76 lines
2.5 KiB
Bash
76 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
# policy: usr_scan-notify — scan alert notification daemon for IPA group members.
|
|
# When the usr_scan-notify user group exists: installs a systemd fetch-alerts timer
|
|
# (fleet-wide) and a profile.d snippet that starts the notification daemon on login
|
|
# for group members (checked at login time via id/SSSD).
|
|
|
|
FETCH_SVC="/etc/systemd/system/ansipa-fetch-alerts.service"
|
|
FETCH_TIMER="/etc/systemd/system/ansipa-fetch-alerts.timer"
|
|
NOTIFY_PROFILED="/etc/profile.d/ansipa-notify.sh"
|
|
|
|
if [[ "$WANT_SCAN_NOTIFY" == true ]]; then
|
|
if [[ ! -x /usr/local/bin/ansipa-fetch-alerts.sh ]]; then
|
|
warn "ansipa-fetch-alerts.sh not found — run deploy-ansipa-policies.yml first."
|
|
fi
|
|
|
|
if [[ ! -f "$FETCH_SVC" ]]; then
|
|
log "Installing ansipa-fetch-alerts systemd service + timer"
|
|
cat > "$FETCH_SVC" <<'UNIT'
|
|
[Unit]
|
|
Description=Fetch Ansipa security alerts from the server SMB share
|
|
After=network-online.target sssd.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/ansipa-fetch-alerts.sh
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
UNIT
|
|
|
|
cat > "$FETCH_TIMER" <<'UNIT'
|
|
[Unit]
|
|
Description=Periodic ansipa security alert fetch
|
|
|
|
[Timer]
|
|
OnBootSec=2min
|
|
OnUnitActiveSec=10min
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
UNIT
|
|
systemctl daemon-reload
|
|
systemctl enable --now ansipa-fetch-alerts.timer
|
|
log "ansipa-fetch-alerts.timer enabled"
|
|
fi
|
|
|
|
if [[ ! -f "$NOTIFY_PROFILED" ]]; then
|
|
log "Installing /etc/profile.d/ansipa-notify.sh"
|
|
cat > "$NOTIFY_PROFILED" <<'PROFILED'
|
|
# ansipa-notify: launch the scan alert notification daemon on login for
|
|
# members of the usr_scan-notify FreeIPA user group.
|
|
# Managed by ansipa-enforce-policies — do not edit manually.
|
|
_NOTIFY_DAEMON=/usr/local/bin/ansipa-scan-notify.sh
|
|
if [[ -x "$_NOTIFY_DAEMON" ]] && \
|
|
id -nG 2>/dev/null | grep -qw "usr_scan-notify" && \
|
|
! pgrep -u "$(id -u)" -f "ansipa-scan-notify" >/dev/null 2>&1; then
|
|
"$_NOTIFY_DAEMON" &
|
|
disown
|
|
fi
|
|
unset _NOTIFY_DAEMON
|
|
PROFILED
|
|
chmod 644 "$NOTIFY_PROFILED"
|
|
fi
|
|
else
|
|
if [[ -f "$FETCH_TIMER" ]]; then
|
|
systemctl disable --now ansipa-fetch-alerts.timer 2>/dev/null || true
|
|
rm -f "$FETCH_SVC" "$FETCH_TIMER"
|
|
systemctl daemon-reload
|
|
log "Removed ansipa-fetch-alerts timer (usr_scan-notify user group no longer exists)"
|
|
fi
|
|
if [[ -f "$NOTIFY_PROFILED" ]]; then
|
|
rm -f "$NOTIFY_PROFILED"
|
|
log "Removed /etc/profile.d/ansipa-notify.sh"
|
|
fi
|
|
fi
|