There is a package

augeas-lenses

on ubuntu linux. I’ll give it a try.

I figured it out: I needed to set the option

--augeas_lenses=/usr/share/augeas/lenses/dist/

in the config file

/opt/orbit/osquery.flags

and then restarted

orbit

with

systemctl restart orbit.service

. Now the query is working fine. Thank you very much!

Installing and configuring the

augeas lenses

is not a huge deal, I do this with a

ansible

snippet during rollout. However, it turned out that the

augeas queries

are a bit unreliable, at least in my tests with querying ssh config parameters. If I do a query on all hosts where I’ve set up

augeas lenses

some responses are empty, even though the parameter I was asking for is set. Even more strange, if I ask for another

sshd

parameter I get responses from different endpoints while the response of one of the endpoints that had result before might be empty.

I’ve no clue why this is, but I can’t use these queries as a compliance check at the moment because the results have to be deterministic and reliable.

Most settings are in fact easy: The first term is the key while everything after the blank space is the value(s). There is at least one exception:

Match

definitions may span multiple lines. But even if this would be ignored and couldn’t be part of a query it would be very useful and sufficient 99% of the time.