Modifying ssh_config with augtool

Question

This is the default /etc/ssh/ssh_config, which contains #ForwardX11 no, which I would like to change, so I do

augtool set "/files/etc/ssh/ssh_config/ForwardX11" yes

which fails, but this adds ForwardX11 yes after the Host *

augtool set "/files/etc/ssh/ssh_config/Host/ForwardX11" yes

Question

• Why doesn't augtool uncomment #ForwardX11 no?
• Why do I have to specify .../Host/...?
• Why are GSSAPIAuthentication yes and ForwardX11Trusted yes missing from the output below?

[root@localhost ~]# augtool ls "/files/etc/ssh/ssh_config"
#comment[1] = $OpenBSD: ssh_config,v 1.27 2013/05/16 02:00:34 dtucker Exp $
#comment[2] = This is the ssh client system-wide configuration file.  See
#comment[3] = ssh_config(5) for more information.  This file provides defaults for
#comment[4] = users, and the values can be changed in per-user configuration files
#comment[5] = or on the command line.
#comment[6] = Configuration data is parsed as follows:
#comment[7] = 1. command line options
#comment[8] = 2. user-specific file
#comment[9] = 3. system-wide file
#comment[10] = Any configuration value is only changed the first time it is set.
#comment[11] = Thus, host-specific definitions should be at the beginning of the
#comment[12] = configuration file, and defaults at the end.
#comment[13] = Site-wide defaults for some commonly used options.  For a comprehensive
#comment[14] = list of available options, their meanings and defaults, please see the
#comment[15] = ssh_config(5) man page.
#comment[16] = Host *
#comment[17] = ForwardAgent no
#comment[18] = ForwardX11 no
#comment[19] = RhostsRSAAuthentication no
#comment[20] = RSAAuthentication yes
#comment[21] = PasswordAuthentication yes
#comment[22] = HostbasedAuthentication no
#comment[23] = GSSAPIAuthentication no
#comment[24] = GSSAPIDelegateCredentials no
#comment[25] = GSSAPIKeyExchange no
#comment[26] = GSSAPITrustDNS no
#comment[27] = BatchMode no
#comment[28] = CheckHostIP yes
#comment[29] = AddressFamily any
#comment[30] = ConnectTimeout 0
#comment[31] = StrictHostKeyChecking ask
#comment[32] = IdentityFile ~/.ssh/identity
#comment[33] = IdentityFile ~/.ssh/id_rsa
#comment[34] = IdentityFile ~/.ssh/id_dsa
#comment[35] = Port 22
#comment[36] = Protocol 2,1
#comment[37] = Cipher 3des
#comment[38] = Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
#comment[39] = MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#comment[40] = EscapeChar ~
#comment[41] = Tunnel no
#comment[42] = TunnelDevice any:any
#comment[43] = PermitLocalCommand no
#comment[44] = VisualHostKey no
#comment[45] = ProxyCommand ssh -q -W %h:%p gateway.example.com
#comment[46] = RekeyLimit 1G 1h
Host/ = *

Answer 1

Augeas has no concept of (un)?commenting. It only lets you manage entries from the file using a tree that maps them. You could emulate uncommenting an entry by inserting a new entry right after (or before) the comment and removing the comment, but Augeas won't do that automatically.

When Augeas sets a value, it changes the value of an existing node if it can find one, or creates a new node (at the end of the tree) otherwise. However, the order of nodes in the tree matters, and creating an entry for a global setting after a Host node is not valid. So you need to insert your new node before the first Host entry:

ins ForwardX11 before Host[1]
set ForwardX11 yes

You could also set it inside the Host entry if you prefer, although this is not strictly equivalent (see man ssh_config):

set Host[.='*'] *    # Ensure the Host entry exists
set Host[.='*']/ForwardX11 yes

As for the two entries missing, they don't appear in your output because ls is not a recursive command. Use print if you want to see the tree recursively.