The_miro
/
Dotfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Dotfiles/setup/modules/FreeipaAnsible/ansible
History
Amir Alexander Abdelbaki 45fd7e5d36 feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo 
Introduces a FreeIPA host-group-driven policy system alongside a sudo
rules management playbook:

- ansipa-enforce-policies.sh: client-side enforcer (systemd timer, 30 min)
  - policy-block-binary-<name>: PATH-priority wrapper blocks the binary
  - policy-timeshift-backup: daily Timeshift snapshot cron (03:00)
  - policy-security-scan: daily ClamAV/rkhunter/chkrootkit cron (02:00)
  Policies are reversible — leaving a group removes enforcement on next run.

- deploy-ansipa-policies.yml: deploys enforcer + systemd service/timer to clients

- manage-sudo-rules.yml: creates FreeIPA sudo rules (allow_sudoers,
  allow_sudo_nopasswd) that SSSD clients already pick up via --sudo enrollment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 		2026-05-20 11:34:09 +02:00
..
ansipa-enforce-policies.sh feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo 2026-05-20 11:34:09 +02:00
ansipa-install-flatpaks.service setup: add FreeIPA Flatpak group installer (fp_install_* groups) 2026-05-18 11:52:27 +02:00
ansipa-install-flatpaks.sh setup: add FreeIPA Flatpak group installer (fp_install_* groups) 2026-05-18 11:52:27 +02:00
ansipa-install-flatpaks.timer setup: add FreeIPA Flatpak group installer (fp_install_* groups) 2026-05-18 11:52:27 +02:00
ansipa-install-modules.service setup: add freeipa-client module and FreeIPA group-based module automation 2026-05-18 11:40:51 +02:00
ansipa-install-modules.sh setup: add freeipa-client module and FreeIPA group-based module automation 2026-05-18 11:40:51 +02:00
ansipa-install-modules.timer setup: add freeipa-client module and FreeIPA group-based module automation 2026-05-18 11:40:51 +02:00
ansipa-install-packages.sh Add setup/modules/FreeipaAnsible/ansible/ansipa-install-packages.sh 2026-04-27 16:44:59 +02:00
ansipa-install.service Add setup/modules/FreeipaAnsible/ansible/ansipa-install.service 2026-04-27 16:44:01 +02:00
ansipa-install.timer Add setup/modules/FreeipaAnsible/ansible/ansipa-install.timer 2026-04-27 16:44:18 +02:00
auto-add-baseuser.sh Update setup/modules/FreeipaAnsible/ansible/auto-add-baseuser.sh 2026-04-27 16:37:39 +02:00
baseuser-sync.path Add setup/modules/FreeipaAnsible/ansible/baseuser-sync.path 2026-04-27 16:39:11 +02:00
baseuser-sync.service Add setup/modules/FreeipaAnsible/ansible/baseuser-sync.service 2026-04-27 16:38:37 +02:00
collect-luks-keys.yml ansible: add collect-luks-keys playbook for LUKS backup key archival 2026-05-18 15:25:05 +02:00
deploy-ansipa-install.yml setup: add FreeIPA Flatpak group installer (fp_install_* groups) 2026-05-18 11:52:27 +02:00
deploy-ansipa-modules.yml setup: add freeipa-client module and FreeIPA group-based module automation 2026-05-18 11:40:51 +02:00
deploy-ansipa-policies.yml feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo 2026-05-20 11:34:09 +02:00
deploy-baseuser-sync.yml Add setup/modules/FreeipaAnsible/ansible/deploy-baseuser-sync.yml 2026-04-27 16:39:34 +02:00
manage-sudo-rules.yml feat(freeipa): add policy enforcement for binary blocking, backups, scans, and sudo 2026-05-20 11:34:09 +02:00