<br>
Kent Brede<br>
UNO Linux System Administrator<br>
<a href="mailto:kbrede@unomaha.edu" target="_blank">kbrede@unomaha.edu</a><br>
<br>
_______________________________________________<br>
augeas-devel mailing list<br>
<a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/augeas-devel" target="_blank">https://www.redhat.com/mailman/listinfo/augeas-devel</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">Raphaël Pinson
<div>Infrastructure Developer & Trainer</div>
<div><a href="tel:%2B33%20479%2026%2057%2093" value="+33479265793" target="_blank">+33 479 26 57 93</a>
<div><a href="tel:%2B33%20781%2090%2000%2079" value="+33781900079" target="_blank">+33 781 90 00 79</a></div>
<div><br>
</div>
<div>Camptocamp France<br>
Savoie Technolac<br>
BP 352<br>
48, avenue du Lac du Bourget<br>
73372 Le Bourget du Lac, Cedex<br>
<a href="http://www.camptocamp.com" target="_blank">www.camptocamp.com</a><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
_______________________________________________<br>
augeas-devel mailing list<br>
<a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/augeas-devel" target="_blank">https://www.redhat.com/mailman/listinfo/augeas-devel</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>