#
# Common options for servers with 'ansible' installed
# >>> Included File: ../custom_includes/ansible
#
ADD_SYSTEM_FILE_OWNER=ansible
#
# Both the below may exist, an exact match to locate the appropriate is performed
SSHD_SUBSYSTEM_ALLOW=sftp:/usr/libexec/openssh/sftp-server:RHEL based servers
SSHD_SUBSYSTEM_ALLOW=sftp:/usr/lib/openssh/sftp-server:Debian based servers
#
SERVER_IS_ANSIBLE_NODE=YES
SERVER_ANSIBLE_NODE_GROUPNAME=ansible
SUDOERS_ALLOW_ALL_SERVERS=%ansible:
SUDOERS_ALLOW_ALL_COMMANDS=%ansible:
#
EXACT_ALERT_REASON=Insecure sudoers entry NOPASWD:%ansible ALL=(ALL) NOPASSWD: ALL
# And add some notes to append to the expected alert report.
EXACT_ALERT_REASON_NOTES=The quick-start documentation for using ansible recoemnds using
EXACT_ALERT_REASON_NOTES=a dangerous sudoers entry which will always alert. You should
EXACT_ALERT_REASON_NOTES=code explicit rules for only the commands the ansible group
EXACT_ALERT_REASON_NOTES=needs to use and should use the servername not ALL as a servername
EXACT_ALERT_REASON_NOTES=in sudoers entries.
