How can I make CFEngine report PermitRootLogin from sshd_config as part of Inventory?

[olehermanse]

I'd like to parse system sshd config, store the PermitRootLogin value in a CFEngine variable, and make CFEngine report that variable to the hub, so I can see it in inventory and make alerts / compliance checks around it. I guess it should be a string with values yes, no, or without-password.

The CFEngine docs show me how to tag a variable for inventory, so I guess something like this:

bundle agent main
{
  vars:
    "sshd_permit_root_login"
      string => "???",
      meta => { "inventory", "attribute_name=SSHD PermitRootLogin" };
}

What would I use to get the data that I want? Does the standard library or the built in functions include functionality to make it easy to parse sshd config? Could someone give me an example?

[nickanderson]

Hi @olehermanse

There are a few functions that come to mind with respect to parsing text. \

• data_readstringarray
• data_readstringarrayidx
• readstringarray
• readstringarrayidx
• data_regextract
• parsestringarray
• parsestringarrayidx
• regextract

Of these, the first two are the ones I most commonly use. For cases where you have a unique key you can use data_readstringarray(), for cases where you might have the same key multiple times you will probably want to use data_readstringarrayidx(). I am going to ignore the match feature for sshd and assume unique keys for this file, that is to say if you have PermitRootLogin multiple times, the last one will win.

bundle agent example_parse_and_inventory_sshd_config_PermitRootLogin
{
  vars:
      "_sshd_config_file" string => "/etc/ssh/sshd_config";
      "_sshd_conf"
        data => data_readstringarray( $(_sshd_config_file), # File to read
                                      "\s+#[^\n]*", # Regex to exclude lines
                                      "\s+",    # Regex matching key value separator
                                      inf,      # maximum number of keys
                                      inf);     # max number of bytes to read from file

    # Inventory the PermitRootLogin value, or note that it is Undefined if we can't find it.
      "sshd_config_PermitRootLogin"
        string => ifelse( isvariable( "_sshd_conf[PermitRootLogin]"), "$(_sshd_conf[PermitRootLogin])",
                          "Undefined" ),
        meta => { "inventory", "attribute_name=$(_sshd_config_file) PermitRootLogin Value" };
}
bundle agent __main__
{
  methods:
    "example_parse_and_inventory_sshd_config_PermitRootLogin";
}    

# cf-agent --no-lock --log-level info --show-evaluated-vars=default:example_parse_and_inventory_sshd_config\. --file /tmp/example_parse_and_inventory_sshd_config_PermitRootLogin.cf
Variable name                            Variable value                                               Meta tags                               
default:example_parse_and_inventory_sshd_config_PermitRootLogin._sshd_conf {"#":["$OpenBSD:","sshd_config,v","1.103","2018/04/09","20:41:22","tj","Exp","$"],"AcceptEnv":["LANG","LC_*"],"ChallengeResponseAuthentication":["no"],"Include":["/etc/ssh/sshd_config.d/*.conf"],"PrintMotd":["no"],"Subsystem":["sftp","/usr/lib/openssh/sftp-server"],"UsePAM":["yes"],"X11Forwarding":["yes"]} source=promise                          
default:example_parse_and_inventory_sshd_config_PermitRootLogin._sshd_config_file /etc/ssh/sshd_config                                         source=promise                          
default:example_parse_and_inventory_sshd_config_PermitRootLogin.sshd_config_PermitRootLogin Undefined                                                    source=promise,inventory,attribute_name=/etc/ssh/sshd_config PermitRootLogin Value

In the example above:

1. We define _sshd_config_file as a string holding the path to the configuration file.
2. We define _sshd_conf as a data container as the result of parsing the configuration file with data_readstringarray().
3. We define a variable sshd_config_PermitRootLogin holding the value of
   PermitRootLogin or Undefined if we didn't find it in the data container
   and tag the variable for Inventory.

[olehermanse]

Thank you, that works!

I ended up modifying your example slightly, this is now in my /var/cfengine/masterfiles/services/main.cf:

bundle agent parse_and_inventory_sshd_config_PermitRootLogin
{
  vars:
    # Create a variable and Inventory attribute for sshd_config:
    "_sshd_config_file"
      string => "/etc/ssh/sshd_config",
      if => fileexists("/etc/ssh/sshd_config"), # Only report if it exists
      meta => { "inventory", "attribute_name=Configuration file for sshd" };

    # Parse contents of sshd_config
    "_sshd_conf"
      data => data_readstringarray( $(_sshd_config_file), # Filename
                                    "\s+#[^\n]*",         # Exclude lines
                                    "\s+",    # Key/value separator
                                    inf,      # max number of keys
                                    inf);     # max number of bytes

    # Inventory the PermitRootLogin value, if we found it:
    "sshd_config_PermitRootLogin"
      string => "$(_sshd_conf[PermitRootLogin])",
      if => isvariable( "_sshd_conf[PermitRootLogin]"),
      meta => { "inventory", "attribute_name=PermitRootLogin" };
}

bundle agent main
{
  methods:
    "parse_and_inventory_sshd_config_PermitRootLogin";
} 

This gives me a nice report in Mission Portal:

[tzz]

You may also be interested in sshd -T which outputs a more parseable format:

% sudo sshd -T|grep -i permitrootlogin
permitrootlogin without-password

It won't show every Match case, you have to use -C to trigger specific overrides:

     -C connection_spec
             Specify the connection parameters to use for the -T extended test mode.  If provided, any Match directives in the configuration file that would apply are applied before the configuration is written to standard output.  The connection
             parameters are supplied as keyword=value pairs and may be supplied in any order, either with multiple -C options or as a comma-separated list.  The keywords are “addr,” “user”, “host”, “laddr”, “lport”, and “rdomain” and correspond to
             source address, user, resolved source host name, local address, local port number and routing domain respectively.

[olehermanse]

That is great to know about, indeed! TIL :) Thanks!

[nickanderson]

NICE, you beat me to it. thanks