Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

rkhunter exceptions for ipa servers

Browse source
This commit is contained in:
clime 2016-09-07 11:15:25 +02:00 • committed by Kevin Fenzi
parent b5e7b32258
commit 8de8e4d99c
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
inventory/inventory
View file

@ -381,6 +381,9 @@ batcave01.phx2.fedoraproject.org
[batcave]
batcave01.phx2.fedoraproject.org
[ipa]
ipa01.phx2.fedoraproject.org
[ipa-stg]
ipa01.stg.phx2.fedoraproject.org

6
roles/rkhunter/templates/rkhunter.conf.j2
View file

@ -390,6 +390,9 @@ ALLOWDEVFILE=/dev/shm/squid-cache_mem.shm
# libvirt spice device makes a /dev/shm/spice file
ALLOWDEVFILE=/dev/shm/spice.*
{% endif %}
{% if inventory_hostname in groups['ipa'] or inventory_hostname in groups['ipa-stg'] %}
ALLOWDEVFILE=/dev/shm/sem.slapd*.stats
{% endif %}
#
# This setting tells rkhunter where the inetd configuration
@ -601,6 +604,9 @@ OS_VERSION_FILE=/etc/{{ ansible_distribution|lower }}-release
#
#RTKT_DIR_WHITELIST=""
#RTKT_FILE_WHITELIST=""
{% if inventory_hostname in groups['ipa'] or inventory_hostname in groups['ipa-stg'] %}
RTKT_FILE_WHITELIST="/var/log/pki/pki-tomcat/ca/system"
{% endif %}
#
# To force rkhunter to use the supplied script for the 'stat' or 'readlink'