11

Is there a more DRY way to write the following commands (will be putting them in a bash shell script):

sudo sed -i 's/^#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

sudo sed -i 's/^#PermitEmptyPasswords yes/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitEmptyPasswords yes/PermitEmptyPasswords no/' /etc/ssh/sshd_config

sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

sudo sed -i 's/^#X11Forwarding yes/X11Forwarding no/' /etc/ssh/sshd_config
sudo sed -i 's/X11Forwarding yes/X11Forwarding no/' /etc/ssh/sshd_config
2
  • And files. And using sed match expressions. Try "man sed".
    – Bruce K
    Apr 29, 2014 at 16:15
  • you could also use a for loop and a list since you are always accessing the same file. The list would contain all your different replacement strings.
    – dboals
    Apr 29, 2014 at 16:16

8 Answers 8

12

Since the patterns to be matched are similar, you could make use of alternation for the 4 strings and capture it. Make the # at the beginning of the string optional.

The following would combine those into one:

sed -i -r 's/^#?(PermitRootLogin|PermitEmptyPasswords|PasswordAuthentication|X11Forwarding) yes/\1 no/' /etc/ssh/sshd_config

If your version of sed doesn't support extended regular expressions, you could say:

sed -i 's/^#\{0,1\}\(PermitRootLogin\|PermitEmptyPasswords\|PasswordAuthentication\|X11Forwarding\) yes/\1 no/' /etc/ssh/sshd_config
2
  • @keyser Without -r the | and parenthesis wouldn't be special, i.e. you would need to escape those.
    – devnull
    Apr 29, 2014 at 16:19
  • 1
    @keyser Added a variant without -r too.
    – devnull
    Apr 29, 2014 at 16:26
11

Either use multiple -e 'sed-command' arguments in a single invocation of sed:

sudo sed -i.bak \
         -e 's/^#PermitRootLogin yes/PermitRootLogin no/' \
         -e 's/PermitRootLogin yes/PermitRootLogin no/' \
         -e 's/^#PermitEmptyPasswords yes/PermitEmptyPasswords no/' \
         -e 's/PermitEmptyPasswords yes/PermitEmptyPasswords no/' \
         -e 's/^#PasswordAuthentication yes/PasswordAuthentication no/' \
         -e 's/PasswordAuthentication yes/PasswordAuthentication no/' \
         -e 's/^#X11Forwarding yes/X11Forwarding no/' \
         -e 's/X11Forwarding yes/X11Forwarding no/' \
         /etc/ssh/sshd_config

Or create a script file, sed.script, containing the commands:

s/^#PermitRootLogin yes/PermitRootLogin no/
s/PermitRootLogin yes/PermitRootLogin no/
s/^#PermitEmptyPasswords yes/PermitEmptyPasswords no/
s/PermitEmptyPasswords yes/PermitEmptyPasswords no/
s/^#PasswordAuthentication yes/PasswordAuthentication no/
s/PasswordAuthentication yes/PasswordAuthentication no/
s/^#X11Forwarding yes/X11Forwarding no/
s/X11Forwarding yes/X11Forwarding no/

and then run sed with that file:

sudo sed -i.bak -f sed.script /etc/ssh/sshconfig

I've added a backup extension to the -i option. You're a braver man than I am if you edit major configuration files without making a backup copy first! (It's also necessary if you work on Mac OS X or BSD; the sed there requires an extension with -i.)

3
  • 1
    You could cut the number of commands in half by using #\? or, if your sed dialect doesn't support that, maybe #*.
    – tripleee
    Apr 29, 2014 at 16:39
  • @tripleee: Yes, there are ways to revise the regexes, including using ^#\{0,1\}, but sometimes, it is easier to let people write the substitute commands in a simpler, if more verbose, way that leads to a more reliable script for them. As they become more comfortable with more complex regexes, they can reduce the content of the script. But knowing that sed can operate on script files or with multiple -e arguments (or a single multi-line -e argument) is the key information here. Apr 29, 2014 at 16:43
  • Yes, that's correct. I wonder why @fedorqui chose to delete the answer using -e.
    – devnull
    Apr 29, 2014 at 16:45
4

Like I said you could also use a for loop.

#!/bin/bash

FILE='/etc/ssh/sshd_config'
REPLACE_STRINGS=('s/^#PermitRootLogin yes/PermitRootLogin no/' 's/PermitRootLogin yes/PermitRootLogin no/' 's/^#PermitEmptyPasswords yes/PermitEmptyPasswords no/' 's/PermitEmptyPasswords yes/PermitEmptyPasswords no/' 's/^#PasswordAuthentication yes/PasswordAuthentication no/' 's/PasswordAuthentication yes/PasswordAuthentication no/' 's/^#X11Forwarding yes/X11Forwarding no/' 's/X11Forwarding yes/X11Forwarding no/')


for i in "${REPLACE_STRINGS[@]}"
{
    sudo sed -i "$i" $FILE
}
4
  • About the only thing in its favour is that it does work. Otherwise, it cannot be recommended. Apr 29, 2014 at 16:39
  • I took the liberty to fix a couple of things in your answer. Feel free to revert if you have any objections.
    – devnull
    Apr 29, 2014 at 16:39
  • This is inferior to using a single sed invocation.
    – tripleee
    Apr 29, 2014 at 16:40
  • 2
    @jonathanLeffler I agree you that your answer is more efficient, but for me the name of the game is readability. For loops with lists are more readable, just my preference. And at my age, with my failing mind, I can't remember all the more complex syntax of all the different commands. Debating further would be about the same as arguing where to place curly braces in C.
    – dboals
    Apr 29, 2014 at 17:05
3

You can use -e:

sudo sed -i -e 'first_command' -e 'second command' ... -e 'last command' /etc/ssh/sshd_config
0
1

You could put your sed commands in an external file:

sudo sed -i -f commands.sed /etc/ssh/sshd_config

commands.sed:
s/#*PermitRootLogin yes/PermitRootLogin no/
s/#*PermitEmptyPasswords yes/PermitEmptyPasswords no/
s/#*PasswordAuthentication yes/PasswordAuthentication no/
s/#*X11Forwarding yes/X11Forwarding no/

You can also embed a multiline sed script in a bash script:

#!/bin/bash

sudo sed -i '
    s/#*PermitRootLogin yes/PermitRootLogin no/
    s/#*PermitEmptyPasswords yes/PermitEmptyPasswords no/
    s/#*PasswordAuthentication yes/PasswordAuthentication no/
    s/#*X11Forwarding yes/X11Forwarding no/
' /etc/ssh/sshd_config
1

Just a small comment.

Beautiful solution is suggested here (from ask Ubuntu).

Instead of writing same character twice in a single line, we can revise it as

sed -i '/^#PermitRootLogin/s/yes/no/' /etc/ssh/sshd_config

This approach will reduce mistakes based on typos.

0

On standard unix (wher sed is posix and not GNU)

sed -e 's/^#PermitRootLogin yes/PermitRootLogin no/;s/PermitRootLogin yes/PermitRootLogin no/;s/^#PermitEmptyPasswords yes/PermitEmptyPasswords no/;s/PermitEmptyPasswords yes/PermitEmptyPasswords no/;s/^#PasswordAuthentication yes/PasswordAuthentication no/;s/PasswordAuthentication yes/PasswordAuthentication no/;s/^#X11Forwarding yes/X11Forwarding no/;s/X11Forwarding yes/X11Forwarding no/' /etc/ssh/sshd_config > /tmp/sshd_config
cat /tmp/sshd_config > /etc/ssh/sshd_config 
rm /etc/ssh/sshd_config 

normaly it's ok but line sometime define to start with the # than word and sometime no specification of place so a PermitRootLogin substitute also change a SpecialPermitRootLogin

0

Being lazy, but I would just do this:

sed -Ei 's/.*PermitRootLogin yes|#PermitRootLogin no/PermitRootLogin no/g' /etc/ssh/sshd_config
sed -Ei 's/.*PermitEmptyPasswords yes|#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config
sed -Ei 's/.*PasswordAuthentication yes|#PasswordAuthentication no/PasswordAuthentication no/g' /etc/ssh/sshd_config
sed -Ei 's/.*X11Forwarding yes|#X11Forwarding no/X11Forwarding no/g' /etc/ssh/sshd_config

~SimonTek

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.