With Salt, sudo files content are now managed from rOPS.

Next: configure DNS records

Will need to be revisited when we switch to acme.sh.

Patched it live.

Bruteforce attack scenario possible, so we're only interested by usernames defined in users.sls, not by "root" (can't login by SSH) or generic accounts like "docker" (doesn't exist):

Same issue for rhyne-wyse.log. Configuration was copied from acme.sh one.

Credentials have been hashed directly in Vault, so we don't need to manipulate cleartext password with Salt.
Salt updated the tomcat-users.xml accordingly.

The full /etc/nginx directories on both docker-002 and dwellers use httpd_config_t for every file.

Alternatively, we made a lot of progress on this in T2124.

So, there is a new reason to do the upgrade.

First step is to create a script to renew all needed certificates:

Une fois que tu as retrouvé les accès SSH pour le web statique:

• WindRiver: automatiquement https://windriver.nasqueron.org/~xcombelle est disponible si tu places des fichiers dans /var/home-wwwroot/xcombelle (je ne sais plus si ça se crée automatiquement avec symlink vers $HOME/public_html, à vérifier)
• Eglide: https://www.eglide.org/~xcombelle pour $HOME/public_html

So, to get routing back:

Not sure of the current benefit to use TC2.

This is still needed for acme.sh if we want to provision different *.nasqueron.org certificates on different servers.

Salt SELinux module issue