Granting access to a host
You can (and probably should) use the bundle uio_grant_access to give users and groups access to your hosts. It is used as follows:
vars:
"math_admin_access" slist => {
"@matinst-drift",
"terjekv-test",
};
"math_default_access" slist => {
"@matinst-ansatte",
"@matinst-studenter",
};
methods:
linux.matte_net::
"Grant @matinst-drift and terjekv-test access to all math hosts "
usebundle => uio_grant_access( "$(math_admin_access)" );
linux.matte_net.!math_admin_hosts::
"Grant default user groups access to non-admin math hosts"
usebundle => uio_grant_access( "$(math_default_access)" );
In the lists, users are listed as-is, with netgroups written as @groupname as is custom. The bundle supports RHEL7, RHEL8, and RHEL9 (as well as the same CentOS versions. On RHEL7 the bundle edits /etc/passwd, on RHEL8+ it creates /etc/security/access.d/80-cfengine-grant-all.conf.
On RHEL8+ it will grant the users and groups access from the source "ALL". If you want something else (ie, one group or user only gets to have access from a specific IP), you will currently have to create your own file under /etc/security/access.d/. Please note that this directory is controlled via CFEngine, and it strictly requires a specific file naming scheme you have to ensure that the SELinux contexts are correct. See inputs/hardening.cf in the CFEngine tree for more information.
Extended documentation on pam_access can be found on USITs pages (in Norwegian only).
Setting up app-sync
Using app-sync for USIT-supported scientific software is supported by CFEngine. It is done as follows:
vars:
"math_default_appsync_apps" slist => {
"matlab",
"maple",
};
methods:
rhel_centos_78.matte_net.math_default::
"Prepare app-sync applications for installation at math"
usebundle => uio_app_sync( "$(math_default_appsync_apps)" );
Note that this does not install the applications, it merely creates the appropriate directories so that the daily / nightly app-sync job will pull the apps. If you need the apps immediately, you can run app-sync update on the host. For Matlab, this will take time. A lot of time.
Disabling Wayland
For RHEL8, Wayland causes issues on some hardware, especially Nvidia hardware, but also i915-based chipsets. Typical issues are flicking windows, Xwayland crashes, and applications that just refuse to work. The bundle does not affect distributions it is unfamiliar with, nor does affect machines without GDM installed.
methods: rhel_centos_8.matte_net:: "Disable Wayland" usebundle => uio_disable_wayland();
Extensions for RHEL8+
Fix Gnome3. By default in RHEL8+ there is no apps-menu, no places-menu, no window-list, no desktop-icons, and no drive-menu. These are extensions. Some are installed by default, but others need to be added, so add the following packages to RHEL8:
gnome-tweaks, gnome-shell-extension-drive-menu
To enable them, do:
[root@ninlil ~]# cat /etc/dconf/db/local.d/00-extensions [org/gnome/shell] # List all extensions that you want to have enabled for all users enabled-extensions=['apps-menu@gnome-shell-extensions.gcampax.github.com', 'drive-menu@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'window-list@gnome-shell-extensions.gcampax.github.com', 'desktop-icons@gnome-shell-extensions.gcampax.github.com']
This can be resolved via CFEngine:
files:
rhel_centos_8.matte_net::
"/etc/dconf/db/local.d/00-extensions"
copy_from => repocopy("redhat_rhel8/etc/dconf/db/local.d/00-extensions"),
perms => mog("755", "root", "root"),
action => immediate,
create => "true",
pathtype => "literal",
comment => "Install dconf configuration for default extensions",
classes => if_repaired("mi_dconf_repaired");
commands:
rhel_centos_8.matte_net.mi_dconf_repaired::
"/usr/bin/dconf update"
comment => "Update dconf";
"/usr/bin/chmod 644 /etc/dconf/db/local"
comment => "Ensure that the generated local dconf database is readable.";
And then do dconf update (or boot). Users with existing configs need to have ~/.config/dconf/user removed for this to reinitalized!
Using yum groups
Yum groups are supported via the yum_group method, but you need to use the real/short name of the group:
# yum grouplist -v [... lots of noise ...] Available Environment Groups: Server with GUI (graphical-server-environment) Server (server-product-environment) Minimal Install (minimal-environment) KDE Plasma Workspaces (kde-desktop-environment) Virtualization Host (virtualization-host-environment) Custom Operating System (custom-environment) Installed Environment Groups: Workstation (workstation-product-environment) Installed Groups: System Tools (system-tools) Development Tools (development) Available Groups: Container Management (container-management) .NET Core Development (dotnet-core) RPM Development Tools (rpm-development-tools) Smart Card Support (smart-card) Headless Management (headless-management) Security Tools (security-tools) Network Servers (network-server) Scientific Support (scientific) Graphical Administration Tools (graphical-admin-tools) Legacy UNIX Compatibility (legacy-unix) Additional Virtualization Tools (virtualization) Java Base (java-base) Java Database (java-database) Misc (misc) Java Browser (java-browser) Red Hat Satellite Tools (sat-tools) Fedora Packager (fedora-packager)
So for yum groups you need to use the name in the parentheses. Ie, development, not Development Tools. You can see a brief list by using the following command:
# yum grouplist -v|awk '$0 ~ /^Done$/ {next} {sub(/.*\(/, "");sub(/\).*/, "")} /Available/ {h="a";next} /Installed/ {h="i";next} h=="i" || h=="a" {print h" "$0" 1"}'
a graphical-server-environment 1
a server-product-environment 1
a minimal-environment 1
a kde-desktop-environment 1
a virtualization-host-environment 1
a custom-environment 1
i workstation-product-environment 1
i system-tools 1
i development 1
a container-management 1
a dotnet-core 1
a rpm-development-tools 1
a smart-card 1
a headless-management 1
a security-tools 1
a network-server 1
a scientific 1
a graphical-admin-tools 1
a legacy-unix 1
a virtualization 1
a java-base 1
a java-database 1
a misc 1
a java-browser 1
a sat-tools 1
a fedora-packager 1
Here the group names are given with ease. To get more information about a group you can use yum groupinfo groupname.