Re: select_region regex not working since upgrade to 3.18.1

hi nick,

the concept of an "anchor" is nice, but aix does only allow valid stanzas 
in its config files. so adding unknown stanzas is not possible as the file 
will be invalitaded by aix.

format of pwdalg.cfg with added explanations:


ssha512:  --> stanzaname
        lpa_module = /usr/lib/security/ssha -->stanzaattribute
        lpa_options = algorithm=sha512 --> stanzaattribute

sblowfish: --> stanzaname 
        lpa_module = /usr/lib/security/sblowfish  --> stanzaattribute 

the task is to add the new stanza if  it is not there and add the given 
attributes :

sshaitsv:
        lpa_module = /usr/lib/security/ssha
        lpa_options = algorithm=sha512,cost_num=10,salt_len=24

same with the login.cfg example.

usw: --> stanzaname
        shells = 
/bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd,/usr/bin/bash
        maxlogins = 32767
        logintimeout = 60
        maxroles = 8
        auth_type = STD_AUTH
        pwd_algorithm = sshaitsv --> add this attribute if missing
        unix_passwd_compat = true

this alls was ok with 3.15.4 but fails in 3.18.1.

anyway, as i silently dislike this messy regex/fileedit disaster  i 
refactored the policy to use aix chsec command to modify these files.


new promise: 
bundle agent set_passwd_algo
{

    classes:
        "pwdalg_mod_ok"  expression => returnszero("/usr/bin/lssec -f 
/etc/security/pwdalg.cfg -s sshaitsv -a lpa_module  | /usr/bin/grep -q 
'lpa_module=/usr/lib/security/ssha'", "useshell");
        "pwdalg_opts_ok" expression => returnszero("/usr/bin/lssec -f 
/etc/security/pwdalg.cfg -s sshaitsv -a lpa_options  | /usr/bin/grep -q 
'algorithm=sha512,cost_num=10,salt_len=24'", "useshell");
        "logincfg_ok"  expression => returnszero("/usr/bin/lssec -f 
/etc/security/login.cfg -s usw -a pwd_algorithm | /usr/bin/grep -q 
'sshaitsv'", "useshell");

    commands:


        "/usr/bin/chsec"    arglist => { "-f /etc/security/pwdalg.cfg", "-s 
sshaitsv", "-a", "lpa_module=\"/usr/lib/security/ssha\"" },
                            contain => in_shell,
                            if      => not("pwdalg_mod_ok"),
                            classes => if_repaired("pwdalg_mod_changed"),
                            comment => "set system auth options";

        "/usr/bin/chsec"    arglist => { "-f /etc/security/pwdalg.cfg", "-s 
sshaitsv", "-a", "lpa_options=\"algorithm=sha512,cost_num=10,salt_len=24\"" 
},
                            contain => in_shell,
                            if      => not("pwdalg_opts_ok"),
                            classes => if_repaired("pwdalg_opts_changed"),
                            comment => "set system auth options";

        "/usr/bin/chsec"    arglist => { "-f /etc/security/login.cfg", "-s 
usw", "-a", "pwd_algorithm=\"sshaitsv\"" },
                            contain => in_shell,
                            if      => not("logincfg_ok"),
                            classes => if_repaired("logincfg_changed"),
                            comment => "set system auth options";


    reports:

        pwdalg_mod_changed|pwdalg_opts_changed::

            "Time: $(sys.date) -  Bundle: $(this.bundle) - Message: 
pwdalg.cfg modified.";

        logincfg_changed::

             "Time: $(sys.date) -  Bundle: $(this.bundle) - Message: 
login.cfg modified.";
}


much cleaner und understandable....as this stanza edit library nightmare is 
only used in about four policys i will try get rid if it completely.

wbr 

chris



On Friday, February 4, 2022 at 8:29:33 PM UTC+1 Nick Anderson wrote:

> Xander Cage <[email protected]> writes: 
>
> hi, 
>>
>> i have this rather complex file edit stuff for aix stanza file editing 
>> and since upgrading to 3.18.1 yesterday, it acts weird. …. not sure whats 
>> wrong here, something changed in 3.18 maybe? 
>>
> Hi Chris, 
>
> The policy you posted didn't have anything to initalize the configuration 
> files I believe the issue is related to being unable to select the *last* 
> section as it seems to work if I add another section (more:) during 
> initialization. So, I think you will need to inject a dummy section. 
> Listing 1: Additional policy
>
> bundle agent init
>  {
>    files:
>
>        "/tmp/pwdalg_cfg_test.cfg"
>          content => "sshaitsv:$(const.n)more:";
>
>        "/tmp/cfe_testbed/." create => "true";
>
>        "/tmp/cfe_testbed/login_cfg_test.cfg"
>          content => "sshaitsv:$(const.n)more:";
>  }      
>  bundle agent post 
>  {
>    reports:
>        "/tmp/pwdalg_cfg_test.cfg"
>          printfile => cat( $(this.promiser) );
>        "/tmp/cfe_testbed/login_cfg_test.cfg"
>          printfile => cat( $(this.promiser) );
>  }      
>
> I also tweaked your main bundle to run the init and post. 
> Listing 2: Tweaked
>
> bundle agent __main__{
>   methods:
>       "init";
>       "parent_bundle";
>       "post";}
>
> I get this output which I think shows what you wanted (sans the more: 
> line). 
>
>
>     info: Updated content of '/tmp/pwdalg_cfg_test.cfg' with content 'sshaitsv:
> more:'
>     info: Created directory '/tmp/cfe_testbed/.'
>     info: Updated content of '/tmp/cfe_testbed/login_cfg_test.cfg' with content 'sshaitsv:
> more:'
>     info: Inserted the promised line '   lpa_module = /usr/lib/security/ssha' into '/tmp/pwdalg_cfg_test.cfg' after locator
>     info: insert_lines promise '   lpa_module = /usr/lib/security/ssha' repaired
>     info: Edited file '/tmp/pwdalg_cfg_test.cfg'
>     info: Inserted the promised line '   lpa_options = algorithm=sha512,cost_num=10,salt_len=24' into '/tmp/pwdalg_cfg_test.cfg' after locator
>     info: insert_lines promise '   lpa_options = algorithm=sha512,cost_num=10,salt_len=24' repaired
>     info: Edited file '/tmp/pwdalg_cfg_test.cfg'
>    error: The promised end pattern '^(\h*|\H+:)$' was not found when selecting region to insert in '/tmp/cfe_testbed/login_cfg_test.cfg'
>    error: The promised end pattern '^(\h*|\H+:)$' was not found when selecting region to insert in '/tmp/cfe_testbed/login_cfg_test.cfg'
>    error: The promised end pattern '^(\h*|\H+:)$' was not found when selecting region to insert in '/tmp/cfe_testbed/login_cfg_test.cfg'
>     info: Inserted the promised line 'usw:' into '/tmp/cfe_testbed/login_cfg_test.cfg' after locator
>     info: insert_lines promise 'usw:' repaired
>     info: Edited file '/tmp/cfe_testbed/login_cfg_test.cfg'
>    error: The promised end pattern '^(\h*|\H+:)$' was not found when selecting region to insert in '/tmp/cfe_testbed/login_cfg_test.cfg'
>    error: The promised end pattern '^(\h*|\H+:)$' was not found when selecting region to insert in '/tmp/cfe_testbed/login_cfg_test.cfg'
> R: /tmp/pwdalg_cfg_test.cfg
> R: sshaitsv:
> R:    lpa_module = /usr/lib/security/ssha
> R:    lpa_options = algorithm=sha512,cost_num=10,salt_len=24
> R: more:
> R: /tmp/cfe_testbed/login_cfg_test.cfg
> R: sshaitsv:
> R: more:
> R: usw:
>
>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/023d0fdb-5014-404b-a409-83dac40e43c2n%40googlegroups.com.