search

fcaviggia / hardened-centos7-kickstart

DVD embedded Kickstart for CentOS 7 utilizing SCAP Security Guide (SSG) as a hardening script.
Other
158 stars 58 forks source link

Adding DVD as disabled repo #5

Closed openface closed 7 years ago

openface commented 7 years ago

Hi Frank,

This is more of a question than an issue, but thought I'd ask anyway.

https://github.com/fcaviggia/hardened-centos7-kickstart/blob/master/config/hardening/hardened-centos.cfg#L150

Here I see that you've added the CentOS-DVD as a yum repo, but not enabled. (enabled=0) Later, there are calls to yum install. Without specifying --enablerepo=centos-dvd, wouldn't this cause yum to fetch packages from whichever repos are enabled? Unless I'm misunderstanding something, the CentOS-DVD repo should be added with enabled=1. ???

I'm currently working on making this package work in an offline environment, so it's important that no remote fetches happen.

Thanks for any clarification on the intent here.

fcaviggia commented 7 years ago

I left the /etc/yum.repos.d/centos-dvd.repo as enabled=0 because I've generally added rhnreg_ks to activate against Spacewalk/RHN Satellite. I think I did find a bug when that's set to enabled before the packages are installed with yum localinstall - I did a fix by the order of when it was executed. I'll check if that is fixed and report back.

fcaviggia commented 7 years ago

Hey, I changed order of when the /etc/yum.repos.d/centos-dvd.repo was created - you can change it to enabled=1 now without messing with any of the installation options. Make the change and re-create the ISO image with sudo ./createiso.sh <path to CentOS 7 DVD>

openface commented 7 years ago

Thanks, makes sense now.