socallinuxexpo / scale-chef

Chef Cookbooks and related scripts for managing SCALE and LinuxFests' infrastructure
8 stars 3 forks source link

Migrate scale_sudo -> fb_sudo; fix dd-agent postix sudo access #298

Closed jaymzh closed 11 months ago

jaymzh commented 11 months ago

Migrate scale_sudo -> fb_sudo; fix dd-agent postix sudo access

Summary:

Closes #296

Test Plan:

Taste-tested and got...

    --- /etc/sudoers    2023-08-23 03:51:04.724300851 +0000
    +++ /tmp/.chef-sudoers20231012-3840474-6rscpw   2023-10-12 01:34:29.864507596 +0000
    @@ -1,14 +1,25 @@
     # This file is managed by Chef

    -Defaults  !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path = /sbin:/bin:/usr/sbin:/usr/bin
    +Defaults !visiblepw
    +Defaults always_set_home
    +Defaults env_reset
    +Defaults env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
    +Defaults secure_path="/sbin:/bin:/usr/sbin:/usr/bin"

    +
     # Host aliases

     # User aliases

    +# User aliases
    +
     # Command aliases

     # Users
    +## all
    +%sudo ALL=(ALL) ALL
    +## admins can run anything
     %sudo ALL=NOPASSWD: ALL
    -dd-agent ALL=(ALL) NOPASSWD:/usr/bin/find /var/spool/postfix/ -type f, /bin/find /var/spool/postfix/ -type f
    +## postfix
    +dd-agent ALL=(ALL) NOPASSWD:/usr/bin/find /var/spool/postfix/incoming -type f
    - Would restore selinux security context

plus:

Oct 12 01:53:01 scale-lists2 sudo[3846097]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list
Oct 12 01:53:01 scale-lists2 sudo[3846099]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/deferred -type f
Oct 12 01:53:01 scale-lists2 sudo[3846099]: pam_unix(sudo:session): session opened for user root by (uid=0)
Oct 12 01:53:01 scale-lists2 sudo[3846099]: pam_unix(sudo:session): session closed for user root
Oct 12 01:53:16 scale-lists2 sudo[3846152]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list
Oct 12 01:53:16 scale-lists2 sudo[3846154]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/incoming -type f
Oct 12 01:53:16 scale-lists2 sudo[3846154]: pam_unix(sudo:session): session opened for user root by (uid=0)
Oct 12 01:53:16 scale-lists2 sudo[3846154]: pam_unix(sudo:session): session closed for user root
Oct 12 01:53:16 scale-lists2 sudo[3846168]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list
Oct 12 01:53:16 scale-lists2 sudo[3846171]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/active -type f
Oct 12 01:53:16 scale-lists2 sudo[3846171]: pam_unix(sudo:session): session opened for user root by (uid=0)
Oct 12 01:53:16 scale-lists2 sudo[3846171]: pam_unix(sudo:session): session closed for user root
Oct 12 01:53:16 scale-lists2 sudo[3846175]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=list
Oct 12 01:53:16 scale-lists2 sudo[3846177]: dd-agent : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/bin/find /var/spool/postfix/deferred -type f