# Openssh Cookbook - why default attribute default = '\*' - override?

**URL:** <https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899>\
**Category:** Chef Infra (archive)\
**Created:** [September 22, 2015, 2:37pm UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899 "2015-09-22T14:37:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexander\_Skwar](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/alexander_skwar/32/1205_2.png) [@Alexander\_Skwar](https://discourse.chef.io/u/Alexander_Skwar)\
**Post date:** [September 22, 2015, 2:37pm UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/1 "2015-09-22T14:37:02Z")

</div>

Hello

In the openssh Cookbook from Supermarket @  
[supermarket.chef.io/cookbooks/openssh](http://supermarket.chef.io/cookbooks/openssh), the attributes file for the “client  
section” contains this:

default[‘openssh’][‘client’][‘host’] = '\*'  
See [github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)

​\*Short question: How do I get rid of this, without having to modify the  
openssh/attributes/default.rb file; ie. from my own cookbook, which  
has a “**include\_recipe  
"openssh"**” somewhere.\*​

​Because of that, the generated /etc/ssh/ssh\_config file contains at least  
this:

$ cat /etc/ssh/ssh\_config

# This file was generated by Chef for host

# Do NOT modify this file by hand!

Host \*

​  
Ie., there’s at least a “Host \*” entry. And the way I have it now, all my  
attributes are below that; ie. my ssh\_config file reads:

$ cat /etc/ssh/ssh\_config

# This file was generated by Chef for host

# Do NOT modify this file by hand!

Host \*  
GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
PubkeyAuthentication yes  
VerifyHostKeyDNS no  
#VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
HostKeyAlgorithms ssh-rsa,ssh-dss  
ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h

That’s not quite what I want. I don’t want that “Host \*” line there.

Thanks a lot,

## Alexander

=\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
=\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

---

<div class="post-metadata">

**Author:** ![Alexander\_Skwar](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/alexander_skwar/32/1205_2.png) [@Alexander\_Skwar](https://discourse.chef.io/u/Alexander_Skwar)\
**Post date:** [September 22, 2015, 3:00pm UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/2 "2015-09-22T15:00:26Z")

</div>

Hi again

Hm. I guess, I'm doing something wrong… Now my ssh\_config looks like this:

$ cat /etc/ssh/ssh\_config

# This file was generated by Chef for host

# Do NOT modify this file by hand!

Host \*  
Host foo  
PubkeyAuthentication no  
HostKeyAlgorithms ssh-dss  
Host bar  
HostKeyAlgorithms ssh-dss  
GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
PubkeyAuthentication yes  
VerifyHostKeyDNS no  
#VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
HostKeyAlgorithms ssh-rsa,ssh-dss  
ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h

That's clearly not, what I want.

In my own cookbook, I've got this attributes/default.rb file:

default['openssh']['client']['foo'] = {  
'pubkey\_authentication' =\> 'no',  
'host\_key\_algorithms' =\> 'ssh-dss'  
}

default['openssh']['client']['bar'] = {  
'host\_key\_algorithms' =\> 'ssh-dss'  
}

default['openssh']['client']['global\_known\_hosts\_file'] =  
'/var/lib/sss/pubconf/known\_hosts'  
default['openssh']['client']['pubkey\_authentication'] = 'yes'

default['openssh']['client']['verify\_host\_key\_d\_n\_s'] = 'no'  
default['openssh']['client']['#_verify\_host\_key\_d\_n\_s_:_no_-\_sonst\_ist\_es\_zu\_langsam']  
= 'no'  
default['openssh']['client']['host\_key\_algorithms'] = 'ssh-rsa,ssh-dss'  
default['openssh']['client']['proxy\_command'] =  
'/usr/bin/sss\_ssh\_knownhostsproxy -p %p %h'

#default['openssh']['client']['\*'] = {}

# EOF

I would not have expected, that my "default" settings (eg. proxy\_command to  
take just one example) is below "Host bar". As it is not in any Host hash,  
I would've expected, that the setting would've been above all the "Host …"  
blocks or maybe in the "Host \*" block.

How to do it correctly?

When I move my "default lines" ABOVE all the "Host" lines (  
default['openssh']['client']['foo'] and default['openssh']['client']['bar']),  
then the generated ssh\_config is good. Don't know, but that does not feel  
right.

Regards,  
Alexander

2015-09-22 16:37 GMT+02:00 Alexander Skwar \<  
[alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com)\>:

> Hello
> 
> In the openssh Cookbook from Supermarket @  
> [openssh Cookbook - Chef Supermarket](http://supermarket.chef.io/cookbooks/openssh), the attributes file for the  
> "client section" contains this:
> 
> default['openssh']['client']['host'] = '\*'  
> See  
> [openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)
> 
> ​\*Short question: How do I get rid of this, without having to modify the  
> openssh/attributes/default.rb file; ie. from my own cookbook, which has a "**include\_recipe  
> "openssh"**" somewhere.\*​
> 
> ​Because of that, the generated /etc/ssh/ssh\_config file contains at least  
> this:
> 
> $ cat /etc/ssh/ssh\_config
> 
> # This file was generated by Chef for host
> 
> # Do NOT modify this file by hand!
> 
> Host \*
> 
> ​  
> Ie., there's at least a "Host \*" entry. And the way I have it now, all my  
> attributes are below that; ie. my ssh\_config file reads:
> 
> $ cat /etc/ssh/ssh\_config
> 
> # This file was generated by Chef for host
> 
> # Do NOT modify this file by hand!
> 
> Host \*  
> GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
> PubkeyAuthentication yes  
> VerifyHostKeyDNS no  
> #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
> HostKeyAlgorithms ssh-rsa,ssh-dss  
> ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> 
> That's not quite what I want. I don't want that "Host \*" line there.
> 
> Thanks a lot,
> 
> ## Alexander
> 
> =\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
> =\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

--

## Alexander

=\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
=\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

---

<div class="post-metadata">

**Author:** ![Shubby](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@Shubby](https://discourse.chef.io/u/Shubby)\
**Post date:** [September 22, 2015, 3:43pm UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/3 "2015-09-22T15:43:58Z")

</div>

Alexander,

The order of things can matter in Chef, and the way the openssh cookbook  
works is pretty simplistic. As far as the /etc/ssh/ssh\_config file is  
concerned, take a look at how it's generated:  
[https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh\_config.erb](https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh_config.erb)  
As you can see, it's going to take each of the attributes you declare and  
write them to the file. It's logical that they would be listed in the file  
in the same order you listed them in your attributes file. So this is one  
instance where the order in which you list attributes can matter. It often  
doesn't matter. The cookbook is designed this way so it doesn't have to  
account for every possible configurable item supported by OpenSSH. You just  
tell it what you need and it will write it into the file. The advantage is  
that the cookbook won't need an update if, in the future, versions of  
OpenSSH are released that add new configurable parameters, so long as they  
don't break compatibility with the formatting of the /etc/ssh/ssh(d)\_config  
files.

On Tue, Sep 22, 2015 at 11:00 AM, Alexander Skwar \<  
[alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com)\> wrote:

> Hi again
> 
> Hm. I guess, I'm doing something wrong… Now my ssh\_config looks like this:
> 
> $ cat /etc/ssh/ssh\_config
> 
> # This file was generated by Chef for host
> 
> # Do NOT modify this file by hand!
> 
> Host \*  
> Host foo  
> PubkeyAuthentication no  
> HostKeyAlgorithms ssh-dss  
> Host bar  
> HostKeyAlgorithms ssh-dss  
> GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
> PubkeyAuthentication yes  
> VerifyHostKeyDNS no  
> #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
> HostKeyAlgorithms ssh-rsa,ssh-dss  
> ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> 
> That's clearly not, what I want.
> 
> In my own cookbook, I've got this attributes/default.rb file:
> 
> default['openssh']['client']['foo'] = {  
> 'pubkey\_authentication' =\> 'no',  
> 'host\_key\_algorithms' =\> 'ssh-dss'  
> }
> 
> default['openssh']['client']['bar'] = {  
> 'host\_key\_algorithms' =\> 'ssh-dss'  
> }
> 
> default['openssh']['client']['global\_known\_hosts\_file'] =  
> '/var/lib/sss/pubconf/known\_hosts'  
> default['openssh']['client']['pubkey\_authentication'] = 'yes'
> 
> default['openssh']['client']['verify\_host\_key\_d\_n\_s'] = 'no'  
> default['openssh']['client']['#_verify\_host\_key\_d\_n\_s_:_no_-\_sonst\_ist\_es\_zu\_langsam']  
> = 'no'  
> default['openssh']['client']['host\_key\_algorithms'] = 'ssh-rsa,ssh-dss'  
> default['openssh']['client']['proxy\_command'] =  
> '/usr/bin/sss\_ssh\_knownhostsproxy -p %p %h'
> 
> #default['openssh']['client']['\*'] = {}
> 
> # EOF
> 
> I would not have expected, that my "default" settings (eg. proxy\_command to  
> take just one example) is below "Host bar". As it is not in any Host  
> hash, I would've expected, that the setting would've been above all the  
> "Host …" blocks or maybe in the "Host \*" block.
> 
> How to do it correctly?
> 
> When I move my "default lines" ABOVE all the "Host" lines (  
> default['openssh']['client']['foo'] and  
> default['openssh']['client']['bar']), then the generated ssh\_config is  
> good. Don't know, but that does not feel right.
> 
> Regards,  
> Alexander
> 
> 2015-09-22 16:37 GMT+02:00 Alexander Skwar \<  
> [alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com)\>:
> 
> > Hello
> > 
> > In the openssh Cookbook from Supermarket @  
> > [openssh versions](http://supermarket.chef.io/cookbooks/openssh), the attributes file for the  
> > "client section" contains this:
> > 
> > default['openssh']['client']['host'] = '\*'  
> > See  
> > [github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)
> > 
> > ​\*Short question: How do I get rid of this, without having to modify the  
> > openssh/attributes/default.rb file; ie. from my own cookbook, which has a "**include\_recipe  
> > "openssh"**" somewhere.\*​
> > 
> > ​Because of that, the generated /etc/ssh/ssh\_config file contains at  
> > least this:
> > 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*
> > 
> > ​  
> > Ie., there's at least a "Host \*" entry. And the way I have it now, all  
> > my attributes are below that; ie. my ssh\_config file reads:
> > 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*  
> > GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
> > PubkeyAuthentication yes  
> > VerifyHostKeyDNS no  
> > #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
> > HostKeyAlgorithms ssh-rsa,ssh-dss  
> > ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> > 
> > That's not quite what I want. I don't want that "Host \*" line there.
> > 
> > Thanks a lot,
> > 
> > ## Alexander
> > 
> > =\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
> > =\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==
> 
> --
> 
> ## Alexander
> 
> =\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
> =\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

---

<div class="post-metadata">

**Author:** ![Alexander\_Skwar](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/alexander_skwar/32/1205_2.png) [@Alexander\_Skwar](https://discourse.chef.io/u/Alexander_Skwar)\
**Post date:** [September 23, 2015, 8:10am UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/4 "2015-09-23T08:10:12Z")

</div>

Hi Fabien

Okay, thanks a lot. So I have to take care to list things in the right  
order. Understood.

Cheers,  
Alexander

2015-09-22 17:43 GMT+02:00 Fabien Delpierre [fabien.delpierre@gmail.com](mailto:fabien.delpierre@gmail.com):

> Alexander,
> 
> The order of things can matter in Chef, and the way the openssh cookbook  
> works is pretty simplistic. As far as the /etc/ssh/ssh\_config file is  
> concerned, take a look at how it's generated:
> 
> [https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh\_config.erb](https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh_config.erb)  
> As you can see, it's going to take each of the attributes you declare and  
> write them to the file. It's logical that they would be listed in the file  
> in the same order you listed them in your attributes file. So this is one  
> instance where the order in which you list attributes can matter. It often  
> doesn't matter. The cookbook is designed this way so it doesn't have to  
> account for every possible configurable item supported by OpenSSH. You just  
> tell it what you need and it will write it into the file. The advantage is  
> that the cookbook won't need an update if, in the future, versions of  
> OpenSSH are released that add new configurable parameters, so long as they  
> don't break compatibility with the formatting of the /etc/ssh/ssh(d)\_config  
> files.
> 
> On Tue, Sep 22, 2015 at 11:00 AM, Alexander Skwar \<  
> [alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com)\> wrote:
> 
> > Hi again
> > 
> > Hm. I guess, I'm doing something wrong… Now my ssh\_config looks like this:
> > 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*  
> > Host foo  
> > PubkeyAuthentication no  
> > HostKeyAlgorithms ssh-dss  
> > Host bar  
> > HostKeyAlgorithms ssh-dss  
> > GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
> > PubkeyAuthentication yes  
> > VerifyHostKeyDNS no  
> > #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
> > HostKeyAlgorithms ssh-rsa,ssh-dss  
> > ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> > 
> > That's clearly not, what I want.
> > 
> > In my own cookbook, I've got this attributes/default.rb file:
> > 
> > default['openssh']['client']['foo'] = {  
> > 'pubkey\_authentication' =\> 'no',  
> > 'host\_key\_algorithms' =\> 'ssh-dss'  
> > }
> > 
> > default['openssh']['client']['bar'] = {  
> > 'host\_key\_algorithms' =\> 'ssh-dss'  
> > }
> > 
> > default['openssh']['client']['global\_known\_hosts\_file'] =  
> > '/var/lib/sss/pubconf/known\_hosts'  
> > default['openssh']['client']['pubkey\_authentication'] = 'yes'
> > 
> > default['openssh']['client']['verify\_host\_key\_d\_n\_s'] = 'no'  
> > default['openssh']['client']['#_verify\_host\_key\_d\_n\_s_:_no_-\_sonst\_ist\_es\_zu\_langsam']  
> > = 'no'  
> > default['openssh']['client']['host\_key\_algorithms'] = 'ssh-rsa,ssh-dss'  
> > default['openssh']['client']['proxy\_command'] =  
> > '/usr/bin/sss\_ssh\_knownhostsproxy -p %p %h'
> > 
> > #default['openssh']['client']['\*'] = {}
> > 
> > # EOF
> > 
> > I would not have expected, that my "default" settings (eg. proxy\_command to  
> > take just one example) is below "Host bar". As it is not in any Host  
> > hash, I would've expected, that the setting would've been above all the  
> > "Host …" blocks or maybe in the "Host \*" block.
> > 
> > How to do it correctly?
> > 
> > When I move my "default lines" ABOVE all the "Host" lines (  
> > default['openssh']['client']['foo'] and  
> > default['openssh']['client']['bar']), then the generated ssh\_config is  
> > good. Don't know, but that does not feel right.
> > 
> > Regards,  
> > Alexander
> > 
> > 2015-09-22 16:37 GMT+02:00 Alexander Skwar \<  
> > [alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com)\>:
> > 
> > > Hello
> > > 
> > > In the openssh Cookbook from Supermarket @  
> > > [openssh Cookbook - Chef Supermarket](http://supermarket.chef.io/cookbooks/openssh), the attributes file for the  
> > > "client section" contains this:
> > > 
> > > default['openssh']['client']['host'] = '\*'  
> > > See  
> > > [openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)
> > > 
> > > ​\*Short question: How do I get rid of this, without having to modify  
> > > the openssh/attributes/default.rb file; ie. from my own cookbook, which has  
> > > a " **include\_recipe "openssh"**" somewhere.\*​
> > > 
> > > ​Because of that, the generated /etc/ssh/ssh\_config file contains at  
> > > least this:
> > > 
> > > $ cat /etc/ssh/ssh\_config
> > > 
> > > # This file was generated by Chef for host
> > > 
> > > # Do NOT modify this file by hand!
> > > 
> > > Host \*
> > > 
> > > ​  
> > > Ie., there's at least a "Host \*" entry. And the way I have it now, all  
> > > my attributes are below that; ie. my ssh\_config file reads:
> > > 
> > > $ cat /etc/ssh/ssh\_config
> > > 
> > > # This file was generated by Chef for host
> > > 
> > > # Do NOT modify this file by hand!
> > > 
> > > Host \*  
> > > GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts  
> > > PubkeyAuthentication yes  
> > > VerifyHostKeyDNS no  
> > > #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no  
> > > HostKeyAlgorithms ssh-rsa,ssh-dss  
> > > ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> > > 
> > > That's not quite what I want. I don't want that "Host \*" line there.
> > > 
> > > Thanks a lot,
> > > 
> > > ## Alexander
> > > 
> > > =\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
> > > =\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==
> > 
> > --
> > 
> > ## Alexander
> > 
> > =\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
> > =\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

--

## Alexander

=\> _Google+_ =\> [http://plus.skwar.me](http://plus.skwar.me) \<==  
=\> _Chat_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

---

<div class="post-metadata">

**Author:** ![Tensibai](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tensibai/32/29_2.png) [@Tensibai](https://discourse.chef.io/u/Tensibai)\
**Post date:** [September 24, 2015, 8:16am UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/5 "2015-09-24T08:16:22Z")

</div>

To just answer: in your wrapper cookbook, override the value with what  
you wish like this for example:

default['openssh']['client']['host'] = '\*.my.domain'

The attribute will be update before the recipe is evaluated, and it will  
update the file accordingly.

What I don't understand is why you don't wish a Host \* in your  
ssh\_config.

It is to declare the defaults value for all hosts, until another "Host  
something" entry is found which in turn could update settings with  
specific values for the "something" pattern.

I'm even unsure keywords before a Host line will be used by the ssh  
client.

Le 2015-09-22 16:37, Alexander Skwar a écrit :

> Hello
> 
> In the openssh Cookbook from Supermarket @ [openssh Cookbook - Chef Supermarket](http://supermarket.chef.io/cookbooks/openssh) [2], the attributes file for the "client section" contains this:
> 
> default['openssh']['client']['host'] = '\*'
> 
> See [openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57) [3]
> 
> ​SHORT QUESTION: HOW DO I GET RID OF THIS, WITHOUT HAVING TO MODIFY THE OPENSSH/ATTRIBUTES/DEFAULT.RB FILE; IE. FROM MY OWN COOKBOOK, WHICH HAS A "INCLUDE\_RECIPE "OPENSSH"" SOMEWHERE.​
> 
> ​Because of that, the generated /etc/ssh/ssh\_config file contains at least this:
> 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*
> 
> ​  
> Ie., there's at least a "Host \*" entry. And the way I have it now, all my attributes are below that; ie. my ssh\_config file reads:
> 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*
> > 
> > GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts
> > 
> > PubkeyAuthentication yes
> > 
> > VerifyHostKeyDNS no
> > 
> > #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no
> > 
> > HostKeyAlgorithms ssh-rsa,ssh-dss
> > 
> > ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> 
> That's not quite what I want. I don't want that "Host \*" line there.
> 
> Thanks a lot,
> 
> ## Alexander
> 
> =\> _GOOGLE+_ =\> [http://plus.skwar.me](http://plus.skwar.me) [1] \<==  
> =\> _CHAT_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

## Links:

[1] [http://plus.skwar.me/](http://plus.skwar.me/)  
[2] [openssh Cookbook - Chef Supermarket](https://supermarket.chef.io/cookbooks/openssh)  
[3]  
[openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](https://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)

---

<div class="post-metadata">

**Author:** ![Tensibai](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tensibai/32/29_2.png) [@Tensibai](https://discourse.chef.io/u/Tensibai)\
**Post date:** [September 24, 2015, 8:35am UTC](https://discourse.chef.io/t/openssh-cookbook-why-default-attribute-default-override/6899/6 "2015-09-24T08:35:15Z")

</div>

Quick version: Set your defaults attributes before the other Hashes as  
the template will read in the order of appearance (declaration)

In my opinion a better way would be to do this:

default['openssh']['client']['\*'] = {

'global\_known\_hosts\_file' = '/var/lib/sss/pubconf/known\_hosts'

'pubkey\_authentication' = 'yes'

'verify\_host\_key\_d\_n\_s' = 'no'

'#_verify\_host\_key\_d\_n\_s_:_no_-\_sonst\_ist\_es\_zu\_langsam'] = 'no'

'host\_key\_algorithms' = 'ssh-rsa,ssh-dss'

'proxy\_command' = '/usr/bin/sss\_ssh\_knownhostsproxy -p %p %h'  
}

default['openssh']['client']['foo'] = {

'pubkey\_authentication' =\> 'no',

'host\_key\_algorithms' =\> 'ssh-dss'

}

default['openssh']['client']['bar'] = {

'host\_key\_algorithms' =\> 'ssh-dss'

}

The template for ssh\_config[1] iterate over the key just under 'client'  
and build the values accordingly.

[1]  
[https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh\_config.erb](https://github.com/chef-cookbooks/openssh/blob/master/templates/default/ssh_config.erb)

Le 2015-09-22 17:00, Alexander Skwar a écrit :

> Hi again
> 
> Hm. I guess, I'm doing something wrong... Now my ssh\_config looks like this:
> 
> > $ cat /etc/ssh/ssh\_config
> > 
> > # This file was generated by Chef for host
> > 
> > # Do NOT modify this file by hand!
> > 
> > Host \*
> > 
> > Host foo
> > 
> > PubkeyAuthentication no
> > 
> > HostKeyAlgorithms ssh-dss
> > 
> > Host bar
> > 
> > HostKeyAlgorithms ssh-dss
> > 
> > GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts
> > 
> > PubkeyAuthentication yes
> > 
> > VerifyHostKeyDNS no
> > 
> > #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no
> > 
> > HostKeyAlgorithms ssh-rsa,ssh-dss
> > 
> > ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> 
> That's clearly not, what I want.
> 
> In my own cookbook, I've got this attributes/default.rb file:
> 
> > default['openssh']['client']['foo'] = {
> > 
> > 'pubkey\_authentication' =\> 'no',
> > 
> > 'host\_key\_algorithms' =\> 'ssh-dss'
> > 
> > }
> > 
> > default['openssh']['client']['bar'] = {
> > 
> > 'host\_key\_algorithms' =\> 'ssh-dss'
> > 
> > }
> > 
> > default['openssh']['client']['global\_known\_hosts\_file'] = '/var/lib/sss/pubconf/known\_hosts'
> > 
> > default['openssh']['client']['pubkey\_authentication'] = 'yes'
> > 
> > default['openssh']['client']['verify\_host\_key\_d\_n\_s'] = 'no'
> > 
> > default['openssh']['client']['#_verify\_host\_key\_d\_n\_s_:_no_-\_sonst\_ist\_es\_zu\_langsam'] = 'no'
> > 
> > default['openssh']['client']['host\_key\_algorithms'] = 'ssh-rsa,ssh-dss'
> > 
> > default['openssh']['client']['proxy\_command'] = '/usr/bin/sss\_ssh\_knownhostsproxy -p %p %h'
> > 
> > #default['openssh']['client']['\*'] = {}
> > 
> > # EOF
> 
> I would not have expected, that my "default" settings (eg. proxy\_command to take just one example) is below "Host bar". As it is not in any Host hash, I would've expected, that the setting would've been above all the "Host ..." blocks or maybe in the "Host \*" block.
> 
> How to do it correctly?
> 
> When I move my "default lines" ABOVE all the "Host" lines (default['openssh']['client']['foo'] and default['openssh']['client']['bar']), then the generated ssh\_config is good. Don't know, but that does not feel right.
> 
> Regards,  
> Alexander
> 
> 2015-09-22 16:37 GMT+02:00 Alexander Skwar [alexanders.mailinglists+nospam@gmail.com](mailto:alexanders.mailinglists+nospam@gmail.com):
> 
> Hello
> 
> In the openssh Cookbook from Supermarket @ [openssh Cookbook - Chef Supermarket](http://supermarket.chef.io/cookbooks/openssh) [2], the attributes file for the "client section" contains this:
> 
> default['openssh']['client']['host'] = '\*'
> 
> See [openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](http://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57) [3]
> 
> ​SHORT QUESTION: HOW DO I GET RID OF THIS, WITHOUT HAVING TO MODIFY THE OPENSSH/ATTRIBUTES/DEFAULT.RB FILE; IE. FROM MY OWN COOKBOOK, WHICH HAS A "INCLUDE\_RECIPE "OPENSSH"" SOMEWHERE.​
> 
> ​Because of that, the generated /etc/ssh/ssh\_config file contains at least this:
> 
> $ cat /etc/ssh/ssh\_config
> 
> # This file was generated by Chef for host
> 
> # Do NOT modify this file by hand!
> 
> Host \*  
> ​  
> Ie., there's at least a "Host \*" entry. And the way I have it now, all my attributes are below that; ie. my ssh\_config file reads:
> 
> $ cat /etc/ssh/ssh\_config
> 
> # This file was generated by Chef for host
> 
> # Do NOT modify this file by hand!
> 
> Host \*
> 
> GlobalKnownHostsFile /var/lib/sss/pubconf/known\_hosts
> 
> PubkeyAuthentication yes
> 
> VerifyHostKeyDNS no
> 
> #VerifyHostKeyDNS:No-SonstIstEsZuLangsam no
> 
> HostKeyAlgorithms ssh-rsa,ssh-dss
> 
> ProxyCommand /usr/bin/sss\_ssh\_knownhostsproxy -p %p %h
> 
> That's not quite what I want. I don't want that "Host \*" line there.
> 
> Thanks a lot,
> 
> ## Alexander
> 
> =\> _GOOGLE+_ =\> [http://plus.skwar.me](http://plus.skwar.me) [1] \<==  
> =\> _CHAT_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

--

## Alexander

=\> _GOOGLE+_ =\> [http://plus.skwar.me](http://plus.skwar.me) [1] \<==  
=\> _CHAT_ (Jabber/Google Talk) =\> [a.skwar@gmail.com](mailto:a.skwar@gmail.com) \<==

## Links:

[1] [http://plus.skwar.me/](http://plus.skwar.me/)  
[2] [openssh Cookbook - Chef Supermarket](https://supermarket.chef.io/cookbooks/openssh)  
[3]  
[openssh/attributes/default.rb at main · sous-chefs/openssh · GitHub](https://github.com/chef-cookbooks/openssh/blob/master/attributes/default.rb#L57)