<div dir="ltr">Xavier,<div> </div><div>The point is -- in general, augeas barfs whenever there's a Match block. With the lens file that ships with augtool. (This is documented in the lens file.)</div><div> </div><div>That's a problem for a general-purpose parsing of a sshd_config file, when you don't know a priori whether the sshd_config file has a Match block or not.</div><div> </div><div>Yes, there are some exotic edge cases in which augeas can tolerate Match blocks. I've found 1-2 myself. But in the main, the lens file doesn't tolerate Match blocks.</div><div> </div><div>I was proposing a miniscule restriction to the sshd_config syntax that should allow the lens file to be embellished to handle Match blocks.</div><div> </div><div>Spike</div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Apr 23, 2021 at 2:06 AM Mol, Xavier (SCC) <<a href="mailto:xavier.mol@kit.edu">xavier.mol@kit.edu</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="DE"><div class="gmail-m_-5108566129675119644WordSection1">Hi Spike, I don’t know your use case, but wouldn’t it be easier to tell Augeas to add UsePrivilegeSeparation before the first Match block? augtool> ins UsePrivilegeSeparation before /files/etc/ssh/sshd_config/Match[1]augtool> set /files/etc/ssh/sshd_config/UsePrivilegeSeparation yes Of course, this doesn’t work out anymore when you are not sure UsePrivilegeSeparation wasn’t set before already. sshd_config will be correct anyway, but this approach would add another ‘UsePrivilegeSeparation = yes’ line every time. Ciao,Xavier. Von: <a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a> <<a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a>> Im Auftrag von Spike White Gesendet: Donnerstag, 22. April 2021 20:00 An: <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a> Betreff: [augeas-devel] Partial answer to augeas not being able to parse / deal with sshd_config Match blocks... <div>Augeas people,<div> </div><div>augeas has a problem dealing with Match blocks in /etc/ssh/sshd_config. It's even documented in the notes in the lens file for that file.</div><div> </div><div>I know that a general purpose parsing of a Match block in augeas is a problem. I've tried. The problem is that augeas by default appends new lines (where they're missing in original file) to the end of the file.</div><div> </div><div>Thus if you have an existing Match block at the end of the sshd_config file such as:</div><div> </div><div>Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3</div><div> </div><div>and you want augeaus to add UsePrivilegeSeparation yes as so:</div><div> </div><div> Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3</div><div> UsePrivilegeSeparation yes </div><div> </div><div>then this UsePrivilegeSeparation will not apply to all users & hosts (as desired), but only to the user specified in the Match block condition.</div><div> </div><div>In a nutshell, I think that's the problem with augeas dealing with a Match block. </div><div> </div><div>Is this a partial solution?:</div><div> </div><div>If you restrict augeas so that every match block it writes and every Match block it parses ends with a line:</div><div> </div><div>Match All</div><div> </div><div>to close an existing Match block, That is if you have this:</div><div> </div><div> Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3</div><div> Match All</div><div> </div><div> and you want augeaus to add UsePrivilegeSeparation yes as so: </div><div> </div><div> Match User servicepptprdvra</div><div> MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3</div><div> Match All</div><div> UsePrivilegeSeparation yes </div><div> </div><div>Then this UsePrivilegeSeparation will be applied to all users & hosts, as desired.</div><div> </div><div>This is a small restriction on the sshd_config syntax when using augeas, but not egregiously so.</div><div> </div><div>Spike White</div><div> </div></div></div></div></blockquote></div>