From 78aad663e6a0559baa998148a55eca902d48c410 Mon Sep 17 00:00:00 2001 From: irl Date: Sat, 8 Nov 2025 21:00:18 +0000 Subject: [PATCH] feat(baseline): move freeipa related lockdown overrides to role from playbook --- playbooks/core_services.yml | 20 -------------------- roles/baseline/tasks/lockdown.yml | 8 ++++++++ 2 files changed, 8 insertions(+), 20 deletions(-) diff --git a/playbooks/core_services.yml b/playbooks/core_services.yml index 60fa95c..351cb30 100644 --- a/playbooks/core_services.yml +++ b/playbooks/core_services.yml @@ -16,18 +16,8 @@ - python3-acme - python3-zipp - python3-pyOpenSSL - # 2.1 Configure Server Services - # These services are required by FreeIPA. - rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it. rhel9cis_dns_server: true rhel9cis_httpd_server: true - # 2.2 Configure Client Services - # These services are required by FreeIPA. - rhel9cis_openldap_clients_required: true - # 5.3.2 Configure authselect - # ipaservers are part of Linux Identity Management. Joining your host to an IdM - # domain automatically configures SSSD authentication on your host. - rhel9cis_allow_authselect_updates: false # TODO: Restricted umask breaks FreeIPA roles rhel9cis_rule_5_4_2_6: false rhel9cis_rule_5_4_3_3: false @@ -41,16 +31,6 @@ hosts: - keycloak become: true - vars: - rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it. - # 2.2 Configure Client Services - # These services are required by FreeIPA. - rhel9cis_openldap_clients_required: true - # 5.3.2 Configure authselect - # ipaservers are part of Linux Identity Management. Joining your host to an IdM - # domain automatically configures SSSD authentication on your host. - rhel9cis_allow_authselect_updates: false - podman_host_rootless_users: ["identity"] roles: - role: sr2c.core.baseline tags: bootstrap diff --git a/roles/baseline/tasks/lockdown.yml b/roles/baseline/tasks/lockdown.yml index 9a11528..5ddbc22 100644 --- a/roles/baseline/tasks/lockdown.yml +++ b/roles/baseline/tasks/lockdown.yml @@ -22,4 +22,12 @@ rhel9cis_syslog: rsyslog rhel9cis_time_synchronization_servers: "{{ baseline_ntp_servers }}" rhel9cis_warning_banner: "{{ baseline_warning_banner }}" + rhel9cis_autofs_services: true # TODO: can we mask it? This is required by FreeIPA but we don't use it. + # 2.2 Configure Client Services + # These services are required by FreeIPA. + rhel9cis_openldap_clients_required: true + # 5.3.2 Configure authselect + # ipaservers are part of Linux Identity Management. Joining your host to an IdM + # domain automatically configures SSSD authentication on your host. + rhel9cis_allow_authselect_updates: false when: (ansible_distribution == "Rocky") and (ansible_distribution_major_version == "9")