<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=ProgId content=Word.Document><meta name=Generator content="Microsoft Word 15"><meta name=Originator content="Microsoft Word 15"><link rel=File-List href="cid:filelist.xml@01D73A81.2946D8A0"><style></style></head><body lang=DE link=blue vlink=purple style='tab-interval:35.4pt'><div class=WordSection1>Hi Spike.<o:p></o:p><o:p> </o:p>> The point is -- in general, augeas barfs whenever there's a Match block. With the lens file that ships with augtool. (This is documented in the lens file.)<o:p></o:p><o:p> </o:p>What version of Augeas are you using? My version, 1.8.1 has a different documentation in the lens file:<o:p></o:p><o:p> </o:p>“””<o:p></o:p>About: CAVEATS<o:p></o:p><o:p> </o:p> In sshd_config, Match blocks must be located at the end of the file.<o:p></o:p> This means that any new "global" parameters (i.e. outside of a Match<o:p></o:p> block) must be written before the first Match block. By default,<o:p></o:p> Augeas will write new parameters at the end of the file.<o:p></o:p><o:p> </o:p> I.e. if you have a Match section and no ChrootDirectory parameter,<o:p></o:p> this command:<o:p></o:p><o:p> </o:p> > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"<o:p></o:p><o:p> </o:p> will be stored in a new node after the Match section and Augeas will<o:p></o:p> refuse to save sshd_config file.<o:p></o:p><o:p> </o:p> To create a new parameter as the right place, you must first create<o:p></o:p> a new Augeas node before the Match section:<o:p></o:p><o:p> </o:p> > ins ChrootDirectory before /files/etc/ssh/sshd_config/Match<o:p></o:p><o:p> </o:p> Then, you can set the parameter<o:p></o:p><o:p> </o:p> > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"<o:p></o:p>“””<o:p></o:p><o:p> </o:p>No mention of a general problem that the lens could not handle, except for ensuring that all Match blocks are positioned at the end of the file. And, as Dan said, there are tools to handle such situations easier. In our case, we also have Puppet to manage (open-)ssh, though we employ basic erb-templates, which don’t have the same pitfalls as Augeas.<o:p></o:p><o:p> </o:p>Ciao,<o:p></o:p>Xavier.<o:p></o:p><o:p> </o:p><o:p> </o:p>Von: Spike White <spikewhitetx@gmail.com> Gesendet: Samstag, 24. April 2021 21:30 An: Mol, Xavier (SCC) <xavier.mol@kit.edu> Cc: augeas-devel@redhat.com Betreff: Re: [augeas-devel] Partial answer to augeas not being able to parse / deal with sshd_config Match blocks...<o:p></o:p><o:p> </o:p><div>Xavier,<o:p></o:p><div><o:p> </o:p></div><div>The point is -- in general, augeas barfs whenever there's a Match block. With the lens file that ships with augtool. (This is documented in the lens file.)<o:p></o:p></div><div><o:p> </o:p></div><div>That's a problem for a general-purpose parsing of a sshd_config file, when you don't know a priori whether the sshd_config file has a Match block or not.<o:p></o:p></div><div><o:p> </o:p></div><div>Yes, there are some exotic edge cases in which augeas can tolerate Match blocks. I've found 1-2 myself. But in the main, the lens file doesn't tolerate Match blocks.<o:p></o:p></div><div><o:p> </o:p></div><div>I was proposing a miniscule restriction to the sshd_config syntax that should allow the lens file to be embellished to handle Match blocks.<o:p></o:p></div><div><o:p> </o:p></div><div>Spike<o:p></o:p></div></div><o:p> </o:p><div><div>On Fri, Apr 23, 2021 at 2:06 AM Mol, Xavier (SCC) <<a href="mailto:xavier.mol@kit.edu">xavier.mol@kit.edu</a>> wrote:<o:p></o:p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;mso-border-left-alt:solid #CCCCCC .75pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div>Hi Spike,<o:p></o:p> <o:p></o:p>I don’t know your use case, but wouldn’t it be easier to tell Augeas to add UsePrivilegeSeparation before the first Match block?<o:p></o:p> <o:p></o:p>augtool> ins UsePrivilegeSeparation before /files/etc/ssh/sshd_config/Match[1]<o:p></o:p>augtool> set /files/etc/ssh/sshd_config/UsePrivilegeSeparation yes<o:p></o:p> <o:p></o:p>Of course, this doesn’t work out anymore when you are not sure UsePrivilegeSeparation wasn’t set before already. sshd_config will be correct anyway, but this approach would add another ‘UsePrivilegeSeparation = yes’ line every time.<o:p></o:p> <o:p></o:p>Ciao,<o:p></o:p>Xavier.<o:p></o:p> <o:p></o:p>Von: <a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a> <<a href="mailto:augeas-devel-bounces@redhat.com" target="_blank">augeas-devel-bounces@redhat.com</a>> Im Auftrag von Spike White Gesendet: Donnerstag, 22. April 2021 20:00 An: <a href="mailto:augeas-devel@redhat.com" target="_blank">augeas-devel@redhat.com</a> Betreff: [augeas-devel] Partial answer to augeas not being able to parse / deal with sshd_config Match blocks...<o:p></o:p> <o:p></o:p><div>Augeas people,<o:p></o:p><div> <o:p></o:p></div><div>augeas has a problem dealing with Match blocks in /etc/ssh/sshd_config. It's even documented in the notes in the lens file for that file.<o:p></o:p></div><div> <o:p></o:p></div><div>I know that a general purpose parsing of a Match block in augeas is a problem. I've tried. The problem is that augeas by default appends new lines (where they're missing in original file) to the end of the file.<o:p></o:p></div><div> <o:p></o:p></div><div>Thus if you have an existing Match block at the end of the sshd_config file such as:<o:p></o:p></div><div> <o:p></o:p></div><div>Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3<o:p></o:p></div><div> <o:p></o:p></div><div>and you want augeaus to add UsePrivilegeSeparation yes as so:<o:p></o:p></div><div> <o:p></o:p></div><div> Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3<o:p></o:p></div><div> UsePrivilegeSeparation yes <o:p></o:p></div><div> <o:p></o:p></div><div>then this UsePrivilegeSeparation will not apply to all users & hosts (as desired), but only to the user specified in the Match block condition.<o:p></o:p></div><div> <o:p></o:p></div><div>In a nutshell, I think that's the problem with augeas dealing with a Match block. <o:p></o:p></div><div> <o:p></o:p></div><div>Is this a partial solution?:<o:p></o:p></div><div> <o:p></o:p></div><div>If you restrict augeas so that every match block it writes and every Match block it parses ends with a line:<o:p></o:p></div><div> <o:p></o:p></div><div>Match All<o:p></o:p></div><div> <o:p></o:p></div><div>to close an existing Match block, That is if you have this:<o:p></o:p></div><div> <o:p></o:p></div><div> Match User servicepptprdvra MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3<o:p></o:p></div><div> Match All<o:p></o:p></div><div> <o:p></o:p></div><div> and you want augeaus to add UsePrivilegeSeparation yes as so: <o:p></o:p></div><div> <o:p></o:p></div><div> Match User servicepptprdvra<o:p></o:p></div><div> MaxSessions 999 ClientAliveInterval 360 ClientAliveCountMax 3<o:p></o:p></div><div> Match All<o:p></o:p></div><div> UsePrivilegeSeparation yes <o:p></o:p></div><div> <o:p></o:p></div><div>Then this UsePrivilegeSeparation will be applied to all users & hosts, as desired.<o:p></o:p></div><div> <o:p></o:p></div><div>This is a small restriction on the sshd_config syntax when using augeas, but not egregiously so.<o:p></o:p></div><div> <o:p></o:p></div><div>Spike White<o:p></o:p></div><div> <o:p></o:p></div></div></div></div></blockquote></div></div></body></html>