D1333.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D1333.diff
View Options

	diff --git a/roles/bastion/yubico/init.sls b/roles/bastion/yubico/init.sls
	--- a/roles/bastion/yubico/init.sls
	+++ b/roles/bastion/yubico/init.sls
	@@ -10,3 +10,4 @@

	include:
	- .authorized_yubikeys
	+ - .selinux
	diff --git a/roles/bastion/yubico/selinux.sls b/roles/bastion/yubico/selinux.sls
	new file mode 100644
	--- /dev/null
	+++ b/roles/bastion/yubico/selinux.sls
	@@ -0,0 +1,23 @@
	+# -------------------------------------------------------------
	+# Salt — Bastion - Yubikeys
	+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	+# Project: Nasqueron
	+# Created: 2018-02-18
	+# License: Trivial work, not eligible to copyright
	+# -------------------------------------------------------------
	+
	+{% if grains['os_family'] == 'RedHat' %}
	+
	+# On Fedora and downstreams, SELinux restricts the capability
	+# of SSHD to connect to external servers.
	+#
	+# From Fedora 18, a flag to allow connection for Yubikeys
	+# authentication has been provided.
	+#
	+# Reference: https://bugzilla.redhat.com/show_bug.cgi?id=841693
	+
	+selinux_authlogin_yubikey:
	+ cmd.run:
	+ - name: setsebool -P authlogin_yubikey 1
	+
	+{% endif %}