From 1c936bb38d39b238001364e1a7ee5479bdfff053 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:01:57 +0100
Subject: [PATCH] Sshd: revert Sshd module to 1.1.0-compatible, add Sshd_140
In order to keep the default sshd config lens compatible with 1.1.0,
the lens from 1.4.0 has been kept in the Sshd_140 module and is not
loaded by default. Use aug_transform, augtool --transform etc. to use
it instead of Sshd.
---
lenses/sshd.aug | 52 +++++-------
lenses/sshd_140.aug | 141 +++++++++++++++++++++++++++++++++
lenses/tests/test_sshd.aug | 56 -------------
lenses/tests/test_sshd_140.aug | 136 +++++++++++++++++++++++++++++++
tests/Makefile.am | 1 +
5 files changed, 298 insertions(+), 88 deletions(-)
create mode 100644 lenses/sshd_140.aug
create mode 100644 lenses/tests/test_sshd_140.aug
diff --git a/lenses/sshd.aug b/lenses/sshd.aug
index 55f6c4f7..785102ec 100644
--- a/lenses/sshd.aug
+++ b/lenses/sshd.aug
@@ -70,55 +70,41 @@ module Sshd =
let sep = Util.del_ws_spc
- let indent = del /[ \t]*/ " "
-
let key_re = /[A-Za-z0-9]+/
- - /MACs|Match|AcceptEnv|Subsystem|Ciphers|KexAlgorithms|(Allow|Deny)(Groups|Users)/i
+ - /MACs|Match|AcceptEnv|Subsystem|(Allow|Deny)(Groups|Users)/
let comment = Util.comment
- let comment_noindent = Util.comment_noindent
let empty = Util.empty
- let array_entry (kw:regexp) (sq:string) =
+ let array_entry (k:string) =
let value = store /[^ \t\n]+/ in
- [ key kw . [ sep . seq sq . value]* . eol ]
+ [ key k . [ sep . seq k . value]* . eol ]
let other_entry =
let value = store /[^ \t\n]+([ \t]+[^ \t\n]+)*/ in
[ key key_re . sep . value . eol ]
- let accept_env = array_entry /AcceptEnv/i "AcceptEnv"
+ let accept_env = array_entry "AcceptEnv"
- let allow_groups = array_entry /AllowGroups/i "AllowGroups"
- let allow_users = array_entry /AllowUsers/i "AllowUsers"
- let deny_groups = array_entry /DenyGroups/i "DenyGroups"
- let deny_users = array_entry /DenyUsers/i "DenyUsers"
+ let allow_groups = array_entry "AllowGroups"
+ let allow_users = array_entry "AllowUsers"
+ let deny_groups = array_entry "DenyGroups"
+ let deny_users = array_entry "DenyUsers"
let subsystemvalue =
let value = store (/[^ \t\n](.*[^ \t\n])?/) in
[ key /[A-Za-z0-9\-]+/ . sep . value . eol ]
let subsystem =
- [ key /Subsystem/i . sep . subsystemvalue ]
+ [ key "Subsystem" . sep . subsystemvalue ]
- let list (kw:regexp) (sq:string) =
- let value = store /[^, \t\n]+/ in
- [ key kw . sep .
- [ seq sq . value ] .
- ([ seq sq . Util.del_str "," . value])* .
+ let macs =
+ let mac_value = store /[^, \t\n]+/ in
+ [ key "MACs" . sep .
+ [ seq "macs" . mac_value ] .
+ ([ seq "macs" . Util.del_str "," . mac_value])* .
eol ]
- let macs = list /MACs/i "MACs"
-
- let ciphers = list /Ciphers/i "Ciphers"
-
- let kexalgorithms = list /KexAlgorithms/i "KexAlgorithms"
-
- let entry = accept_env | allow_groups | allow_users
- | deny_groups | subsystem | deny_users
- | macs | ciphers | kexalgorithms
- | other_entry
-
let condition_entry =
let value = store /[^ \t\n]+/ in
[ sep . key /[A-Za-z0-9]+/ . sep . value ]
@@ -126,15 +112,17 @@ module Sshd =
let match_cond =
[ label "Condition" . condition_entry+ . eol ]
- let match_entry = indent . (entry | comment_noindent)
- | empty
+ let match_entry =
+ ( comment | empty | (Util.indent . other_entry) )
let match =
- [ key /Match/i . match_cond
+ [ key "Match" . match_cond
. [ label "Settings" . match_entry+ ]
]
- let lns = (entry | comment | empty)* . match*
+ let lns = (comment | empty | accept_env | allow_groups | allow_users
+ | deny_groups | subsystem | deny_users | macs
+ | other_entry ) * . match*
let xfm = transform lns (incl "/etc/ssh/sshd_config")
diff --git a/lenses/sshd_140.aug b/lenses/sshd_140.aug
new file mode 100644
index 00000000..8a7f176f
--- /dev/null
+++ b/lenses/sshd_140.aug
@@ -0,0 +1,141 @@
+(*
+Module: Sshd_140
+ Parses /etc/ssh/sshd_config
+
+ This module is compatible with Augeas 1.4.0, but is not loaded by default.
+
+Author: David Lutterkort lutter@redhat.com
+ Dominique Dumont dominique.dumont@hp.com
+
+About: Reference
+ sshd_config man page.
+ See http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5
+
+About: License
+ This file is licensed under the LGPL v2+.
+
+About: Lens Usage
+ Sample usage of this lens in augtool:
+
+ * Get your current setup
+ > print /files/etc/ssh/sshd_config
+ ...
+
+ * Set X11Forwarding to "no"
+ > set /files/etc/ssh/sshd_config/X11Forwarding "no"
+
+ More advanced usage:
+
+ * Set a Match section
+ > set /files/etc/ssh/sshd_config/Match[1]/Condition/User "foo"
+ > set /files/etc/ssh/sshd_config/Match[1]/Settings/X11Forwarding "yes"
+
+ Saving your file:
+
+ > save
+
+
+About: CAVEATS
+
+ In sshd_config, Match blocks must be located at the end of the file.
+ This means that any new "global" parameters (i.e. outside of a Match
+ block) must be written before the first Match block. By default,
+ Augeas will write new parameters at the end of the file.
+
+ I.e. if you have a Match section and no ChrootDirectory parameter,
+ this command:
+
+ > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"
+
+ will be stored in a new node after the Match section and Augeas will
+ refuse to save sshd_config file.
+
+ To create a new parameter as the right place, you must first create
+ a new Augeas node before the Match section:
+
+ > ins ChrootDirectory before /files/etc/ssh/sshd_config/Match
+
+ Then, you can set the parameter
+
+ > set /files/etc/ssh/sshd_config/ChrootDirectory "foo"
+
+
+About: Configuration files
+ This lens applies to /etc/ssh/sshd_config
+
+*)
+
+module Sshd_140 =
+ let eol = del /[ \t]*\n/ "\n"
+
+ let sep = Util.del_ws_spc
+
+ let indent = del /[ \t]*/ " "
+
+ let key_re = /[A-Za-z0-9]+/
+ - /MACs|Match|AcceptEnv|Subsystem|Ciphers|KexAlgorithms|(Allow|Deny)(Groups|Users)/i
+
+ let comment = Util.comment
+ let comment_noindent = Util.comment_noindent
+ let empty = Util.empty
+
+ let array_entry (kw:regexp) (sq:string) =
+ let value = store /[^ \t\n]+/ in
+ [ key kw . [ sep . seq sq . value]* . eol ]
+
+ let other_entry =
+ let value = store /[^ \t\n]+([ \t]+[^ \t\n]+)*/ in
+ [ key key_re . sep . value . eol ]
+
+ let accept_env = array_entry /AcceptEnv/i "AcceptEnv"
+
+ let allow_groups = array_entry /AllowGroups/i "AllowGroups"
+ let allow_users = array_entry /AllowUsers/i "AllowUsers"
+ let deny_groups = array_entry /DenyGroups/i "DenyGroups"
+ let deny_users = array_entry /DenyUsers/i "DenyUsers"
+
+ let subsystemvalue =
+ let value = store (/[^ \t\n](.*[^ \t\n])?/) in
+ [ key /[A-Za-z0-9\-]+/ . sep . value . eol ]
+
+ let subsystem =
+ [ key /Subsystem/i . sep . subsystemvalue ]
+
+ let list (kw:regexp) (sq:string) =
+ let value = store /[^, \t\n]+/ in
+ [ key kw . sep .
+ [ seq sq . value ] .
+ ([ seq sq . Util.del_str "," . value])* .
+ eol ]
+
+ let macs = list /MACs/i "MACs"
+
+ let ciphers = list /Ciphers/i "Ciphers"
+
+ let kexalgorithms = list /KexAlgorithms/i "KexAlgorithms"
+
+ let entry = accept_env | allow_groups | allow_users
+ | deny_groups | subsystem | deny_users
+ | macs | ciphers | kexalgorithms
+ | other_entry
+
+ let condition_entry =
+ let value = store /[^ \t\n]+/ in
+ [ sep . key /[A-Za-z0-9]+/ . sep . value ]
+
+ let match_cond =
+ [ label "Condition" . condition_entry+ . eol ]
+
+ let match_entry = indent . (entry | comment_noindent)
+ | empty
+
+ let match =
+ [ key /Match/i . match_cond
+ . [ label "Settings" . match_entry+ ]
+ ]
+
+ let lns = (entry | comment | empty)* . match*
+
+(* Local Variables: *)
+(* mode: caml *)
+(* End: *)
diff --git a/lenses/tests/test_sshd.aug b/lenses/tests/test_sshd.aug
index 5954e16f..788a12f0 100644
--- a/lenses/tests/test_sshd.aug
+++ b/lenses/tests/test_sshd.aug
@@ -1,4 +1,3 @@
-(* Module: Test_sshd *)
module Test_sshd =
let accept_env = "Protocol 2
@@ -75,61 +74,6 @@ Match User sarko Group pres.*
Match User bush Group pres.* Host white.house.*
Banner /etc/welcome.txt\n"
-(* Test: Sshd.lns
- Indent when adding to a Match group *)
- test Sshd.lns put match_blocks after
- set "Match[1]/Settings/PermitRootLogin" "yes";
- set "Match[1]/Settings/#comment" "a comment" =
-"X11Forwarding yes
-Match User sarko Group pres.*
- Banner /etc/bienvenue.txt
- X11Forwarding no
- PermitRootLogin yes
- # a comment
-Match User bush Group pres.* Host white.house.*
-Banner /etc/welcome.txt\n"
-
-
-(* Test: Sshd.lns
- Parse Ciphers and KexAlgorithms as lists (GH issue #69) *)
-test Sshd.lns get "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
-KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n" =
- { "Ciphers"
- { "1" = "aes256-gcm@openssh.com" }
- { "2" = "aes128-gcm@openssh.com" }
- { "3" = "aes256-ctr" }
- { "4" = "aes128-ctr" }
- }
- { "KexAlgorithms"
- { "1" = "diffie-hellman-group-exchange-sha256" }
- { "2" = "diffie-hellman-group14-sha1" }
- { "3" = "diffie-hellman-group-exchange-sha1" }
- }
-
-(* Test: Sshd.lns
- Keys are case-insensitive *)
-test Sshd.lns get "ciPheRs aes256-gcm@openssh.com,aes128-ctr
-maTcH User foo
- x11forwarding no\n" =
- { "ciPheRs"
- { "1" = "aes256-gcm@openssh.com" }
- { "2" = "aes128-ctr" }
- }
- { "maTcH"
- { "Condition"
- { "User" = "foo" }
- }
- { "Settings"
- { "x11forwarding" = "no" }
- }
- }
-
-(* Test: Sshd.lns
- Allow AllowGroups in Match groups (GH issue #75) *)
-test Sshd.lns get "Match User foo
-AllowGroups users\n" =
- { "Match" { "Condition" { "User" = "foo" } }
- { "Settings" { "AllowGroups" { "1" = "users" } } } }
(* Local Variables: *)
(* mode: caml *)
diff --git a/lenses/tests/test_sshd_140.aug b/lenses/tests/test_sshd_140.aug
new file mode 100644
index 00000000..056c53f9
--- /dev/null
+++ b/lenses/tests/test_sshd_140.aug
@@ -0,0 +1,136 @@
+(* Module: Test_sshd_140 *)
+module Test_sshd_140 =
+
+ let accept_env = "Protocol 2
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL\n"
+
+ test Sshd_140.lns get accept_env =
+ { "Protocol" = "2" }
+ { "AcceptEnv"
+ { "1" = "LC_PAPER" }
+ { "2" = "LC_NAME" }
+ { "3" = "LC_ADDRESS" }
+ { "4" = "LC_TELEPHONE" }
+ { "5" = "LC_MEASUREMENT" } }
+ { "AcceptEnv"
+ { "6" = "LC_IDENTIFICATION" }
+ { "7" = "LC_ALL" } }
+
+
+ test Sshd_140.lns get "HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key\n" =
+ { "HostKey" = "/etc/ssh/ssh_host_rsa_key" }
+ { "HostKey" = "/etc/ssh/ssh_host_dsa_key" }
+
+
+ test Sshd_140.lns put accept_env after
+ rm "AcceptEnv";
+ rm "AcceptEnv";
+ set "Protocol" "1.5";
+ set "X11Forwarding" "yes"
+ = "Protocol 1.5\nX11Forwarding yes\n"
+
+ test Sshd_140.lns get "AuthorizedKeysFile %h/.ssh/authorized_keys\n" =
+ { "AuthorizedKeysFile" = "%h/.ssh/authorized_keys" }
+
+ test Sshd_140.lns get "Subsystem sftp /usr/lib/openssh/sftp-server\n" =
+ { "Subsystem"
+ { "sftp" = "/usr/lib/openssh/sftp-server" } }
+
+ test Sshd_140.lns get "Subsystem sftp-test /usr/lib/openssh/sftp-server\n" =
+ { "Subsystem"
+ { "sftp-test" = "/usr/lib/openssh/sftp-server" } }
+
+
+
+ let match_blocks = "X11Forwarding yes
+Match User sarko Group pres.*
+ Banner /etc/bienvenue.txt
+ X11Forwarding no
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt
+"
+ test Sshd_140.lns get match_blocks =
+ { "X11Forwarding" = "yes"}
+ { "Match"
+ { "Condition" { "User" = "sarko" }
+ { "Group" = "pres.*" } }
+ { "Settings" { "Banner" = "/etc/bienvenue.txt" }
+ { "X11Forwarding" = "no" } } }
+ { "Match"
+ { "Condition" { "User" = "bush" }
+ { "Group" = "pres.*" }
+ { "Host" = "white.house.*" } }
+ { "Settings" { "Banner" = "/etc/welcome.txt" } } }
+
+ test Sshd_140.lns put match_blocks after
+ insb "Subsystem" "/Match[1]";
+ set "/Subsystem/sftp" "/usr/libexec/openssh/sftp-server"
+ = "X11Forwarding yes
+Subsystem sftp /usr/libexec/openssh/sftp-server
+Match User sarko Group pres.*
+ Banner /etc/bienvenue.txt
+ X11Forwarding no
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt\n"
+
+(* Test: Sshd_140.lns
+ Indent when adding to a Match group *)
+ test Sshd_140.lns put match_blocks after
+ set "Match[1]/Settings/PermitRootLogin" "yes";
+ set "Match[1]/Settings/#comment" "a comment" =
+"X11Forwarding yes
+Match User sarko Group pres.*
+ Banner /etc/bienvenue.txt
+ X11Forwarding no
+ PermitRootLogin yes
+ # a comment
+Match User bush Group pres.* Host white.house.*
+Banner /etc/welcome.txt\n"
+
+
+(* Test: Sshd_140.lns
+ Parse Ciphers and KexAlgorithms as lists (GH issue #69) *)
+test Sshd_140.lns get "Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
+KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1\n" =
+ { "Ciphers"
+ { "1" = "aes256-gcm@openssh.com" }
+ { "2" = "aes128-gcm@openssh.com" }
+ { "3" = "aes256-ctr" }
+ { "4" = "aes128-ctr" }
+ }
+ { "KexAlgorithms"
+ { "1" = "diffie-hellman-group-exchange-sha256" }
+ { "2" = "diffie-hellman-group14-sha1" }
+ { "3" = "diffie-hellman-group-exchange-sha1" }
+ }
+
+(* Test: Sshd_140.lns
+ Keys are case-insensitive *)
+test Sshd_140.lns get "ciPheRs aes256-gcm@openssh.com,aes128-ctr
+maTcH User foo
+ x11forwarding no\n" =
+ { "ciPheRs"
+ { "1" = "aes256-gcm@openssh.com" }
+ { "2" = "aes128-ctr" }
+ }
+ { "maTcH"
+ { "Condition"
+ { "User" = "foo" }
+ }
+ { "Settings"
+ { "x11forwarding" = "no" }
+ }
+ }
+
+(* Test: Sshd_140.lns
+ Allow AllowGroups in Match groups (GH issue #75) *)
+test Sshd_140.lns get "Match User foo
+AllowGroups users\n" =
+ { "Match" { "Condition" { "User" = "foo" } }
+ { "Settings" { "AllowGroups" { "1" = "users" } } } }
+
+(* Local Variables: *)
+(* mode: caml *)
+(* End: *)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index b4563540..387ac7d2 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -189,6 +189,7 @@ lens_tests = \
lens-squid.sh \
lens-ssh.sh \
lens-sshd.sh \
+ lens-sshd_140.sh \
lens-sssd.sh \
lens-stunnel.sh \
lens-subversion.sh \
--
2.24.1