# Help with Idempotent lineinfile regex

**URL:** <https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946>\
**Category:** Ansible Project\
**Created:** [April 5, 2014, 2:02pm UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946 "2014-04-05T14:02:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Antonio\_Marin](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@Antonio\_Marin](https://forum.ansible.com/u/Antonio_Marin)\
**Post date:** [April 5, 2014, 2:02pm UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946/1 "2014-04-05T14:02:59Z")

</div>

Hello,

I’m trying to create a lineinfile task to append a word in a line, when it’s not present, like the following:

# The line should start with AllowGroups

# Follows an unknown length sequence of “\s\w+”

# It’s possible to find groupN within the previous sequence, in which case the task should return ok

# If groupN is not present, the result will be AllowGroups, followed by the existing sequence, followed by " groupN"

- name: Add group to ssh allowed  
lineinfile: backrefs=yes  
dest=/etc/ssh/sshd\_config  
regex=‘^AllowGroups(._)(?! groupN)(._)’  
line=‘AllowGroups\1\3 groupN’

state=present

I have tried several approaches but none have been successful.

I would appreciate any light to achieve it.

BR,  
Tony

---

<div class="post-metadata">

**Author:** ![Paul\_Durivage](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@Paul\_Durivage](https://forum.ansible.com/u/Paul_Durivage)\
**Post date:** [April 6, 2014, 3:24pm UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946/2 "2014-04-06T15:24:39Z")

</div>

A better, more reliable approach would be to create a template sshd\_config file (or just a regular, non-templated file) that is placed on nodes via the [copy](http://docs.ansible.com/copy_module.html) or [template](http://docs.ansible.com/template_module.html) module.

---

<div class="post-metadata">

**Author:** ![Antonio\_Marin](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@Antonio\_Marin](https://forum.ansible.com/u/Antonio_Marin)\
**Post date:** [April 6, 2014, 6:33pm UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946/3 "2014-04-06T18:33:58Z")

</div>

It’s not an option as the current file has previously templated with some common configuration. It’s a role who has to add the group to the line if the host includes it.

Br

---

<div class="post-metadata">

**Author:** ![Magnus\_boden](https://avatars.discourse-cdn.com/v4/letter/m/50afbb/32.png) [@Magnus\_boden](https://forum.ansible.com/u/Magnus_boden)\
**Post date:** [January 20, 2015, 10:44pm UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946/4 "2015-01-20T22:44:13Z")

</div>

Hello,

After a lot of fiddling around I found a way to do it, I was also after a way to handle AllowGroups in sshd\_config also that it shouldn’t remove other groups in the line just make sure to add the new ones.

The first one registers the current AllowGroups in a variable which is used by the later tasks.  
The second one adds the AllowGroups line if it doesn’t exist at all (the regexp line will never do that)  
The last line adds all the groups in the with\_items: [‘root’, ‘admins’] array.

Hope someone can save a few hours work figuring this out.

I only joined here to give you the answer, If you have any questions email me at magnus(at)boden.cx

Regards  
Magnus

# Ansible complains if grep fails so match something that is always there too

- name: SSH groups  
shell: ‘cat /etc/ssh/sshd\_config | egrep “(Port|AllowGroups)”’  
register: ssh\_groups

# Add line if it doesnt exists groups will be filled in below

- name: SSH configure AllowGroups  
lineinfile: dest=/etc/ssh/sshd\_config line=“AllowGroups”  
when: ssh\_groups.stdout is defined and ssh\_groups.stdout.find(“AllowGroups”) == -1  
notify:

- restart ssh

- name: SSH configure AllowGroups  
lineinfile: dest=/etc/ssh/sshd\_config regexp=“^\s_AllowGroups\s+(._)$” line=“AllowGroups {{ item }} \1” backrefs=yes  
when: ssh\_groups.stdout is defined and ssh\_groups.stdout.find(“{{ item }}”) == -1  
with\_items: [‘root’, ‘admins’]  
notify:

- restart ssh

---

<div class="post-metadata">

**Author:** ![Mark\_Janssen](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@Mark\_Janssen](https://forum.ansible.com/u/Mark_Janssen)\
**Post date:** [January 27, 2015, 9:51am UTC](https://forum.ansible.com/t/help-with-idempotent-lineinfile-regex/14946/5 "2015-01-27T09:51:15Z")

</div>

In this specific case, you can just add additional ‘AllowGroups’ lines in the ssh config. Just something I ran into last week as well…  
All the different AllowGroups (and AllowUsers, DenyGroups, DenyUsers) lines are appended, so there is no need to add entries to an existing line.

I just have a template now, with some conditionals based on what roles/groups a server is in.