skyler / rpms / scap-security-guide

Forked from rpms/scap-security-guide 3 years ago
Clone
Source Code
GIT

Files

  1.   f9fc5de6f6a658ab0fac43452b6366147f5a1f64
  2.   SOURCES
  3.   scap-security-guide-0.1.44-fix_ansible_sssd_tasks.patch
Blob Blame History Raw 
From b3a0d725611897e2aa1577cc64c58572703f9d21 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 14 Mar 2019 17:07:13 +0100
Subject: [PATCH 1/5] Create /etc/sssd/sssd/conf with correct permissions

Only owner of file should be able to access it.
---
 .../sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml | 2 ++
 .../sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml       | 2 ++
 .../services/sssd/sssd_enable_smartcards/ansible/shared.yml     | 1 +
 .../services/sssd/sssd_memcache_timeout/ansible/shared.yml      | 1 +
 .../sssd/sssd_offline_cred_expiration/ansible/shared.yml        | 1 +
 .../sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml        | 1 +
 6 files changed, 8 insertions(+)

diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
index ecea440bf..171a3d1ac 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
@@ -18,6 +18,7 @@
     path: /etc/sssd/sssd.conf
     create: yes
     line: "[domain/default]\nldap_tls_cacertdir = {{ var_sssd_ldap_tls_ca_dir }}\n"
+    mode: 0600
   when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
@@ -28,6 +29,7 @@
     regexp: '^\s*ldap_tls_cacertdir'
     insertafter: '\s*\[domain\/[^]]*]'
     line: 'ldap_tls_cacertdir = {{ var_sssd_ldap_tls_ca_dir }}'
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
index 8941c953a..86915ae7d 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
@@ -26,6 +26,7 @@
   lineinfile:
     path: /etc/sssd/sssd.conf
     line: "[domain/default]\nldap_id_use_start_tls = True\n"
+    mode: 0600
   when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
@@ -36,6 +37,7 @@
     regexp: '^\s*ldap_id_use_start_tls'
     insertafter: '\s*\[domain\/[^]]*]'
     line: 'ldap_id_use_start_tls = True'
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
index a42f8ec20..b4ec2b6a1 100644
--- a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
@@ -10,6 +10,7 @@
     option: pam_cert_auth
     value: true
     create: yes
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
diff --git a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
index 88abc9346..29d8bced6 100644
--- a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
@@ -12,6 +12,7 @@
     option: memcache_timeout
     value: "{{ var_sssd_memcache_timeout }}"
     create: yes
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
index 01d8a94c2..e999417c6 100644
--- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
@@ -10,6 +10,7 @@
     option: offline_credentials_expiration
     value: 1
     create: yes
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
diff --git a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
index 6f9673f75..f4d4d11da 100644
--- a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
@@ -10,6 +10,7 @@
     option: ssh_known_hosts_timeout
     value: 86400
     create: yes
+    mode: 0600
   tags:
     @ANSIBLE_TAGS@
   @ANSIBLE_ENSURE_PLATFORM@
-- 
2.20.1


From be5a09c6dc83f16654022a0c006b210020a5ba7c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 14 Mar 2019 17:12:39 +0100
Subject: [PATCH 2/5] Use ini_file to deal with sssd config file

Much simpler then lineinfile module
---
 .../sssd_ldap_configure_tls_ca_dir/ansible/shared.yml | 11 ++++++-----
 .../sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml  | 11 ++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
index 171a3d1ac..1689e2b43 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
@@ -24,13 +24,14 @@
     @ANSIBLE_TAGS@
 
 - name: "Configure LDAPs path to CA directory"
-  lineinfile:
+  ini_file:
     path: /etc/sssd/sssd.conf
-    regexp: '^\s*ldap_tls_cacertdir'
-    insertafter: '\s*\[domain\/[^]]*]'
-    line: 'ldap_tls_cacertdir = {{ var_sssd_ldap_tls_ca_dir }}'
+    section: "{{ test_grep_domain.stdout | regex_replace('\\[(.*)\\]','\\1') }}"
+    option: ldap_tls_cacertdir
+    value: "{{ var_sssd_ldap_tls_ca_dir }}"
+    create: yes
     mode: 0600
+  when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
-  @ANSIBLE_ENSURE_PLATFORM@
 
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
index 86915ae7d..dbf546013 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
@@ -32,12 +32,13 @@
     @ANSIBLE_TAGS@
 
 - name: "Configure LDAP to use STARTTLS"
-  lineinfile:
+  ini_file:
     path: /etc/sssd/sssd.conf
-    regexp: '^\s*ldap_id_use_start_tls'
-    insertafter: '\s*\[domain\/[^]]*]'
-    line: 'ldap_id_use_start_tls = True'
+    section: "{{ test_grep_domain.stdout | regex_replace('[(.*)]','\\1') }}"
+    option: ldap_id_use_start_tls
+    value: true
+    create: yes
     mode: 0600
+  when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
-  @ANSIBLE_ENSURE_PLATFORM@
-- 
2.20.1


From 857818d224c97e9cda954b76126b2cd8055901fa Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 14 Mar 2019 17:13:30 +0100
Subject: [PATCH 3/5] Use variable for ssh timeout

---
 .../sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml      | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
index f4d4d11da..8f3d0029c 100644
--- a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
@@ -3,12 +3,14 @@
 # strategy = unknown
 # complexity = low
 # disruption = medium
+- (xccdf-var sshd_idle_timeout_value)
+
 - name: "Configure SSSD to Expire SSH Known Hosts"
   ini_file:
     dest: /etc/sssd/sssd.conf
     section: ssh
     option: ssh_known_hosts_timeout
-    value: 86400
+    value: "{{ sshd_idle_timeout_value }}"
     create: yes
     mode: 0600
   tags:
-- 
2.20.1


From 4192b0982084c057b594acc508a5e3dc66549d60 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 14 Mar 2019 17:23:30 +0100
Subject: [PATCH 4/5] Add minimal functional default/domain

Add domain and its required keys with default value for sssd service to
start
---
 .../ansible/shared.yml                        | 10 ++++++++--
 .../sssd_ldap_start_tls/ansible/shared.yml    | 12 ++++++++++--
 .../sssd_enable_smartcards/ansible/shared.yml | 18 ++++++++++++++++++
 .../sssd_memcache_timeout/ansible/shared.yml  | 19 +++++++++++++++++++
 .../ansible/shared.yml                        | 19 +++++++++++++++++++
 .../ansible/shared.yml                        | 19 +++++++++++++++++++
 6 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
index 1689e2b43..fe1a9ac07 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/ansible/shared.yml
@@ -14,11 +14,17 @@
   @ANSIBLE_ENSURE_PLATFORM@
 
 - name: "Add default domain group and set CA directory (if no domain there)"
-  lineinfile:
+  ini_file:
     path: /etc/sssd/sssd.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
     create: yes
-    line: "[domain/default]\nldap_tls_cacertdir = {{ var_sssd_ldap_tls_ca_dir }}\n"
     mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+    - { section: domain/default, option: ldap_tls_cacertdir, value: "{{ var_sssd_ldap_tls_ca_dir }}" }
   when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
index dbf546013..9ebc53e0f 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
@@ -23,10 +23,18 @@
   @ANSIBLE_ENSURE_PLATFORM@
 
 - name: "Add default domain group and use STARTTLS (if no domain there)"
-  lineinfile:
+  ini_file:
     path: /etc/sssd/sssd.conf
-    line: "[domain/default]\nldap_id_use_start_tls = True\n"
+    section: domain/default
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    create: yes
     mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+    - { section: domain/default, option: ldap_id_use_start_tls, value: true}
   when: test_grep_domain.stdout == "" and @ANSIBLE_PLATFORM_CONDITION@
   tags:
     @ANSIBLE_TAGS@
diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
index b4ec2b6a1..f6dbdf429 100644
--- a/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/ansible/shared.yml
@@ -3,6 +3,24 @@
 # strategy = configure
 # complexity = low
 # disruption = medium
+- name: "Test for domain group"
+  shell: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
+  register: test_grep_domain
+  ignore_errors: yes
+  changed_when: False
+
+- name: "Add default domain group (if no domain there)"
+  ini_file:
+    path: /etc/sssd/sssd.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    create: yes
+    mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+  when: test_grep_domain.stdout == ""
 - name: "Enable Smartcards in SSSD"
   ini_file:
     dest: /etc/sssd/sssd.conf
diff --git a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
index 29d8bced6..3cf2af44e 100644
--- a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml
@@ -5,6 +5,25 @@
 # disruption = medium
 - (xccdf-var var_sssd_memcache_timeout)
 
+- name: "Test for domain group"
+  shell: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
+  register: test_grep_domain
+  ignore_errors: yes
+  changed_when: False
+
+- name: "Add default domain group (if no domain there)"
+  ini_file:
+    path: /etc/sssd/sssd.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    create: yes
+    mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+  when: test_grep_domain.stdout == ""
+
 - name: "Configure SSSD's Memory Cache to Expire"
   ini_file:
     dest: /etc/sssd/sssd.conf
diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
index e999417c6..f2cddfd2a 100644
--- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml
@@ -3,6 +3,25 @@
 # strategy = configure
 # complexity = low
 # disruption = medium
+- name: "Test for domain group"
+  shell: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
+  register: test_grep_domain
+  ignore_errors: yes
+  changed_when: False
+
+- name: "Add default domain group (if no domain there)"
+  ini_file:
+    path: /etc/sssd/sssd.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    create: yes
+    mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+  when: test_grep_domain.stdout == ""
+
 - name: "Configure SSD to Expire Offline Credentials"
   ini_file:
     dest: /etc/sssd/sssd.conf
diff --git a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
index 8f3d0029c..61bd79856 100644
--- a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/ansible/shared.yml
@@ -5,6 +5,25 @@
 # disruption = medium
 - (xccdf-var sshd_idle_timeout_value)
 
+- name: "Test for domain group"
+  shell: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
+  register: test_grep_domain
+  ignore_errors: yes
+  changed_when: False
+
+- name: "Add default domain group (if no domain there)"
+  ini_file:
+    path: /etc/sssd/sssd.conf
+    section: "{{ item.section }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+    create: yes
+    mode: 0600
+  with_items:
+    - { section: sssd, option: domains, value: default}
+    - { section: domain/default, option: id_provider, value: files }
+  when: test_grep_domain.stdout == ""
+
 - name: "Configure SSSD to Expire SSH Known Hosts"
   ini_file:
     dest: /etc/sssd/sssd.conf
-- 
2.20.1


From 48a230730a07d8a496c5cfe050934f24e031818a Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Fri, 15 Mar 2019 11:42:39 +0100
Subject: [PATCH 5/5] Escape square brackes in regex_replace

---
 .../sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
index 9ebc53e0f..d0ecf8590 100644
--- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
+++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/ansible/shared.yml
@@ -42,7 +42,7 @@
 - name: "Configure LDAP to use STARTTLS"
   ini_file:
     path: /etc/sssd/sssd.conf
-    section: "{{ test_grep_domain.stdout | regex_replace('[(.*)]','\\1') }}"
+    section: "{{ test_grep_domain.stdout | regex_replace('\\[(.*)\\]','\\1') }}"
     option: ldap_id_use_start_tls
     value: true
     create: yes
-- 
2.20.1

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation