Entry '#{line.chomp}' is unsupported and will be ignored at

Error message

Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}

What it means

Logged by the fileserver configuration parser: in fileserver.conf, allow/deny entries are no longer honored — only `allow *` is silently accepted, and any other allow/deny line is reported as unsupported and ignored. Mount ACLs moved to auth.conf / Puppet Server auth rules, so file-serving access control must live there; the ignored entry has no effect.

Source

Thrown at lib/puppet/file_serving/configuration/parser.rb:42

        case line
        when /^\s*#/; next # skip comments
        when /^\s*$/; next # skip blank lines
        when /\[([-\w]+)\]/
          mount = newmount(::Regexp.last_match(1))
        when /^\s*(\w+)\s+(.+?)(\s*#.*)?$/
          var = ::Regexp.last_match(1)
          value = ::Regexp.last_match(2)
          value.strip!
          raise(ArgumentError, _("Fileserver configuration file does not use '=' as a separator")) if value =~ /^=/

          case var
          when "path"
            path(mount, value)
          when "allow", "deny"
            # ignore `allow *`, otherwise report error
            if var != 'allow' || value != '*'
              error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
              Puppet.err("Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}")
            end
          else
            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
            raise ArgumentError, _("Invalid argument '%{var}' at %{error_location}") %
                                 { var: var, error_location: error_location_str }
          end
        else
          error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)
          raise ArgumentError, _("Invalid entry at %{error_location}: '%{file_text}'") %
                               { file_text: line.chomp, error_location: error_location_str }
        end
      end
    end

    validate

    @mounts
  end

View on GitHub (pinned to e227c27540)

Solutions

Delete allow/deny lines from fileserver.conf — keep only mount and path entries
Enforce access control in auth.conf or Puppet Server HOCON auth rules instead
Reload/restart the Puppet server after changing ACL files
Audit that no mount relied on the ignored deny line for security

Example fix

# before (fileserver.conf)
[files]
  path /etc/puppet/files
  allow 10.0.0.0/8
  deny badhost.example.com

# after (fileserver.conf)
[files]
  path /etc/puppet/files

# access rules live in auth.conf / Puppet Server auth rules

Defensive patterns

Strategy: validation

Validate before calling

File.readlines('/etc/puppetlabs/puppet/fileserver.conf').each_with_index do |line, i|
  if line =~ /^\s*(allow|deny)\b/i && line !~ /^\s*allow\s+\*\s*$/i
    abort "fileserver.conf:#{i + 1}: ACLs are unsupported — move rules to auth.conf"
  end
end

Prevention

Keep fileserver.conf to mounts and paths only; manage ACLs in auth.conf via a module
Lint Puppet config files in CI so allow/deny lines fail the build
Security-review any migrated fileserver.conf for silently ignored deny rules

When it happens

Trigger: A fileserver.conf containing e.g. `allow 10.0.0.0/8` or `deny evil.example.com` under a mount. The parser's case hits the allow/deny branch, and because it is not `allow *`, Puppet.err logs the entry with file/line and the entry is skipped.

Common situations: Configs carried forward from Puppet 3.x masters; operators assuming fileserver.conf still restricts file serving; hardening passes that add deny lines that silently do nothing.

Related errors

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/a8983c3c9fab15ec. Report an issue: GitHub.