Willem's questions

The playbook below should generate a file with the content:

a,b
ssh_host_key
ssh_rsa_host_key

However, the way I construct the variable names results in either syntax/templating errors or 'variable name does not exists':

---
- hosts: localhost
  connection: local

  vars:
    CentOS:
      ciphers: "a,b"
      hostkeys:
        - "ssh_host_key"
        - "ssh_rsa_host_key"
  tasks:
  - copy:
      dest: "{{ playbook_dir }}/test.out"
      content: |

        # This works:
        {{ CentOS.ciphers }}

        # This results in 'No variable found with this name':
        {{ lookup('vars', ansible_distribution + '.ciphers') }}

        # Templating errors:
        {% for hostkey in {{ lookup('vars', ansible_distribution + '.hostkeys') }} %}
        {{ hostkey }}
        {% endfor %}

        # Templating errors:
        {% for hostkey in {{ hostvars[inventory_hostname][ansible_distribution + '.hostkeys'] }} %}
        {{ hostkey }}
        {% endfor %}

What is the proper way to 'assemble' the variable names? Or is there a better way of doing this?

When using

CMD ["/usr/sbin/sshd", "-D"]

in a Dockerfile, docker logs does not show the logging:

cat > Dockerfile.stdout <<EOF
FROM alpine:latest
RUN    apk add --no-cache openssh-server \
    && mkdir /var/run/sshd \
    && ssh-keygen -A
CMD ["/usr/sbin/sshd", "-D"]
EOF

docker build -f Dockerfile.stdout -t sshd-stdout .

docker run --name sshd-stdout -d sshd-stdout

docker logs sshd-stdout
<empty>

Docker host is CentOS:

cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)

Docker logging backend is journald:

grep ^OPTIONS /etc/sysconfig/docker
OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'

I also tried using json as a logging backend, without success.

How do I 'forward' the logging correctly?

As suggested by @marioavs, '-e' is necessary. I have tried '-e' and '-D', but not both at the same time. So:

cat > Dockerfile.stdout <<EOF
FROM alpine:latest
RUN    apk add --no-cache openssh-server \
    && mkdir /var/run/sshd \
    && ssh-keygen -A
CMD ["/usr/sbin/sshd", "-D", "-e"]
EOF

Is it possible to suppress specific error messages when running a Puppet manifest?

The following snippet activates and starts iptables if the file /etc/sysconfig/iptables exists. It works fine, but "Check for iptables rulesfile" generates an error message that I would like to hide. I checked the (v2.7) docs the options of the exec resource type and Googled, but no luck.

cat init.pp
service { "iptables":
  enable  => true,
  ensure  => running,
  require => Exec["Check for iptables rulesfile"];
}

exec { "Check for iptables rulesfile":
  command => "/usr/bin/test -f /etc/sysconfig/iptables",
  returns => "0";
}

puppet apply --debug init.pp
...
err: /Stage[main]//Exec[Check for iptables rulesfile]/returns: change from notrun to 0 failed: /usr/bin/test -f /etc/sysconfig/iptables returned 1 instead of one of [0] at init.pp:12
...
warning: /Stage[main]//Service[iptables]: Skipping because of failed dependencies

Any thoughts?

P.S. Yes, I'm aware this is not the 'right' way to manage firewall rules with Puppet.

I would like to verify the sender and 'addressee' certificate information of an encrypted/signed file. So far, I came up with the following set of arguments to openssl:

openssl cms -inform DER -cmsout -print -recip my.crt -in cms_file

This returns the following information:

CMS_ContentInfo: 
  contentType: pkcs7-envelopedData (1.2.840.113549.1.7.3)
  d.envelopedData: 
    version: 2
    originatorInfo:
...
            issuer: O=TheirCompany, CN=TheirCA
...
            subject: O=TheirCompany, CN=TheirEndpoint
...
    recipientInfos:
...
          issuer: O=TheirCompany, CN=TheirCA
...

So I've got most of the information I'm looking for, except the subject of the recipient. How do I extract this information?

I have a command that I run via sudo. This command needs to have its working directory set to the directory where the command is installed. The user that calls sudo has no permissions in this directory so I can not cd beforehand.

So basically what I like to be able to inlude in /etc/sudoers is something like :

appuser localhost = (appowner) NOPASSWD: cd /opt/app/bin \; ./binary

I know I can use a wrapper script around binary but I would rather not... Any suggestions?