On 10/4/13 3:52 AM, Rui Pedro Bernardino wrote:
Hi,

I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group:
	[root@seis64 ~]# ssh localhost
	root@localhost's password:                    
	[root@seis64 ~]# sshd_enable_warning_banner.sh
	[root@seis64 ~]# /etc/init.d/sshd restart
	Stopping sshd:                                             [  OK  ]
	Starting sshd:                                             [  OK  ]
	[root@seis64 ~]# ssh localhost
	root@localhost's password:

Still no banner. 

This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'):
	[root@seis64 ~]# tail -5 /etc/ssh/sshd_config
	# Rules for sftponly group
	Match group sftponly
	X11Forwarding no
	AllowTcpForwarding no
	Banner /etc/issue

This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.

Bottom line, new primitives must be inserted *before* Match blocks.

Ah, yes, I see what you're talking about now. How's this?

# Attempt to adjust value, should string be present
grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
  sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
        # string not present, check for Match stanza
        grep -q ^Match /etc/ssh/sshd_config && \
                sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords no\n&/' /etc/ssh/sshd_config
        if ! [ $? -eq 0 ]; then
                # Match stanza not present, add to bottom of /etc/ssh/sshd_config
                echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config
        fi
fi

.... there has to be some easier / less fugly way through sed or awk... anyone?