pam module not enforcing the after

[overholw]

Based on the examples I wrote the following:

    # GuideSection 6.5
    # restrict access to the su command to the wheel group (and root)
    pam { '6.5 Restrict Access to the su Command':
      ensure    => present,
      service   => 'su',
      type      => 'auth',
      control   => 'required',
      module    => 'pam_wheel.so',
      arguments => 'use_uid',
      position  => 'after *[type="auth" and module="pam_rootok.so"]',
    }

Manually moving the generated "auth required pam_wheel.so use_uid" line above the "auth sufficient pam_rootok.so" line did not cause the pam_wheel.so line to be moved down.

Is there a bug in my syntax, augeasproviders or somewhere else?

[raphink]

Puppet won't move existing entries if you use ensure => present, it will only create them in the right place.

To move existing entries, you need to use ensure => positioned instead.