position parameter does not work

[mmarod]

I have tried using both XPath and default forms for declaring positions and neither seem to work. I also tried declaring the position param as 'after' on the second pam resource below but that also did not work.

Using Debian 7 / Puppet 3.7.3

    pam { "Set cracklib limits in common-password.":
      ensure    => present,
      service   => 'common-password',
      type      => 'password',
      control   => 'required',
      module    => 'pam_cracklib.so',
      arguments => [ 'retry=3', 'minlen=8', 'difok=3' ],
      position  => 'before module pam_unix.so'
    }

    pam { "Set unix options in common-password":
      ensure    => present,
      service   => 'common-password',
      type      => 'password',
      control   => 'required',
      module    => 'pam_unix.so',
      arguments => [ 'use_authtok', 'nullok', 'md5', 'remember=6' ],
    }

The output of this is...

password    required    pam_unix.so use_authtok nullok  md5 remember=6
password    required    pam_cracklib.so retry=3 minlen=8    difok=3

[raphink]

If the entry already exists, ensure => present will not relocate it, you
need ensure => positioned

On Thu, 7 May 2015 22:31 Michael Marod [email protected] wrote:

I have tried using both XPath and default forms for declaring positions
and neither seem to work. I also tried declaring the position param as
'after' on the second pam resource below but that also did not work.

Using Debian 7 / Puppet 3.7.3

pam { "Set cracklib limits in common-password.":
  ensure    => present,
  service   => 'common-password',
  type      => 'password',
  control   => 'required',
  module    => 'pam_cracklib.so',
  arguments => [ 'retry=3', 'minlen=8', 'difok=3' ],
  position  => 'before module pam_unix.so'
}

pam { "Set unix options in common-password":
  ensure    => present,
  service   => 'common-password',
  type      => 'password',
  control   => 'required',
  module    => 'pam_unix.so',
  arguments => [ 'use_authtok', 'nullok', 'md5', 'remember=6' ],
}

The output of this is...

password required pam_unix.so use_authtok nullok md5 remember=6
password required pam_cracklib.so retry=3 minlen=8 difok=3

—
Reply to this email directly or view it on GitHub
#3.

[mmarod]

Ah ok -- Well I tried positioned and am getting this error...

# puppet agent -t
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Loading facts
Info: Caching catalog for baseline....
Info: Applying configuration version '1431032288'
Error: undefined method `in_position?' for Pam[Set cracklib limits in common-password.](provider=augeas):Puppet::Type::Pam::ProviderAugeas
Error: /Stage[main]/Main/Pam[Set cracklib limits in common-password.]/ensure: change from present to positioned failed: undefined method `in_position?' for Pam[Set cracklib limits in common-password.](provider=augeas):Puppet::Type::Pam::ProviderAugeas
Error: undefined method `in_position?' for Pam[Set unix options in common-password.](provider=augeas):Puppet::Type::Pam::ProviderAugeas
Error: /Stage[main]/Main/Pam[Set unix options in common-password.]/ensure: change from present to positioned failed: undefined method `in_position?' for Pam[Set unix options in common-password.](provider=augeas):Puppet::Type::Pam::ProviderAugeas

I have version 2.1.1 of the augeasproviders_core module and 4.6.0 of puppetlabs/stdlib and pluginsync is enabled... Any idea which module has the in_position? function?

[raphink]

That is quite weird. in_position? is present in lib/puppet/provider/pam/augeas.rb though, so it should be picked up.

[necrolyte2]

I seem to have a similar issue trying to insert pam line at the end of account chain

With both cases below, the line was added to the end of the file instead of where I expected

Tried this:

    pam { "puppet_pam_auth":
        ensure      => positioned,
        service     => 'sshd',
        type        => 'account',
        control     => 'sufficient',
        module      => 'pam_pbssimpleauth.so',
        position    => 'before *[type="session"]'
    }

Then tried this with same result:

    pam { "puppet_pam_auth":
        ensure      => positioned,
        service     => 'sshd',
        type        => 'account',
        control     => 'sufficient',
        module      => 'pam_pbssimpleauth.so',
        position    => 'before module pam_selinux.so'
    }

Result from both:

#%PAM-1.0
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth
account sufficient      pam_pbssimpleauth.so

[Heidistein]

Sor, arriving on debian 11, puppet 7.10 seeing this issue. I like to tinker around with stuff, but this one I have no idea where to start. Lenses are a big voodoo for me.

Edit: Sorry, this was my own wrongdoing. I had a mix of old modules and camptocamp augeas, augeasproviders_core and a big mess. Apology.