42 lines
2.0 KiB
Bash
42 lines
2.0 KiB
Bash
# The web server is this VM, with SELinux enforcing and no Apache yet.
|
|
[ "$(getenforce 2>/dev/null)" = Enforcing ] || refuse "SELinux must be enforcing (getenforce); set it back first"
|
|
pkg_installed httpd && refuse "Apache (httpd) is already installed; this lab installs it from scratch, so use a VM without it"
|
|
[ -e /srv/www ] && refuse "/srv/www already exists; move it away first"
|
|
listening 80 tcp && refuse "something already listens on port 80"
|
|
listening 8888 tcp && refuse "something already listens on port 8888"
|
|
|
|
# The control node: ansible-core, semanage for checking, and greg's
|
|
# project, with sudo without a password for the localhost plays.
|
|
for p in ansible-core policycoreutils-python-utils; do
|
|
pkg_installed $p || { echo $p >>"$LAB_STATE/missing"; pkg_install $p; }
|
|
done
|
|
if semanage fcontext -l -C | grep -q '^/srv/www'; then refuse "there's already a file context rule for /srv/www (semanage fcontext -l -C)"; fi
|
|
if semanage port -l -C | grep -Eq '[ ,]8888(,|$)'; then refuse "port 8888 already has a local SELinux label (semanage port -l -C)"; fi
|
|
user_add greg
|
|
printf 'greg ALL=(ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/le-lab-greg
|
|
chmod 440 /etc/sudoers.d/le-lab-greg
|
|
install -d -m 755 -o greg -g greg /home/greg/ansible
|
|
cat >/home/greg/ansible/ansible.cfg <<'X'
|
|
[defaults]
|
|
inventory = inventory
|
|
host_key_checking = false
|
|
|
|
[privilege_escalation]
|
|
become = true
|
|
X
|
|
printf '[webservers]\nlocalhost ansible_connection=local\n' >/home/greg/ansible/inventory
|
|
chown greg: /home/greg/ansible/ansible.cfg /home/greg/ansible/inventory
|
|
# What's installed here now; reset removes what the tasks add.
|
|
rpm -qa --qf '%{NAME}\n' | sort -u >"$LAB_STATE/rpms"
|
|
|
|
# Task 2 starts off.
|
|
state_set boolean "$(getsebool httpd_can_network_connect | awk '{print $NF}')"
|
|
setsebool -P httpd_can_network_connect off
|
|
# The firewall, as it is, for reset.
|
|
if active firewalld; then
|
|
touch "$LAB_STATE/firewalld"
|
|
firewall-cmd -q --permanent --query-service=http && touch "$LAB_STATE/had-http"
|
|
firewall-cmd -q --permanent --query-port=8888/tcp && touch "$LAB_STATE/had-8888"
|
|
fi
|
|
true
|