Enforcing hashed home directory permissions with puppet

Question

Home directories in our environment are hashed using the first two letters of a username. For example, the home directory for user lars is /home/l/a/lars.

I would like to use puppet to enforce mode 0700 permissions on the user home directories, but I'm not sure how to target the home directories. Essentially I would like to do this:

chmod 700 /home/*/*/*

In the absence of hashing this would be easy (using for example recurse and recurselimit), but the hashing has left me looking for a solution.

UPDATE: I am not looking to enumerate our users in puppet (because home directories are created as part of our account management process).

While thinking about this I've also become more muddled. Even if our home directories weren't hashed, how would I get puppet to apply permissions to the contents of a directory without affecting the top directory itself? I was thinking of something like this:

file { '/home:
  ensure => directory,
  mode => 0700,
  recurse => true,
  recurselimit => 1,
  }

But this would apply the mode to both /home and its immediate contents. Mode 700 on /home/lars is fine. Mode 700 on /home is a big problem. Is this even possible?

Answer 1

It seems you've faced one of limitations of puppet. I'd just write a shell script that would do it.

Another possible solution might be to write a plugin for puppet which would allow you to use new datatype (say, file_wildcard) or something like that. That should be possible to write one on ruby, but I've never done that.

Answer 2

Puppet doesn't understand wildcards in file type. If you use something like this:

file { "/home/*":
            ensure  => directory,
            owner   => $username,
            group   => $username,
            mode    => 700,
            require => [ User[$username], Group[$username] ]
    }

it will create /home/\* folder.

So, you must create the directory structure which you want as belows:

define add_user ( $fullname, $uid ) {

    $username = $title
    $firstletter = regsubst($username, '(.).*', '\1')
    $secondletter = regsubst($username, '.(.).*', '\1')

    user { $username:
            comment => "$fullname",
            home    => "/home/$firstletter/$secondletter/$username",
            shell   => "/bin/bash",
            uid     => $uid,
            require => [ File["/home/$firstletter"], File["/home/$firstletter/$secondletter"] ]
    }

    group { $username:
            gid     => $uid,
            require => User[$username]
    }

    file { "/home/$firstletter":
            ensure  => directory,
            owner   => root,
            group   => root,
            mode    => 755
    }
    file { "/home/$firstletter/$secondletter":
            ensure  => directory,
            owner   => root,
            group   => root,
            mode    => 755,
            require => File["/home/$firstletter"]
    }
    file { "/home/$firstletter/$secondletter/$username":
            ensure  => directory,
            owner   => $username,
            group   => $username,
            mode    => 700,
            require => [ File["/home/$firstletter/$secondletter"], User[$username], Group[$username] ]
    }

    file { "/home/$firstletter/$secondletter/$username/.ssh":
            ensure  => directory,
            owner   => $username,
            group   => $username,
            mode    => 700,
            require => File["/home/$firstletter/$secondletter/$username"]
    }

    # now make sure that the ssh key authorized files is around
    file { "/home/$firstletter/$secondletter/$username/.ssh/authorized_keys":
            ensure  => present,
            owner   => $username,
            group   => $username,
            mode    => 600,
            require => File["/home/$firstletter/$secondletter/$username"]
    }
}

and call it with:

node 'test_node' {
    add_user { lars:
        fullname    => "Larry Page",
        uid         => 510
    }
}

Answer 3

You need to either declare the File resource(s) you want Puppet to manage (Puppet is a declarative language...) to puppet or your looking at using the exec type to execute the chmod code snippet you gave.