Amir Alexander Abdelbaki 45fd7e5d36 feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo ... Introduces a FreeIPA host-group-driven policy system alongside a sudo rules management playbook: - ansipa-enforce-policies.sh: client-side enforcer (systemd timer, 30 min) - policy-block-binary-<name>: PATH-priority wrapper blocks the binary - policy-timeshift-backup: daily Timeshift snapshot cron (03:00) - policy-security-scan: daily ClamAV/rkhunter/chkrootkit cron (02:00) Policies are reversible — leaving a group removes enforcement on next run. - deploy-ansipa-policies.yml: deploys enforcer + systemd service/timer to clients - manage-sudo-rules.yml: creates FreeIPA sudo rules (allow_sudoers, allow_sudo_nopasswd) that SSSD clients already pick up via --sudo enrollment. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-05-20 11:34:09 +02:00
..
ansible	feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo	2026-05-20 11:34:09 +02:00
image	setup: add FreeIPA image builder and Keycloak integration	2026-05-18 11:22:48 +02:00
auto-enroll-ansible.sh	Update setup/modules/FreeipaAnsible/auto-enroll-ansible.sh	2026-04-27 16:38:02 +02:00
copilot-explains.txt	Update setup/modules/FreeipaAnsible/copilot-explains.txt	2026-04-27 17:00:37 +02:00
freeipa-client-answerfile.json	setup: add FreeIPA server module and generic client script	2026-05-18 11:12:31 +02:00
freeipa-client.sh	setup: add FreeIPA server module and generic client script	2026-05-18 11:12:31 +02:00
freeipa-enroll.sh	Update setup/modules/FreeipaAnsible/freeipa-enroll.sh	2026-04-27 16:37:09 +02:00