evolix/EvoBSD
21
0
Fork 0
Code Issues 2 Pull requests Releases 3 Wiki Activity
EvoBSD/roles/base/templates/doas.conf.j2

19 lines
1.3 KiB
Plaintext
Raw Normal View History

Add initial project
2018-12-28 11:23:49 +01:00
# {{ ansible_managed }}
Stricter ssh and doas access - two separate groups actually needed Fix #34 again After some discussions, with actually need two separates groups : - One group for ssh access (evobsd_ssh_group) - One group for sudo/doas access (evobsd_sudo_group) We won't need any client group. A client user will be added to the ssh group, so that we won't have to think about what specific group a user need to be added in.
2020-10-15 11:01:52 +02:00
permit setenv {SSH_AUTH_SOCK SSH_TTY PKG_PATH HOME=/root ENV=/root/.profile} :{{ evobsd_sudo_group }}
Add initial project
2018-12-28 11:23:49 +01:00
permit nopass root
We should be able to execute evomaintence.sh as soon as we can SSH to the server
2020-10-20 15:57:35 +02:00
permit setenv {ENV PS1 SSH_AUTH_SOCK SSH_TTY} nopass :{{ evobsd_ssh_group }} as root cmd /usr/share/scripts/evomaintenance.sh
Doas authorization for collectd We put the doas authorization for collectd in the global file and we let it if collectd is not there, because otherwise the authorization would be removed if the base role was run without the collectd role, even if collectd was still running. Collectd would have been broken.
2020-10-14 16:37:22 +02:00
permit nopass _collectd as root cmd /bin/cat
Add initial project
2018-12-28 11:23:49 +01:00
permit nopass _collectd as root cmd /usr/sbin/bgpctl
Doas permissions rearrangement
2020-04-21 16:18:07 +02:00
permit nopass _nrpe as root cmd /sbin/bioctl args sd2
Update NRPE and doas configuration for checks mailq and openvpn_certificates - Fix check_mailq : the check from monitoring-plugins current version is not compatible with opensmtpd. I picked the last version from the GIT repository, and adjusted nrpe and doas configuration - Add doas configuration for check_openvpn_certificates.sh : some servers need doas, others don't. Better to set it everywhere.
2021-07-27 18:02:49 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_mailq.pl
Replace all sudo occurences with doas
2019-07-15 18:25:25 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipsecctl.sh
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd_simple
Add initial project
2018-12-28 11:23:49 +01:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospfd
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ospf6d
Add OpenBGPD nrpe check with doas configuration
2020-04-21 14:25:42 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_openbgpd
Add initial project
2018-12-28 11:23:49 +01:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_pf_states
Replace sudo with doas
2019-07-15 17:44:05 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_connections_state.sh
Configure the check_packetfilter in NRPE with doas
2020-07-28 17:57:30 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_packetfilter.sh
Add a doas authorization for NRPE
2020-10-20 15:06:03 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_ipsecctl_critiques.sh
Update NRPE and doas configuration for checks mailq and openvpn_certificates - Fix check_mailq : the check from monitoring-plugins current version is not compatible with opensmtpd. I picked the last version from the GIT repository, and adjusted nrpe and doas configuration - Add doas configuration for check_openvpn_certificates.sh : some servers need doas, others don't. Better to set it everywhere.
2021-07-27 18:02:49 +02:00
permit nopass _nrpe as root cmd /usr/local/libexec/nagios/plugins/check_openvpn_certificates.sh
Reference in a new issue Copy permalink