第 35 章 使用 Ansible 在 IdM 中配置 HBAC 和 sudo 规则

流程

1. 使用以下内容创建您的 Ansible playbook 文件 add-hbac-and-sudo-rules-to-idm.yml ：

   ---
   - name: Playbook to manage IPA HBAC and SUDO rules
     hosts: ipaserver
     become: false
     gather_facts: false
   
     vars_files:
     - /home/<user_name>/MyPlaybooks/secret.yml
   
     module_defaults:
       group/freeipa.ansible_freeipa.modules:
         ipaadmin_password: "{{ ipaadmin_password }}"
   
     tasks:
     - name: HBAC Rule for Jane - can log in to client01
       freeipa.ansible_freeipa.ipahbacrule: # Creates the rule
         name: Jane_rule
         hbacsvc:
         - sshd
         - login
         host: # Host name
         - client01.idm.example.com
         user:
         - jane
   
     - name: HBAC Rule for John - can log in to client02
       freeipa.ansible_freeipa.ipahbacrule: # Creates the rule
         name: john_rule
         hbacsvc:
         - sshd
         - login
         host: # Host name
         - client02.idm.example.com
         user:
         - john
   
     - name: Add user member alice to group admins
       freeipa.ansible_freeipa.ipagroup:
         name: admins
         action: member
         user:
         - alice
   
     - name: HBAC Rule for IdM administrators
       freeipa.ansible_freeipa.ipahbacrule: # Rule to allow admins full access
         name: admin_access # Rule name
         servicecat: all # All services
         hostcat: all # All hosts
         group: # User group
         - admins
   
       - name: Add reboot command to SUDO
         freeipa.ansible_freeipa.ipasudocmd:
           name: /usr/sbin/reboot
           state: present
       - name: Add less command to SUDO
         freeipa.ansible_freeipa.ipasudocmd:
           name: /usr/bin/less
           state: present
       - name: Add setenforce command to SUDO
         freeipa.ansible_freeipa.ipasudocmd:
           name: /usr/sbin/setenforce
           state: present
   
     - name: Create a SUDO command group
       freeipa.ansible_freeipa.ipasudocmdgroup:
         name: cmd_grp_1
         description: "Group of important commands"
         sudocmd:
         - /usr/sbin/setenforce
         - /usr/bin/less
         - /usr/sbin/reboot
         action: sudocmdgroup
         state: present
   
     - name: Create a SUDO rule with a SUDO command group
       freeipa.ansible_freeipa.ipasudorule:
         name: sudo_rule_1
         allow_sudocmdgroup:
         - cmd_grp_1
         group: admins
         state: present
   
     - name: Disable allow_all HBAC Rule
       freeipa.ansible_freeipa.ipahbacrule: # Rule to allow admins full access
         name: allow_all # Rule name
         state: disabled # Disables rule to allow everyone the ability to login

2. 运行 playbook：

   $ ansible-playbook --vault-password-file=password_file -i inventory add-hbac-and-sudo-rules-to-idm.yml

验证

1. 以 jane 用户身份连接到 client01：

   ~]$ ssh jane@client01
   Password:
   
   Last login: Fri Aug 11 15:32:18 2023 from 192.168.122.1
   [jane@client01 ~]$

   输出证明 jane 已登录到 client01。

2. 尝试以 jane 用户身份连接到 client02 ：

   ~]$ ssh jane@client02
   Password:
   Connection closed by 192.168.122.47 port 22

   输出证明 jane 无法登录到 client02。

3. 以 alice 用户身份连接到 client02 ：

   ~]$ ssh alice@client02
   Password:
   
   Last login: Fri Aug 10 16:13:43 2023 from 192.168.122.1

   输出证明 alice 已登录到 client02。

4. 尝试使用 less 查看 /etc/sssd/sssd.conf 文件的内容，而无需调用超级用户特权：

   [alice@client02 ~]$ less /etc/sssd/sssd.conf
   /etc/sssd/sssd.conf: Permission denied

   尝试失败，因为该文件对除了文件的所有者（即 root 用户）之外的任何人都不可读。

5. 调用 root 特权以使用 less 查看 /etc/sssd/sssd.conf 文件的内容：

   [alice@client02 ~]$ sudo less /etc/sssd/sssd.conf
   [sudo] password for alice:
   
   [domain/idm.example.com]
   
   id_provider = ipa
   ipa_server_mode = True
   [...]

   输出证明 alice 可以对 /etc/sssd/sssd.conf 文件执行 less 命令。