Replaces the unsigned SMB-policystore auto-sync (enforcer blindly sourced
whatever .sh files sat on the share, no integrity check) with a dedicated
git-over-SSH server plus GPG commit signing: nodes pull on a timer, verify
every commit's signature and fast-forward history before an unprivileged
puller account hands off to root via one exact scoped sudo command, and a
fetch failure is a safe no-op that keeps the last-known-good policy running.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rename the security-scan policy to dev_mon_clamscan (fits the XXX_mon_* naming
for monitoring groups) and make it hand results to CheckMK natively instead of
uploading logs to an SMB share.
- dev_mon_clamscan.sh: runs the daily ClamAV/rkhunter/chkrootkit scan and writes
its own CheckMK local check (ansipa_clamscan → service "Ansipa_ClamScan"); the
agent from dev_mon_base collects it. Removes the SMB upload entirely. Discovery
matches dev_mon_clamscan BEFORE the generic dev_mon_* catch-all so it sets
WANT_CLAMSCAN rather than being treated as a dev_mon.sh check. mkdir -p the
cron dir (minimal hosts lack /etc/cron.d until cron is installed).
- Remove the now-redundant dev_mon_malware check from dev_mon.sh (subsumed).
- Remove usr_scan-notify and the whole SMB scan-alert pipeline it fed:
ansipa-fetch-alerts.sh, ansipa-scan-notify.sh, server ansipa-check-scans.sh,
the ansipa-scans Samba share + scanupload account, /etc/ansipa-smb.creds, and
the SMB_SCAN_PASSWORD/smb_scan_password variables (playbook, compose, run.sh,
.env, Dockerfile). The ansipa-luks-keys and ansipa-policystore shares stay.
Verified live on the Arch client: enrolling in dev_mon_clamscan writes the scan
script, cron, and local check (which reports "Ansipa_ClamScan"); leaving the
group removes all three. Docs updated (policy tables, architecture, SMB shares,
scan-flow → CheckMK).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
Found while running the policy matrix and NAT/WAN scenario in VMs:
- ansipa-enforce-policies.sh and the dev_security-scan generated script called
`hostname -f`, but the hostname binary (inetutils) is not installed on a
minimal Arch system, so the enforcer aborted with "hostname: command not
found" on every run. Add an ansipa_fqdn() helper (hostnamectl / getent /
/etc/hostname / kernel-hostname fallback chain) and use it; inline the same
fallback in the standalone scan script.
- Fix two stacked bugs that meant CheckMK push mode — the only monitoring
transport that works when a client is behind NAT — never functioned:
* ansipa-checkmk-setup.sh referenced IPA_ADMIN_PASS in the DONE_FLAG
early-exit path, but that variable was assigned only afterwards, so every
rerun kinit'd with an empty password, failed silently, and skipped the
push-mode request writer. Resolve config before the early exit.
* _write_push_requests parsed `ipa hostgroup-show dev_mon_base` members with
awk that did `next` on the "Member hosts:" line — but ipa prints members on
that same line, so the only line with hostnames was discarded and no push
request was ever written. Rewrite the awk to capture the label line's value
plus wrapped continuation lines. Verified end-to-end: requests are written
and CheckMK flips the host to cmk_agent_connection=push-agent.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
The 1550-line ansipa-enforce-policies.sh is replaced by a slim orchestrator
that sources policy files from policies.d/ — one file per policy type — via
a shared lib/ansipa-policy.sh that consolidates all IPA group discovery into
two queries (one host-show, one group-find) instead of five or more.
New files:
- ansible/lib/ansipa-policy.sh shared constants, log/warn, _ansipa_discover(),
_smb_parse_cred(), _ansipa_sync_policystore()
- ansible/policies.d/dev_daemon.sh
- ansible/policies.d/dev_timeshift-backup.sh
- ansible/policies.d/dev_security-scan.sh
- ansible/policies.d/dev_no-local-users.sh
- ansible/policies.d/dev_local-sudo.sh
- ansible/policies.d/dev_ssh.sh
- ansible/policies.d/dev_mon.sh includes usr_mon_logins (same CMK dep)
- ansible/policies.d/usr_admin.sh
- ansible/policies.d/usr_block-binary.sh
- ansible/policies.d/usr_prt.sh
- ansible/policies.d/usr_scan-notify.sh
- ansible/policies.d/usr_smb.sh
- ansible/policies.d/usr_policystore.sh NEW: auto-mount ~/policystore for
usr_smb_adm_policystore members
The policies.d/ folder on the FreeIPA container is exposed as an SMB share
(ansipa-policystore) so admins can live-edit policy files without Ansible.
The enforcer syncs from the share before each run; cached local files are
used as fallback when SMB is unreachable.
- ansipa-smb-setup.sh: adds ansipa-policystore share + smb-policystore system
user + usr_smb_adm_policystore IPA group with auto-generated credential
- deploy-ansipa-policies.yml: deploys lib/ and policies.d/ to enrolled clients;
adds optional seed_policystore task for bootstrap
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Amir Alexander Abdelbaki