[Puppet Users] Augeas pam.d argument checking

Ed
2010-02-18T13:40:47Z

I''m trying to change the password complexity requirements in
pam.d/system-auth using augeas. I can append the values (lcredit=-1,
ucredit=-1, etc) onto the correct place, but if another value is
already present (i.e. lcredit=-2), the onlyif match statement doesn''t
seem to support checking regular expressions inside of strings. How do
I check that any numeric value exists in the argument??

        define passwordcomplexity($lowercase = "1", $uppercase =
"1",
$numeric = "1", $special = "1") {
                augeas { "add_lowercase_reqs" :
                        context => "/files/etc/pam.d",
                        changes => "set
system-auth/*[module=''pam_cracklib.so'']/argument[last()+1]
lcredit=-$lowercase",
                        onlyif => "match
system-auth/*[argument=''lcredit=*''] size == 0",
                }
                augeas { "add_uppercase_reqs" :
                        context => "/files/etc/pam.d",
                        changes => "set
system-auth/*[module=''pam_cracklib.so'']/argument[last()+1]
ucredit=-$uppercase",
                        onlyif => "match
system-auth/*[argument=''ucredit=*''] size == 0",
                }
                augeas { "add_numeric_reqs" :
                        context => "/files/etc/pam.d",
                        changes => "set
system-auth/*[module=''pam_cracklib.so'']/argument[last()+1]
dcredit=-$numeric",
                        onlyif => "match
system-auth/*[argument=''dcredit=*''] size == 0",
                }
                augeas { "add_special_reqs" :
                        context => "/files/etc/pam.d",
                        changes => "set
system-auth/*[module=''pam_cracklib.so'']/argument[last()+1]
ocredit=-$special",
                        onlyif => "match
system-auth/*[argument=''ocredit=*''] size == 0",
                }
        }

This will continuously append lcredit=-2, etc onto the end of the
line, without checking the values that currently exist:

----------------------------------------------------
password    requisite     pam_cracklib.so try_first_pass retry=3
maxrepeat=3    lcredit=-2      ocredit=-2      dcredit=-2
ucredit=-2      dcredit=-2      ocredit=-2      lcredit=-2
ucredit=-2
-----------------------------------------------------


~Ed