From 6eac650a10cc5cedfe81d563c5af6413c08541cd Mon Sep 17 00:00:00 2001 From: Greg Sutcliffe Date: Wed, 1 Jul 2026 13:25:24 +0100 Subject: [PATCH] Nagios: remove nrpe from a bunch of smaller things Signed-off-by: Greg Sutcliffe --- roles/haproxy/templates/haproxy.cfg | 2 +- roles/ipa/client/templates/fedora-nss-ignore.conf.j2 | 8 ++++---- roles/pagure/tasks/selinux.yml | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/roles/haproxy/templates/haproxy.cfg b/roles/haproxy/templates/haproxy.cfg index 5e565f2e00..8f449d3c2a 100644 --- a/roles/haproxy/templates/haproxy.cfg +++ b/roles/haproxy/templates/haproxy.cfg @@ -5,7 +5,7 @@ global user haproxy group haproxy daemon - stats socket /var/run/haproxy-stat user haproxy group nrpe mode 0664 + stats socket /var/run/haproxy-stat user haproxy group zabbix mode 0664 stats socket /var/run/haproxy-admin level admin user root group root mode 0660 #debug #quiet diff --git a/roles/ipa/client/templates/fedora-nss-ignore.conf.j2 b/roles/ipa/client/templates/fedora-nss-ignore.conf.j2 index 00d427158c..be3da6ab45 100644 --- a/roles/ipa/client/templates/fedora-nss-ignore.conf.j2 +++ b/roles/ipa/client/templates/fedora-nss-ignore.conf.j2 @@ -6,13 +6,13 @@ ## creating restricted accounts but we want to make sure the id in ## /etc/passwd and /etc/group are used. [nss] -filter_users = root,bin,daemon,adm,lp,sync,shutdown,halt,mail,operator,games,ftp,nobody,avahi-autoipd,dbus,polkitd,rpc,tss,ntp,rpcuser,nfsnobody,postfix,sshd,nagios,nrpe,openvpn,chrony,sssd,named,apache,blockerbugs,mirrormanager,postgres,zabbix,ftbfs,masher,git,paguremirroring -filter_groups = root,bin,daemon,sys,adm,tty,disk,lp,mem,kmem,wheel,cdrom,mail,man,dialout,floppy,games,tape,video,ftp,lock,audio,nobody,users,utmp,utempter,avahi-autoipd,ssh_keys,systemd-journal,dbus,rpc,tss,ntp,dip,rpcuser,nfsnobody,postdrop,postfix,sshd,screen,nagios,nrpe,openvpn,input,systemd-bus-proxy,systemd-network,cgred,chrony,printadmin,sssd,named,apache,blockerbugs,mirrormanager,postgres,ftbfs,masher,git,paguremirroring +filter_users = root,bin,daemon,adm,lp,sync,shutdown,halt,mail,operator,games,ftp,nobody,avahi-autoipd,dbus,polkitd,rpc,tss,ntp,rpcuser,nfsnobody,postfix,sshd,nagios,openvpn,chrony,sssd,named,apache,blockerbugs,mirrormanager,postgres,zabbix,ftbfs,masher,git,paguremirroring +filter_groups = root,bin,daemon,sys,adm,tty,disk,lp,mem,kmem,wheel,cdrom,mail,man,dialout,floppy,games,tape,video,ftp,lock,audio,nobody,users,utmp,utempter,avahi-autoipd,ssh_keys,systemd-journal,dbus,rpc,tss,ntp,dip,rpcuser,nfsnobody,postdrop,postfix,sshd,screen,nagios,openvpn,input,systemd-bus-proxy,systemd-network,cgred,chrony,printadmin,sssd,named,apache,blockerbugs,mirrormanager,postgres,ftbfs,masher,git,paguremirroring {% else %} ## This file contains users who are in ipa to stop people from ## creating restricted accounts but we want to make sure the id in ## /etc/passwd and /etc/group are used. [nss] -filter_users = root,bin,daemon,adm,lp,sync,shutdown,halt,mail,operator,games,ftp,nobody,avahi-autoipd,dbus,polkitd,rpc,tss,ntp,rpcuser,nfsnobody,postfix,sshd,nagios,nrpe,openvpn,chrony,sssd,named,mock,apache,bodhi,ftpsync,blockerbugs,mirrormanager,rabbitmq,postgres,rawhide,mysql,zabbix,pagure,ftbfs,masher,git,paguremirroring -filter_groups = root,bin,daemon,sys,adm,tty,disk,lp,mem,kmem,wheel,cdrom,mail,man,dialout,floppy,games,tape,video,ftp,lock,audio,nobody,users,utmp,utempter,avahi-autoipd,ssh_keys,systemd-journal,dbus,rpc,tss,ntp,dip,rpcuser,nfsnobody,postdrop,postfix,sshd,screen,nagios,nrpe,openvpn,input,systemd-bus-proxy,systemd-network,cgred,chrony,printadmin,sssd,named,mock,apache,blockerbugs,mirrormanager,rabbitmq,postgres,rawhide,mysql,pagure,ftbfs,masher,git,paguremirroring +filter_users = root,bin,daemon,adm,lp,sync,shutdown,halt,mail,operator,games,ftp,nobody,avahi-autoipd,dbus,polkitd,rpc,tss,ntp,rpcuser,nfsnobody,postfix,sshd,nagios,openvpn,chrony,sssd,named,mock,apache,bodhi,ftpsync,blockerbugs,mirrormanager,rabbitmq,postgres,rawhide,mysql,zabbix,pagure,ftbfs,masher,git,paguremirroring +filter_groups = root,bin,daemon,sys,adm,tty,disk,lp,mem,kmem,wheel,cdrom,mail,man,dialout,floppy,games,tape,video,ftp,lock,audio,nobody,users,utmp,utempter,avahi-autoipd,ssh_keys,systemd-journal,dbus,rpc,tss,ntp,dip,rpcuser,nfsnobody,postdrop,postfix,sshd,screen,nagios,openvpn,input,systemd-bus-proxy,systemd-network,cgred,chrony,printadmin,sssd,named,mock,apache,blockerbugs,mirrormanager,rabbitmq,postgres,rawhide,mysql,pagure,ftbfs,masher,git,paguremirroring {% endif %} diff --git a/roles/pagure/tasks/selinux.yml b/roles/pagure/tasks/selinux.yml index 2c65e2ffca..eef9e98bba 100644 --- a/roles/pagure/tasks/selinux.yml +++ b/roles/pagure/tasks/selinux.yml @@ -101,10 +101,10 @@ - selinux - pagure -- name: Set sebooleans so allow nagios/nrpe to call sudo from NRPE utils scripts +- name: Set sebooleans to deny nagios/nrpe to call sudo as it's gone ansible.posix.seboolean: name: nagios_run_sudo - state: true + state: false persistent: true tags: - config