EvoBSD/roles/base/templates/doas.conf.j2

# {{ ansible_managed }}
permit setenv {SSH_AUTH_SOCK SSH_TTY PKG_PATH HOME=/root ENV=/root/.profile} :{{ evobsd_group }}
permit nopass root
permit setenv {ENV PS1 SSH_AUTH_SOCK SSH_TTY} nopass :{{ evobsd_group }} as root cmd /usr/share/scripts/evomaintenance.sh
permit nopass _collectd as root cmd /usr/sbin/bgpctl
permit nopass _nrpe as root cmd /sbin/bioctl args sd2
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/check_mailq
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/check_dhcp
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipsecctl.sh
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd_simple
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospf6d
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_openbgpd
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_pf_states
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_connections_state.sh
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_packetfilter.sh
Add initial project 2018-12-28 11:23:49 +01:00			`# {{ ansible_managed }}`
Stricter ssh and doas access - better version Fix #34 We now use a unique evobsd_group (evolix by default). Each user has 2 groups : evobsd_group and user.name. Only evobsd_group can ssh to server and use doas. I also added a password restrictions block for IPs/group. And we make sure the home folder is only readable by owner. 2020-10-13 16:03:54 +02:00			`permit setenv {SSH_AUTH_SOCK SSH_TTY PKG_PATH HOME=/root ENV=/root/.profile} :{{ evobsd_group }}`
Add initial project 2018-12-28 11:23:49 +01:00			`permit nopass root`
Stricter ssh and doas access - better version Fix #34 We now use a unique evobsd_group (evolix by default). Each user has 2 groups : evobsd_group and user.name. Only evobsd_group can ssh to server and use doas. I also added a password restrictions block for IPs/group. And we make sure the home folder is only readable by owner. 2020-10-13 16:03:54 +02:00			`permit setenv {ENV PS1 SSH_AUTH_SOCK SSH_TTY} nopass :{{ evobsd_group }} as root cmd /usr/share/scripts/evomaintenance.sh`
Add initial project 2018-12-28 11:23:49 +01:00			`permit nopass _collectd as root cmd /usr/sbin/bgpctl`
Doas permissions rearrangement 2020-04-21 16:18:07 +02:00			`permit nopass _nrpe as root cmd /sbin/bioctl args sd2`
Replace all sudo occurences with doas 2019-07-15 18:25:25 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/check_mailq`
Doas permissions rearrangement 2020-04-21 16:18:07 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/check_dhcp`
Replace all sudo occurences with doas 2019-07-15 18:25:25 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipsecctl.sh`
			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd_simple`
Add initial project 2018-12-28 11:23:49 +01:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd`
			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospf6d`
Add OpenBGPD nrpe check with doas configuration 2020-04-21 14:25:42 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_openbgpd`
Add initial project 2018-12-28 11:23:49 +01:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_pf_states`
Replace sudo with doas 2019-07-15 17:44:05 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_connections_state.sh`
Configure the check_packetfilter in NRPE with doas 2020-07-28 17:57:30 +02:00			`permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_packetfilter.sh`