Skip to content

Commit

Permalink
Don't remediate when it is inappropriate
Browse files Browse the repository at this point in the history
Don't remediate when the config file already contains the include
directive.
  • Loading branch information
matejak committed Aug 3, 2021
1 parent df45c3f commit a3ec49f
Showing 1 changed file with 5 additions and 2 deletions.
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
# platform = multi_platform_all

{{% set target_file = "/etc/ssh/sshd_config.d/sshd_config_original.conf" -%}}
{{% set base_config = "/etc/ssh/sshd_config" -%}}
if test -f {{{ target_file}}}; then
{{{ die("Remediation probably already happened, '" ~ target_file ~ "' already exists, not doing anything.", action="false") }}}
elif grep -Eq '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf' {{{ base_config }}} && ! grep -Eq '^\s*Match\s' {{{ base_config }}}; then
{{{ die("Remediation probably already happened, '" ~ base_config ~ "' already contains the include directive.", action="false") }}}
else
mkdir -p /etc/ssh/sshd_config.d
mv /etc/ssh/sshd_config {{{ target_file }}}
cat > /etc/ssh/sshd_config << EOF
mv {{{ base_config }}} {{{ target_file }}}
cat > {{{ base_config }}} << EOF
# To modify the system-wide sshd configuration, create a *.conf file under
# /etc/ssh/sshd_config.d/ which will be automatically included below
Expand Down

0 comments on commit a3ec49f

Please sign in to comment.