klecker: a few rules for security folks to interact with dak and archvsync. copied...

diff --git a/manifests/site.pp b/manifests/site.pp
index d5c3ad7ef83022422b12da6100b784cd4eff7471..0519f25df96196859bb639326ffdffc4cc7d8dd1 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -45,7 +45,7 @@ node default {
 
     # test here first
     case $hostname {
-        handel,geo1,geo2,geo3,wieck,brahms,bartok,spohr,sperger,carver,rore,malo,peri,penalosa,praetorius,schein,villa,lobos,steffani,kassia,pergolesi,lafayette,rem,albeniz,goetz,smetana,allegri,puccini,ball,argento,arcadelt,dijkstra,schumann,caballero,voltaire,pescetti,mundy,agricola,goedel,lebrun,mayer,mayr,merulo,morales,murphy,paer,saens,schroeder,spontini,widor,zelenka,agnesi,piatti,powell,samosa,gluck,rietz,unger,tartini,mahler,raff,chopin,ravel,ries,master,merkel:    { include sudo }
+        handel,geo1,geo2,geo3,wieck,brahms,bartok,spohr,sperger,carver,rore,malo,peri,penalosa,praetorius,schein,villa,lobos,steffani,kassia,pergolesi,lafayette,rem,albeniz,goetz,smetana,allegri,puccini,ball,argento,arcadelt,dijkstra,schumann,caballero,voltaire,pescetti,mundy,agricola,goedel,lebrun,mayer,mayr,merulo,morales,murphy,paer,saens,schroeder,spontini,widor,zelenka,agnesi,piatti,powell,samosa,gluck,rietz,unger,tartini,mahler,raff,chopin,ravel,ries,master,merkel,klecker:    { include sudo }
         default:   {}
     }
 }

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index 11fce4590338fb7a3bf37c71b4b1ab4ed6f95756..10e850bf5bf88cab8d012cbd98522c1c7421f793 100644 (file)
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -99,3 +99,10 @@ dak          ries=(archvsync)        NOPASSWD:/home/archvsync/runmirrors
 # dak stuff
 %debian-release        ries=(dak)              /usr/local/bin/dak transitions --import *
 %ftpteam       ries=(dak)              /usr/local/bin/dak transitions --import *
+# security
+%security      klecker=(dak)           NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
+%sec_public    klecker=(dak)           NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
+%sec_data      klecker=(archvsync)     NOPASSWD: /home/archvsync/security/signal ""
+dak            klecker=(archvsync)     NOPASSWD: /home/archvsync/signal_security
+# web stuff
+debwww         klecker=(archvsync)     NOPASSWD: /home/archvsync/webmirrors/runmirrors

diff --git a/modules/sudo/files/per-host/klecker.debian.org/sudoers b/modules/sudo/files/per-host/klecker.debian.org/sudoers
deleted file mode 100644 (file)
index a8bab5d..0000000
--- a/modules/sudo/files/per-host/klecker.debian.org/sudoers
+++ /dev/null
@@ -1,52 +0,0 @@
-##
-## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-##
-
-# /etc/sudoers
-#
-# This file MUST be edited with the 'visudo' command as root.
-#
-# See the man page for details on how to write a sudoers file.
-#
-
-# Host alias specification
-
-# User alias specification
-
-# Cmnd alias specification
-
-# User privilege specification
-root   ALL=(ALL) ALL
-jeroen ALL=(ALL) ALL
-
-%adm   ALL=(ALL) ALL
-%adm    ALL=(ALL) NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none
-
-# Security
-%security klecker=(dak) NOPASSWD:/usr/local/bin/dak new-security-install -[AR] -- *
-%sec_public klecker=(dak) NOPASSWD:/usr/local/bin/dak new-security-install -[AR] -- *
-%sec_data klecker=(archvsync) NOPASSWD: /home/archvsync/security/signal ""
-
-# ftpmaster
-%debadmin ALL=(root) NOPASSWD:/bin/su - dak, (dak) NOPASSWD: ALL
-dak      ALL=(archvsync) NOPASSWD:/home/archvsync/runmirrors, NOPASSWD:/home/archvsync/rundebbugs, NOPASSWD:/home/archvsync/runpackageweb, NOPASSWD:/home/archvsync/signal_security
-
-# www-master
-debwww klecker=(archvsync) NOPASSWD:/home/archvsync/webmirrors/runmirrors
-# Updating the web pages
-%debwww ALL=(debwww) ALL
-
-%apachectrl     ALL=(root) /usr/sbin/apache2-vhost-update
-
-# mirroradm
-%mirroradm ALL=(archvsync) ALL
-
-nagios  ALL=(ALL) NOPASSWD: /usr/bin/arrayprobe ""
-nagios  ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/hpacucli controller all show
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd all show
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]\:[0-9] show
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]I\:[0-9]\:[0-9] show
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/hpacucli controller slot=0 show status
-nagios  ALL=(ALL) NOPASSWD: /usr/sbin/samhain -t check --foreground -p err -s none -l none -m none