plus3it / amigen8

Set of tools to provide automation of tasks for creating STIG-partitioned EL8 AMIs
10 stars 13 forks source link

[Feature Request] Ensure use of NetworkManager Key-files instead of ifcfg files #119

Open ferricoxide opened 1 month ago

ferricoxide commented 1 month ago

Is your feature request related to a problem? Please describe.

As noted in AMIgen9 #22:

While writing security-automation for the watchmaker project (see: ash-linux-formula https://github.com/plus3it/ash-linux-formula/pull/506), a security-finding came up for the network configuration files. This led me to find a vendor-article on the deprecation of ifcfg files in RHEL 9 and later (see the "NetworkManager connection profiles in ifcfg format are deprecated" section of the linked-document for specific verbiage). The AMIgen automation needs to be updated to account for this change

There are similar notes for RHEL8 noting that the deprecation is pending: it might be a good idea to update the EL8 automation to better align to that pending-deprecation and associated warning.

Describe the solution you'd like

As with the previously-linked AMIgen9 issue:

AMIgen bakes in the cloud-init service. Instances launched from AMIgen-created images already leverage cloud-init for boot-time automation-tasks. The ifcfg to NM-keyfile operation could be included by way of a per once stage script.

Describe alternatives you've considered

Additional context

ferricoxide commented 1 month ago

While the legacy files are being created in PostBuild.sh, it's not 100% clear that a similar mechanism can be used for creating the NM-keyfiles from the get-go.