docs(ansipa): document all policies; fix package check for pacman/dpkg
- ansipa-enforce-policies.sh header: add missing dev_ssh_*, usr_smb_r_*, usr_smb_rw_*, dev_mon_* (base/malware/timeshift/power), usr_mon_logins with concise descriptions matching actual behaviour. Notes section updated with CheckMK setup prerequisite. - ansipa_packages local check: replace broken rpm||dpkg fallback (wc -l always exits 0 so dpkg/pacman branches were never reached) with an if/elif/elif that probes for rpm, dpkg, or pacman in order. Includes pacman.log-based recent-packages list for Arch hosts. - deploy-ansipa-policies.yml prerequisites: add CheckMK and SMB mount notes. - .env.example: add CheckMK section (CMK_ADMIN_PASSWORD, CMK_SITE_ID). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>feat/astal-menu
parent
6bb19cea78
commit
0dd7ce3b51
|
|
@ -21,6 +21,29 @@
|
|||
# dev_local-sudo-<username> Grant <username> full sudo on this specific device by adding
|
||||
# them to the local sudoers drop-in. Leaving the group removes
|
||||
# the drop-in on the next run.
|
||||
# dev_ssh_<userid> Distribute <userid>'s SSH public keys from their IPA profile to
|
||||
# /home/<userid>/.ssh/authorized_keys on this device (ansipa-managed
|
||||
# section; manually added keys are preserved). Leaving the group
|
||||
# removes only the ansipa-managed section on the next run.
|
||||
# Keys stored in IPA via: ipa user-mod <userid> --sshpubkey='...'
|
||||
#
|
||||
# CheckMK monitoring host-groups (device policies — require dev_mon_base first):
|
||||
# dev_mon_base Install CheckMK agent; register host in CheckMK under /ansipa;
|
||||
# enable check_mk.socket (port 6556) for pull mode, or
|
||||
# cmk-agent-ctl push timer for push mode (when server can't
|
||||
# reach the client directly).
|
||||
# Built-in sections report CPU, RAM, disk, uptime.
|
||||
# Custom check: installed package count (rpm / dpkg / pacman).
|
||||
# Credentials are auto-discovered from the IPA dev_mon_base
|
||||
# description (populated by ansipa-checkmk-setup.sh on the server).
|
||||
# Leaving the group deregisters the host and disables the agent.
|
||||
# dev_mon_malware Local check reporting ClamAV scan results from the
|
||||
# dev_security-scan log. Requires dev_security-scan to run first;
|
||||
# both groups can coexist independently.
|
||||
# dev_mon_timeshift Local check for most-recent Timeshift snapshot age.
|
||||
# WARN if >5 days, CRIT if >10 days; CRIT if no snapshots found.
|
||||
# dev_mon_power Local check for CPU package power via Intel RAPL (preferred)
|
||||
# or lm-sensors fallback. WARN >65 W, CRIT >95 W.
|
||||
#
|
||||
# User-group naming conventions (per-user policies — follow the user across devices):
|
||||
# usr_admin Members get full sudo on every enrolled host via a sudoers
|
||||
|
|
@ -48,10 +71,23 @@
|
|||
# only for group members (checked via id(1) / SSSD).
|
||||
# Deleting the IPA user group removes the timer and profile.d
|
||||
# snippet on the next enforcer run.
|
||||
# usr_smb_r_<name> Mount a read-only Samba share as ~/‹name› for members on any
|
||||
# usr_smb_rw_<name> enrolled host where they are logged in. rw membership takes
|
||||
# precedence over r when both exist for the same share name.
|
||||
# Credential string is stored in the IPA group description by
|
||||
# ansipa-smb-setup.sh (cifs://<host>:<user>:<pass>).
|
||||
# Leaving the group unmounts the share on the next run.
|
||||
# Requires: cifs-utils installed on the client.
|
||||
# usr_mon_logins (CheckMK) Local check for SSH login attempts in the last 24 h:
|
||||
# successful + failed + invalid-user counts with thresholds.
|
||||
# WARN: ≥10 failed or ≥5 invalid; CRIT: ≥50 failed or ≥20 invalid.
|
||||
# Installed fleet-wide when the group exists; requires dev_mon_base.
|
||||
#
|
||||
# Notes:
|
||||
# - Install scan tools first: add the host to dev_mod_anti-malware.
|
||||
# - Configure Timeshift (type + target device) before enabling dev_timeshift-backup.
|
||||
# - CheckMK server must be running and accessible before adding hosts to dev_mon_base.
|
||||
# Run ansipa-checkmk-setup.sh on the FreeIPA container to seed credentials and groups.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
|
|
@ -1310,8 +1346,18 @@ UNIT
|
|||
# ── dev_mon_base: installed-packages local check ───────────────────────
|
||||
# CPU, RAM, disk, uptime are reported by the built-in check_mk_agent sections.
|
||||
_cmk_write_check "ansipa_packages" '#!/bin/bash
|
||||
PKG_COUNT=$(rpm -qa --qf "%{NAME}\n" 2>/dev/null | wc -l || dpkg-query -f "${Package}\n" -W 2>/dev/null | wc -l || echo 0)
|
||||
RECENT=$(rpm -qa --qf "%{INSTALLTIME} %{NAME}\n" 2>/dev/null | sort -rn | head -5 | awk "{print \$2}" | tr "\n" "," | sed "s/,\$//" || echo "n/a")
|
||||
PKG_COUNT=0
|
||||
RECENT="n/a"
|
||||
if command -v rpm &>/dev/null; then
|
||||
PKG_COUNT=$(rpm -qa --qf "%{NAME}\n" 2>/dev/null | wc -l)
|
||||
RECENT=$(rpm -qa --qf "%{INSTALLTIME} %{NAME}\n" 2>/dev/null | sort -rn | head -5 | awk "{print \$2}" | tr "\n" "," | sed "s/,\$//")
|
||||
elif command -v dpkg &>/dev/null; then
|
||||
PKG_COUNT=$(dpkg --list 2>/dev/null | grep -c "^ii")
|
||||
RECENT=$(grep " install " /var/log/dpkg.log 2>/dev/null | tail -5 | awk "{print \$4}" | tr "\n" "," | sed "s/,\$//")
|
||||
elif command -v pacman &>/dev/null; then
|
||||
PKG_COUNT=$(pacman -Qq 2>/dev/null | wc -l)
|
||||
RECENT=$(grep "\[ALPM\] installed" /var/log/pacman.log 2>/dev/null | tail -5 | awk "{print \$4}" | tr "\n" "," | sed "s/,\$//")
|
||||
fi
|
||||
echo "0 Ansipa_Packages packages=${PKG_COUNT} ${PKG_COUNT} packages installed. Recent: ${RECENT}"'
|
||||
|
||||
# ── dev_mon_malware: ClamAV scan result check ──────────────────────────
|
||||
|
|
|
|||
|
|
@ -41,6 +41,10 @@
|
|||
# - For dev_security-scan / usr_scan-notify: smb_scan_password set (use ansible-vault in production)
|
||||
# - For security-scan tools: also add host to dev_mod_anti-malware group
|
||||
# - For timeshift-backup: also add host to dev_mod_timeshift group
|
||||
# - For dev_mon_*: CheckMK CE must be up; run ansipa-checkmk-setup.sh on the FreeIPA
|
||||
# container first (seeds credentials + groups in IPA)
|
||||
# - For usr_smb_r_*/usr_smb_rw_*: cifs-utils installed (handled below); Samba service
|
||||
# running on the IPA container (ansipa-smb.service auto-starts)
|
||||
#
|
||||
# Usage:
|
||||
# ansible-playbook -i inventory deploy-ansipa-policies.yml \
|
||||
|
|
|
|||
|
|
@ -20,6 +20,14 @@ IPA_SETUP_KRA=false
|
|||
SMB_SCAN_PASSWORD=ChangeMe_ScanPass!
|
||||
LUKS_KEY_UPLOAD_PASSWORD=ChangeMe_LuksUpload!
|
||||
|
||||
# ── CheckMK CE monitoring ─────────────────────────────────────────────────────
|
||||
# CMK_ADMIN_PASSWORD — web UI password for cmkadmin.
|
||||
# CMK_SITE_ID — OMD site name (default: cmk). Used in all CheckMK URLs and
|
||||
# agent registration. Must match whatever was used on first start.
|
||||
# Web UI: http://localhost:8090/cmk/ after `docker compose up -d`
|
||||
CMK_ADMIN_PASSWORD=ChangeMe_CMK!
|
||||
CMK_SITE_ID=cmk
|
||||
|
||||
# ── Keycloak ──────────────────────────────────────────────────────────────────
|
||||
KC_HOSTNAME=keycloak.corp.example.com
|
||||
KC_REALM=corp
|
||||
|
|
|
|||
Loading…
Reference in New Issue