Now we can take a look at something perhaps a little bit more useful
by looking at how we can have a manifest that restarts services after
we've edited the SSHD configuration.
So let's get our engines started for our last demonstration, a
demonstration where we can look at how we can edit existing configuration
files and restart the associated services. So we're going to begin by
copying across that header line into a new manifest. It just saves me
having to write out that first line again.
So we'll call the manifest noroot.pp, and we can look at ensuring that we are
stopping the root user logging in via SSH. When we take a look at the current
settings, so when we grep for PermitRoot from /etc/ssh/sshd_config, the
default setting here is being read by the commented line where we're not
allowing password‑based authentication by root, but we want to stop root
login via SSH full stop, so we want PermitRootLogin no. So we're going to do
that through our manifest, and we can ensure this then across multiple
machines where we're running this on a Puppet server. As we add here our file,
even though we don't particularly need to manage the service,
we're going to put in a service resource. This allows me to restart a
service if the file is changed. So we can go through and put in our sshd
service and the associated properties. We only need to worry about this in a
normal sense, so ensure, big arrow, and running. I don't need to worry about
restarted or anything like that.
So we can just say that we want to make sure that the service
is running, and then we can go through and enable and have this
set to the Boolean value of true.
So we don't need to quote the Boolean values. As we're putting in
multiple entries, we're just comma‑separating each entry, but that
can include the last entry as well.
Now the next resource we're putting in is the file_line resource.
This comes from the standard library, which we've already installed through a
dependency with our Apache module. We can say root_ssh; that really is just a
label to act as the name, and we're going to be working with /etc, /ssh, and
the sshd_config. So this is going to be our path property, again,
comma‑separating each of them. We want to ensure that the line is present.
We're not really checking that a file is present; we're checking that the line
is present, and the line that we want to look for is going to be then our
PermitRootLogin no.
And again, just to ensure you're putting it in the right case.
So PermitRootLogin and no. Now, just in case the line is
already set, and it might be set to yes,
we need to edit that line, so we can check for existing lines, so
those lines that begin with PermitRootLogin.
Currently, we don't have any that begin with
PermitRootLogin, so we'll just add the line.
The clever thing is then notify. With notify,
we can then specify the service that we need to notify, and we'll
restart the service. So service and then the name of the service,
sshd. We're just about done on this so we can close off our
file_line resource, double‑check everything looks okay, but of
course, just because it looks okay,
doesn't mean it will be okay, so let's use our puppet parser
validate and our noroot.pp. And again, no output is good output.
Again, I'm not worried about the Ruby warnings that we're getting.
So now we're ready to apply our file, so sudo and puppet apply,
noroot.pp, and then we'll look at just redirecting those Ruby warnings,
and give this a whirl. So we can see there again that things have
changed, that we've created that new line,
we've refreshed our server, so we've restarted our server service for the
SSH daemon, and we're able then to go through and search for PermitRoot
again, and we can see now we've got the new line,
PermitRootLogin no.
So this is really powerful, being able to change existing configuration
files without having to send the whole file down.
But let's return to our slides so we might summarize just a little of what we've looked at with Puppet.