bundle agent editline_pam_group
{
vars:

  "default_groups"   string => "*;*;*;Al0000-2400;audio,bluetooth,cdrom,dip,floppy,netdev,plugdev,scanner,video";

files:

  debian.(workstation|roaming).installation::

    "/etc/security/group.conf"
      create => "true",
      edit_line => append_if_no_line("$(default_groups)");
}