Salt中单一状态的多个file.line

Question

我想要一个 Salt 状态来管理我的 SSH 文件。这需要多个file.line 操作。我该怎么做？

更新：请参阅问题底部了解我当前的解决方法

我拥有的是这样的：

Secure SSH:
  file:
   - name: /etc/ssh/sshd_config
   - line:
     - match: "^PasswordAuthentication "
     - content: "PasswordAuthentication no"
     - mode: ensure
   - line:
     - match: "^PubkeyAuthentication "
     - content: "PubkeyAuthentication yes"
     - mode: ensure
   - line:
     - match: "^Port "
     - content: "Port 8888"
     - mode: ensure
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

但这失败了

    Data failed to compile:
----------
    No function declared in state 'file' in SLS u'xyz'

其实我的第一次尝试是这样的：

Secure SSH:
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^PasswordAuthentication "
    - content: "PasswordAuthentication no"
    - mode: ensure
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^PubkeyAuthentication "
    - content: "PubkeyAuthentication yes"
    - mode: ensure
  file.line:
    - name: /etc/ssh/sshd_config
    - match: "^Port "
    - content: "Port 8888"
    - mode: ensure
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

但这失败了

    Data failed to compile:
----------
    Rendering SLS 'base:xyz' failed: Conflicting ID 'file.line'

我理解这个错误，因为每个状态函数都是一个字典键，但它看起来确实很干净。

Salt 文档在这方面没有什么帮助，因为它没有说明 anything 当您只是 也许 您想将多个内容修改到一个文件时该怎么做，而且它方便地仅在其文档中提供非常琐碎的示例。

更新： 我通过为每一行使用单独的状态来让它工作（我还将file.line 更改为file.replace，但这是另一个问题）。我认为这相当笨拙，而且不是每一步都重新加载服务吗？

Disallow SSH password authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PasswordAuthentication .*
    - repl: PasswordAuthentication no
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Allow SSH public key authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PubkeyAuthentication .*
    - repl: PubkeyAuthentication yes
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Set SSH port:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^Port .*
    - repl: Port 8888
    - append_if_not_found: True
  service.running:
    - name: sshd
    - watch:
      - file: /etc/ssh/sshd_config

Answer 1

将 file.replace 分离为多个状态是可行的方法。

为避免冗余，您也应该将 service.running 移动到它自己的状态。另外：使用 watch（或 watch_in）时，您需要在 file: 部分之后指定您正在观看的状态的名称。

结果将如下所示：

Disallow SSH password authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PasswordAuthentication .*
    - repl: PasswordAuthentication no
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

Allow SSH public key authentication:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^PubkeyAuthentication .*
    - repl: PubkeyAuthentication yes
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

Set SSH port:
  file.replace:
    - name: /etc/ssh/sshd_config
    - pattern: ^Port .*
    - repl: Port 8888
    - append_if_not_found: True
    - watch_in:
      - service: ssh_service

ssh_service:
  service.running:
    - name: sshd

Answer 2

1. 我建议查看listen 而不是watch。 Watch 会重启 sshd 3 次，每次修改文件后都会重启一次。

   如果你使用listen，它只会在最后重新启动一次。但你必须这样做

2. 将service.running 放在最后加上它自己的 stateid 并听取所有更改。

   Disallow SSH password authentication:
     file.replace:
       - name: /etc/ssh/sshd_config
       - pattern: ^PasswordAuthentication .*
       - repl: PasswordAuthentication no
       - append_if_not_found: True
   
   Allow SSH public key authentication:
     file.replace:
       - name: /etc/ssh/sshd_config
       - pattern: ^PubkeyAuthentication .*
       - repl: PubkeyAuthentication yes
       - append_if_not_found: True
   
   Set SSH port:
     file.replace:
       - name: /etc/ssh/sshd_config
       - pattern: ^Port .*
       - repl: Port 8888
       - append_if_not_found: True
   
   Start SSHD:
     service.running:
       - name: sshd
       - listen:
         - file: /etc/ssh/sshd_config
   

3. 您可能还会发现检查augeas 状态是值得的。它使进行此类更改变得更加容易，并且在状态文件中看起来更好。

   sshd_config:
     augeas.change:
       - context: /files/etc/ssh/sshd_config
       - changes:
         - set Port 8888
         - set PasswordAuthentication yes
         - set PubkeyAuthentication yes
     service.running:
       - name: sshd
       - listen:
         - augeas: sshd_config