Chapter 31. Configuring a system for session recording by using RHEL system roles

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording
     hosts: managed-node-01.example.com
     tasks:
       - name: Enable session recording for specific users
         ansible.builtin.include_role:
           name: rhel-system-roles.tlog
     vars:
       tlog_scope_sssd: some
       tlog_users_sssd:
         - <recorded_user>

   tlog_scope_sssd: <value>

   The some value specifies you want to record only certain users and groups, not all or none.

   tlog_users_sssd:: <list_of_users>

   A YAML list of users you want to record a session from. Note that the role does not add users if they do not exist.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Check the SSSD drop-in file’s content:

   # cat cd /etc/sssd/conf.d/sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

2. Log in as a user whose session will be recorded.
3. Play back a recorded session.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording excluding users and groups
     hosts: managed-node-01.example.com
     tasks:
       - name: Exclude users and groups
         ansible.builtin.include_role:
           name: rhel-system-roles.tlog
         vars:
           tlog_scope_sssd: all
           tlog_exclude_users_sssd:
             - jeff
             - james
           tlog_exclude_groups_sssd:
             - admins

   tlog_scope_sssd: <value>

   The value all specifies that you want to record all users and groups.

   tlog_exclude_users_sssd: <user_list>

   A YAML list of users user names you want to exclude from the session recording.

   tlog_exclude_groups_sssd: <group_list>

   A YAML list of groups you want to exclude from the session recording.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Check the SSSD drop-in file’s content:

   # cat cd /etc/sssd/conf.d/sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

2. Log in as a user whose session will be recorded.
3. Play back a recorded session.