. However, I’m missing the option to check
config settings, because I want to ensure that I’ve set
on all hosts. I can’t find something related in the*
and I can’t figure the query out by myself. Has someone done something in that regard?
Standard query library
table and make sure that augeas is installed on your endpoint. Then you can access this easily. Here's a good blog post on it: https://medium.com/swlh/parsing-configuration-files-with-augeas-on-osquery-ec8260a9a50b
package on the endpoints, where
on ubuntu linux. I’ll give it a try.
with a lot of
files. But it seems there’s still something missing. At least if I do the following query from
on this system, the response is empty:
SELECT label, value FROM augeas WHERE path = '/etc/ssh/sshd_config' AND label = 'PermitRootLogin';
in the config file
and then restarted
. Now the query is working fine. Thank you very much!
systemctl restart orbit.service
is not a huge deal, I do this with a
snippet during rollout. However, it turned out that the
are a bit unreliable, at least in my tests with querying ssh config parameters. If I do a query on all hosts where I’ve set up
some responses are empty, even though the parameter I was asking for is set. Even more strange, if I ask for another
parameter I get responses from different endpoints while the response of one of the endpoints that had result before might be empty.
definitions may span multiple lines. But even if this would be ignored and couldn’t be part of a query it would be very useful and sufficient 99% of the time.