config-conflicts — Unmerged configuration files¶

When a package ships a new version of a configuration file you changed, the upgrade keeps yours and saves the package's version next to it. Those leftovers are easy to miss — and for files such as sshd_config or sudoers, the new defaults may matter for security.

At a glance


ID	`config-conflicts`
Category	Packages
Needs root	no
Needs programs	none
Compares with a snapshot	no
Options	2

What it checks¶

Files under /etc ending in .dpkg-new, .dpkg-old, .dpkg-dist, .dpkg-bak, .ucf-new, .ucf-old or .ucf-dist.
Leftovers of the files in critical_paths (by default sshd_config, its .d directory, sudoers and its .d directory) are reported individually as critical; the rest are grouped.

Findings¶

Severity	Finding	What to do
critical	Unmerged package config for file	`diff -u FILE FILE.dpkg-dist`, merge what you want, validate (`sshd -t`, `visudo -c`), then delete the leftover.
warning	N config files have unmerged package versions	Review each diff, merge, delete the leftovers.
info	Some directories under /etc were not readable	Run as root for complete results.

Commands it runs¶

None: it walks /etc.

Limitations¶

It finds leftovers by name. A configuration file you changed without a leftover next to it (because the package didn't change its version) isn't reported.
Files managed by configuration management (Ansible, Puppet, …) produce leftovers that are expected; list them in ignore_paths.

Options¶

Option	Default	Description
`critical_paths`	`["/etc/ssh/sshd_config", "/etc/ssh/sshd_config.d/", "/etc/sudoers", "/etc/sudoers.d/"]`	Config files whose unmerged updates are critical; a trailing / means a directory
`ignore_paths`	`[]`	Files to leave out, e.g. ones a configuration tool such as Ansible manages (shell-style patterns, matched against the config file or its leftover copy)

Set them in the configuration file under checks: config-conflicts:, or for one run with --check-option:

checks:
  config-conflicts:
    enabled: true
    critical_paths: ["/etc/ssh/sshd_config", "/etc/ssh/sshd_config.d/", "/etc/sudoers", "/etc/sudoers.d/"]
    ignore_paths: []

pydebuprep report --check-option config-conflicts.critical_paths=/etc/ssh/sshd_config

For a list option, --check-option replaces the configured list; repeat it to give several items.