Andreas Piening05/30/2022, 1:28 PM
. However, I’m missing the option to check
config settings, because I want to ensure that I’ve set
on all hosts. I can’t find something related in the*
and I can’t figure the query out by myself. Has someone done something in that regard?
Standard query library
Jason05/30/2022, 3:08 PM
table and make sure that augeas is installed on your endpoint. Then you can access this easily. Here's a good blog post on it: https://medium.com/swlh/parsing-configuration-files-with-augeas-on-osquery-ec8260a9a50b
Andreas Piening05/30/2022, 4:04 PM
package on the endpoints, where
on ubuntu linux. I’ll give it a try.
Jason05/30/2022, 4:17 PM
Andreas Piening05/30/2022, 6:03 PM
with a lot of
files. But it seems there’s still something missing. At least if I do the following query from
on this system, the response is empty:
SELECT label, value FROM augeas WHERE path = '/etc/ssh/sshd_config' AND label = 'PermitRootLogin';
in the config file
and then restarted
. Now the query is working fine. Thank you very much!
systemctl restart orbit.service
Mystery Incorporated05/31/2022, 4:41 AM
Andreas Piening05/31/2022, 7:38 AM
is not a huge deal, I do this with a
snippet during rollout. However, it turned out that the
are a bit unreliable, at least in my tests with querying ssh config parameters. If I do a query on all hosts where I’ve set up
some responses are empty, even though the parameter I was asking for is set. Even more strange, if I ask for another
parameter I get responses from different endpoints while the response of one of the endpoints that had result before might be empty.
Mystery Incorporated05/31/2022, 8:06 AM
Andreas Piening05/31/2022, 8:09 AM
definitions may span multiple lines. But even if this would be ignored and couldn’t be part of a query it would be very useful and sufficient 99% of the time.
Mystery Incorporated05/31/2022, 8:17 AM
Andreas Piening05/31/2022, 8:20 AM