From 724c16f0eefaedc55fc0d7952b27f97cfeac11cb Mon Sep 17 00:00:00 2001 From: Thomas Schneider <thomas@fsmpi.rwth-aachen.de> Date: Sat, 10 Jun 2023 18:47:32 +0200 Subject: [PATCH] shell: RHEL support --- shell/defaults/main.yml | 7 +- shell/handlers/main.yml | 5 ++ shell/tasks/shell.yml | 47 +++++++++++-- shell/tasks/sudo.yml | 4 +- shell/templates/sudoers-rhel.j2 | 120 ++++++++++++++++++++++++++++++++ 5 files changed, 173 insertions(+), 10 deletions(-) create mode 100644 shell/templates/sudoers-rhel.j2 diff --git a/shell/defaults/main.yml b/shell/defaults/main.yml index bf965fe..2de3350 100644 --- a/shell/defaults/main.yml +++ b/shell/defaults/main.yml @@ -6,7 +6,12 @@ shell_software: - lftp - mercurial - pwgen - - snmp + - >- + {% if is_debian -%} + snmp + {%- elif is_rhel -%} + net-snmp-utils + {%- endif %} - telnet shell_blacklist_pcspkr: true diff --git a/shell/handlers/main.yml b/shell/handlers/main.yml index 4a2bbc1..0594ad3 100644 --- a/shell/handlers/main.yml +++ b/shell/handlers/main.yml @@ -6,3 +6,8 @@ - name: update initramfs command: update-initramfs -u + when: is_debian + +- name: dracut + command: dracut --regenerate-all --force + when: is_rhel diff --git a/shell/tasks/shell.yml b/shell/tasks/shell.yml index a0f7911..cf2ef8b 100644 --- a/shell/tasks/shell.yml +++ b/shell/tasks/shell.yml @@ -10,16 +10,49 @@ - zsh state: present install_recommends: false + when: is_debian tags: - packages - shell -- name: ensure installaton of some additional software +- name: ensure installation of basic shell commands + dnf: + name: + - git + - vim + - zsh + state: present + when: is_rhel + tags: + - packages + - shell + +- name: Install additional software (Debian) apt: name: - aptitude - - atop - build-essential + - mtr-tiny + - ncurses-term + when: is_debian + tags: + - packages + - shell + +- name: Install additional software (RHEL) + dnf: + name: + - "@development" + - mtr + when: is_rhel + tags: + - packages + - shell + +- name: ensure installaton of some additional software + package: + name: + - atop - curl - dnsutils - ethtool @@ -30,8 +63,6 @@ - less - lsof - man - - mtr-tiny - - ncurses-term - nmap - pv - reptyr @@ -50,7 +81,7 @@ - shell - name: ensure installation of variable additional software - apt: + package: name: "{{ shell_software }}" state: present tags: @@ -58,12 +89,13 @@ - shell - name: ensure installation of modern additional software - apt: + package: name: - ripgrep - fd-find state: present - when: ansible_distribution_major_version|int(default=99) >= 10 + when: >- + not is_debian or ansible_distribution_major_version|int(default=99) >= 10 tags: - packages - shell @@ -133,6 +165,7 @@ notify: - rerun depmod - update initramfs + - dracut tags: - config - shell diff --git a/shell/tasks/sudo.yml b/shell/tasks/sudo.yml index 5f65bd4..61c9d5f 100644 --- a/shell/tasks/sudo.yml +++ b/shell/tasks/sudo.yml @@ -2,7 +2,7 @@ # file: roles/common/tasks/sudo.yml - name: ensure sudo is installed - apt: + package: state: present name: sudo tags: @@ -10,7 +10,7 @@ - name: ensure we got a sane sudo config template: - src: sudoers.j2 + src: sudoers{{ "-rhel" if is_rhel }}.j2 dest: /etc/sudoers owner: root group: root diff --git a/shell/templates/sudoers-rhel.j2 b/shell/templates/sudoers-rhel.j2 new file mode 100644 index 0000000..93e02ba --- /dev/null +++ b/shell/templates/sudoers-rhel.j2 @@ -0,0 +1,120 @@ +## Sudoers allows particular users to run various commands as +## the root user, without needing the root password. +## +## Examples are provided at the bottom of the file for collections +## of related commands, which can then be delegated out to particular +## users or groups. +## +## This file must be edited with the 'visudo' command. + +## Host Aliases +## Groups of machines. You may prefer to use hostnames (perhaps using +## wildcards for entire domains) or IP addresses instead. +# Host_Alias FILESERVERS = fs1, fs2 +# Host_Alias MAILSERVERS = smtp, smtp2 + +## User Aliases +## These aren't often necessary, as you can use regular groups +## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname +## rather than USERALIAS +# User_Alias ADMINS = jsmith, mikem + + +## Command Aliases +## These are groups of related commands... + +## Networking +# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool + +## Installation and management of software +# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum + +## Services +# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable + +## Updating the locate database +# Cmnd_Alias LOCATE = /usr/bin/updatedb + +## Storage +# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount + +## Delegating permissions +# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp + +## Processes +# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall + +## Drivers +# Cmnd_Alias DRIVERS = /sbin/modprobe + +# Defaults specification + +# +# Refuse to run if unable to disable echo on the tty. +# +Defaults !visiblepw + +# +# Preserving HOME has security implications since many programs +# use it when searching for configuration files. Note that HOME +# is already set when the the env_reset option is enabled, so +# this option is only effective for configurations where either +# env_reset is disabled or HOME is present in the env_keep list. +# +Defaults always_set_home +Defaults match_group_by_gid + +# Prior to version 1.8.15, groups listed in sudoers that were not +# found in the system group database were passed to the group +# plugin, if any. Starting with 1.8.15, only groups of the form +# %:group are resolved via the group plugin by default. +# We enable always_query_group_plugin to restore old behavior. +# Disable this option for new behavior. +Defaults always_query_group_plugin + +Defaults env_reset +Defaults env_keep = "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS" +Defaults env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE" +Defaults env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES" +Defaults env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE" +Defaults env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY" + +# +# Adding HOME to env_keep may enable a user to run unrestricted +# commands via sudo. +# +# Defaults env_keep += "HOME" + +Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin + +## Next comes the main part: which users can run what software on +## which machines (the sudoers file can be shared between multiple +## systems). +## Syntax: +## +## user MACHINE=COMMANDS +## +## The COMMANDS section may have other options added to it. +## +## Allow root to run any commands anywhere +root ALL=(ALL) ALL + +## Allows members of the 'sys' group to run networking, software, +## service management apps and more. +# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS + +## Allows people in group wheel to run all commands +%wheel ALL=(ALL) ALL + +## Same thing without a password +# %wheel ALL=(ALL) NOPASSWD: ALL + +## Allows members of the users group to mount and unmount the +## cdrom as root +# %users ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom + +## Allows members of the users group to shutdown this system +# %users localhost=/sbin/shutdown -h now + +## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment) +#includedir /etc/sudoers.d -- GitLab