Skip to content
Snippets Groups Projects
Commit 2f621608 authored by Rafael Guterres Jeffman's avatar Rafael Guterres Jeffman
Browse files

New sudorule (Sudo Rule) management module

There is a new sudorule (Sudo Rule) management module placed in the plugins
folder:

  plugins/modules/ipasudorule.py

The sudorule module allows to ensure presence and absence of Sudo Rules.

Here is the documentation for the module:

  README-sudorule.md

New example playbooks have been added:

    playbooks/sudorule/ensure-sudorule-host-member-is-absent.yml
    playbooks/sudorule/ensure-sudorule-host-member-is-present.yml
    playbooks/sudorule/ensure-sudorule-hostgroup-member-is-absent.yml
    playbooks/sudorule/ensure-sudorule-hostgroup-member-is-present.yml
    playbooks/sudorule/ensure-sudorule-is-absent.yml
    playbooks/sudorule/ensure-sudorule-is-disabled.yml
    playbooks/sudorule/ensure-sudorule-is-enabled.yml
    playbooks/sudorule/ensure-sudorule-is-present.yml
    playbooks/sudorule/ensure-sudorule-sudocmd-is-absent.yml
    playbooks/sudorule/ensure-sudorule-sudocmd-is-present.yml

New tests added for the module:

  tests/hbacrule/test_sudorule.yml
parent 0c30020a
No related branches found
No related tags found
No related merge requests found
Showing
with 1114 additions and 0 deletions
Sudorule module
===============
Description
-----------
The sudorule (Sudo Rule) module allows to ensure presence and absence of Sudo Rules and host, hostgroups, users, and user groups as members of Sudo Rule.
Features
--------
* Sudo Rule management
Supported FreeIPA Versions
--------------------------
FreeIPA versions 4.4.0 and up are supported by the ipasudorule module.
Requirements
------------
**Controller**
* Ansible version: 2.8+
**Node**
* Supported FreeIPA version (see above)
Usage
=====
Example inventory file
```ini
[ipaserver]
ipaserver.test.local
```
Example playbook to make sure Sudo Rule is present:
```yaml
---
- name: Playbook to handle sudorules
hosts: ipaserver
become: true
tasks:
# Ensure Sudo Rule is present
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
```
Example playbook to make sure sudocmds are present in Sudo Rule:
```yaml
---
- name: Playbook to handle sudorules
hosts: ipaserver
become: true
tasks:
# Ensure Sudo Rule is present
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
cmd:
- /sbin/ifconfig
action: member
```
Example playbook to make sure sudocmds are not present in Sudo Rule:
```yaml
---
- name: Playbook to handle sudorules
hosts: ipaserver
become: true
tasks:
# Ensure Sudo Rule is present
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
cmd:
- /sbin/ifconfig
action: member
state: absent
```
Example playbook to make sure Sudo Rule is absent:
```yaml
---
- name: Playbook to handle sudorules
hosts: ipaserver
become: true
tasks:
# Ensure Sudo Rule is present
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
```
Variables
=========
ipasudorule
---------------
Variable | Description | Required
-------- | ----------- | --------
`ipaadmin_principal` | The admin principal is a string and defaults to `admin` | no
`ipaadmin_password` | The admin password is a string and is required if there is no admin ticket available on the node | no
`name` \| `cn` | The list of sudorule name strings. | yes
`description` | The sudorule description string. | no
`usercategory` | User category the rule applies to. Choices: ["all"] | no
`hostcategory` | Host category the rule applies to. Choices: ["all"] | no
`cmdcategory` | Command category the rule applies to. Choices: ["all"] | no
`nomembers` | Suppress processing of membership attributes. (bool) | no
`host` | List of host name strings assigned to this sudorule. | no
`hostgroup` | List of host group name strings assigned to this sudorule. | no
`user` | List of user name strings assigned to this sudorule. | no
`group` | List of user group name strings assigned to this sudorule. | no
`cmd` | List of sudocmd name strings assigned to this sudorule. | no
`cmdgroup` | List of sudocmd group name strings assigned wto this sudorule. | no
`action` | Work on sudorule or member level. It can be on of `member` or `sudorule` and defaults to `sudorule`. | no
`state` | The state to ensure. It can be one of `present`, `absent`, `enabled` or `disabled`, default: `present`. | no
Authors
=======
Rafael Jeffman
......@@ -20,6 +20,7 @@ Features
* Modules for pwpolicy management
* Modules for sudocmd management
* Modules for sudocmdgroup management
* Modules for sudorule management
* Modules for topology management
* Modules for user management
......@@ -403,6 +404,7 @@ Modules in plugin/modules
* [ipapwpolicy](README-pwpolicy.md)
* [ipasudocmd](README-sudocmd.md)
* [ipasudocmdgroup](README-sudocmdgroup.md)
* [ipasudorule](README-sudorule.md)
* [ipatopologysegment](README-topology.md)
* [ipatopologysuffix](README-topology.md)
* [ipauser](README-user.md)
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
# Ensure host server is absent in Sudo Rule
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
host: server
action: member
state: absent
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
# Ensure host server is present in Sudo Rule
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
host: server
action: member
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
# Ensure hostgroup cluster is absent in Sudo Rule
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
hostgroup: cluster
action: member
state: absent
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
# Ensure hostgrep cluster is present in Sudo Rule
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
hostgroup: cluster
action: member
---
- name: Tests
hosts: ipaserver
become: true
tasks:
# Ensure sudorule command is absent
- ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: absent
---
- name: Tests
hosts: ipaserver
become: true
tasks:
# Ensure sudorule command is disabled
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
state: disabled
---
- name: Tests
hosts: ipaserver
become: true
tasks:
# Ensure sudorule command is enabled
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
state: enabled
---
- name: Tests
hosts: ipaserver
become: true
tasks:
# Ensure sudorule command is present
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
description: A test sudo rule.
state: present
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
state: absent
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
- ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
This diff is collapsed.
---
- name: Tests
hosts: ipaserver
become: true
gather_facts: false
tasks:
- name: Ensure hostgroup is present, with a host.
ipahostgroup:
ipaadmin_password: MyPassword123
name: cluster
host:
- "{{ groups.ipaserver[0] }}"
- name: Ensure some sudocmds are available
ipasudocmd:
ipaadmin_password: pass1234
name:
- /sbin/ifconfig
- /usr/bin/vim
state: present
- name: Ensure sudorules are absent
ipasudorule:
ipaadmin_password: pass1234
name:
- testrule1
- allusers
- allhosts
- allcommands
state: absent
- name: Ensure sudorule is present
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
register: result
failed_when: not result.changed
- name: Ensure sudorule is present again
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
register: result
failed_when: result.changed
- name: Ensure sudorule is present, runAsUserCategory.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
runAsUserCategory: all
register: result
failed_when: result.changed
- name: Ensure sudorule is present, with usercategory 'all'
ipasudorule:
ipaadmin_password: pass1234
name: allusers
usercategory: all
register: result
failed_when: not result.changed
- name: Ensure sudorule is present, with usercategory 'all', again
ipasudorule:
ipaadmin_password: pass1234
name: allusers
usercategory: all
register: result
failed_when: result.changed
- name: Ensure sudorule is present, with hostategory 'all'
ipasudorule:
ipaadmin_password: pass1234
name: allhosts
hostcategory: all
register: result
failed_when: not result.changed
- name: Ensure sudorule is present, with hostategory 'all', again
ipasudorule:
ipaadmin_password: pass1234
name: allhosts
hostcategory: all
register: result
failed_when: result.changed
- name: Ensure sudorule is disabled
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: disabled
- name: Ensure sudorule is disabled, again
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: disabled
register: result
failed_when: result.changed
- name: Ensure sudorule is enabled
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: enabled
register: result
failed_when: not result.changed
- name: Ensure sudorule is enabled, again
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: enabled
register: result
failed_when: result.changed
- name: Ensure sudorule is present and some sudocmd are a member of it.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
register: result
failed_when: not result.changed
- name: Ensure sudorule is present and some sudocmd are a member of it, again.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
register: result
failed_when: result.changed
- name: Ensure sudorule is present with cmdcategory 'all'.
ipasudorule:
ipaadmin_password: pass1234
name: allcommands
cmdcategory: all
register: result
failed_when: not result.changed
- name: Ensure sudorule is present with cmdcategory 'all', again.
ipasudorule:
ipaadmin_password: pass1234
name: allcommands
cmdcategory: all
register: result
failed_when: result.changed
- name: Ensure host "{{ groups.ipaserver[0] }}" is present in sudorule.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
host: "{{ groups.ipaserver[0] }}"
action: member
register: result
failed_when: not result.changed
- name: Ensure host "{{ groups.ipaserver[0] }}" is present in sudorule, again.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
host: "{{ groups.ipaserver[0] }}"
action: member
register: result
failed_when: result.changed
- name: Ensure hostgroup is present in sudorule.
ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
hostgroup: cluster
action: member
register: result
failed_when: not result.changed
- name: Ensure hostgroup is present in sudorule, again.
ipasudorule:
ipaadmin_password: MyPassword123
name: testrule1
hostgroup: cluster
action: member
register: result
failed_when: result.changed
- name: Ensure sudorule sudocmds are absent
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
state: absent
register: result
failed_when: not result.changed
- name: Ensure sudorule sudocmds are absent, again
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
cmd:
- /sbin/ifconfig
- /usr/bin/vim
action: member
state: absent
register: result
failed_when: result.changed
- name: Ensure sudorule is absent
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: absent
register: result
failed_when: not result.changed
- name: Ensure sudorule is absent, again.
ipasudorule:
ipaadmin_password: pass1234
name: testrule1
state: absent
register: result
failed_when: result.changed
- name: Ensure sudorule allhosts is absent
ipasudorule:
ipaadmin_password: pass1234
name: allhosts
state: absent
register: result
failed_when: not result.changed
- name: Ensure sudorule allhosts is absent, again
ipasudorule:
ipaadmin_password: pass1234
name: allhosts
state: absent
register: result
failed_when: result.changed
- name: Ensure sudorule allusers is absent
ipasudorule:
ipaadmin_password: pass1234
name: allusers
state: absent
register: result
failed_when: not result.changed
- name: Ensure sudorule allusers is absent, again
ipasudorule:
ipaadmin_password: pass1234
name: allusers
state: absent
register: result
failed_when: result.changed
- name: Ensure sudorule allcommands is absent
ipasudorule:
ipaadmin_password: pass1234
name: allcommands
state: absent
register: result
failed_when: not result.changed
- name: Ensure sudorule allcommands is absent, again
ipasudorule:
ipaadmin_password: pass1234
name: allcommands
state: absent
register: result
failed_when: result.changed
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment