[Puppet Users] Windows ACL best practise

Thomas Bendler
Tue, 19 Mar 2013 09:42:09 -0000

Hi @all,

I''ve started to extend some classes I wrote with support for Windows.
Unfortunately I got stucked with the ACLs. The plan is (as I thougth) quite
simple, I would like to create a central directory (i.e. c:\managed) and I
would like to put some additional files and directories underneath this
directory (i.e. a repository, a project directory and some programs). The
idea is to have everything related to Puppet in one place. So far, so good,
creating the resources is not a big deal but when it comes to ACLs it
become complicated (at least for me). I''ve wrote a param class with
something like this inside:

# Operating system definitions
case $::osfamily {
  redhat: {
    $osUser = ''root''
    $osGroup = ''root''
    $osFilePermissions = ''0644''
    $osDirectoryPermissions = ''0755''
  }
  windows: {
    $osUser = ''Administrator''
    $osGroup = ''Administrators''
    $osFilePermissions = ''0660''
    $osDirectoryPermissions = ''0770''
  }
}

In the common class I have for Windows something like this:

# Create central manged directory
file {
  "c:\managed":
    ensure => directory,
    mode => "${common::params::osDirectoryPermissions}",
    owner => "${common::params::osUser}",
    group => "${common::params::osGroup}";
}

Now I ran into the first problem, we have english Windows systems as well
as german Windows systems where the administrator group is Administrators
(english) and Administratoren (german). So on german systems, the group is
invalid and all depending stuff is not working because the central
directory isn''t available. Sometimes it''s even worst, the
directory is
created but only the local Administrator can access the directory, neither
local system nor anyone else.

I was thinking about two approaches to solve the problem, first, create
something base on exec with mkdir if directory does not exist and a script
setting the correct ACLs (with inheritance) or second, create a local
puppet group and assign the correct groups to it (what could result in
manual actions because of the language settings). Any ideas how to deal
with that situation or even better, does someone have already working
solutions dealing with that kind of problem?

Regards Thomas
--
Linux ... enjoy the ride!