<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/4/13 3:52 AM, Rui Pedro
Bernardino wrote:<br>
</div>
<blockquote
cite="mid:B0F8BA03CBE85346A2A4A48A2A9365D401EA7422E59D@INOAVREX11.ptin.corpPT.com"
type="cite">
<pre wrap="">Hi,
I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group:
        [root@seis64 ~]# ssh localhost
        root@localhost's password:
        [root@seis64 ~]# sshd_enable_warning_banner.sh
        [root@seis64 ~]# /etc/init.d/sshd restart
        Stopping sshd: [ OK ]
        Starting sshd: [ OK ]
        [root@seis64 ~]# ssh localhost
        root@localhost's password:
Still no banner.
This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'):
        [root@seis64 ~]# tail -5 /etc/ssh/sshd_config
        # Rules for sftponly group
        Match group sftponly
        X11Forwarding no
        AllowTcpForwarding no
        Banner /etc/issue
This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.
Bottom line, new primitives must be inserted <b class="moz-txt-star"><span class="moz-txt-tag">*</span>before<span class="moz-txt-tag">*</span></b> Match blocks.
</pre>
</blockquote>
<br>
Ah, yes, I see what you're talking about now. How's this?<br>
<br>
<blockquote type="cite"># Attempt to adjust value, should string be
present<br>
grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \<br>
sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g"
/etc/ssh/sshd_config<br>
if ! [ $? -eq 0 ]; then<br>
# string not present, check for Match stanza<br>
grep -q ^Match /etc/ssh/sshd_config && \<br>
sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords
no\n&/' /etc/ssh/sshd_config<br>
if ! [ $? -eq 0 ]; then<br>
# Match stanza not present, add to bottom of
/etc/ssh/sshd_config<br>
echo "PermitEmptyPasswords no" >>
/etc/ssh/sshd_config<br>
fi<br>
fi</blockquote>
<br>
.... there has to be some easier / less fugly way through sed or
awk... anyone?<br>
<br>
</body>
</html>