CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Salt ACL

Browse Source
This commit is contained in:
Mike Reeves
2020-08-19 10:08:11 -04:00
parent 968e481ebe
commit 95f006db7d
1 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
salt/common/tools/sbin/soup
View File

@@ -87,6 +87,28 @@ highstate() {
salt-call state.highstate -l info salt-call state.highstate -l info
} }
masterlock() {
# Lock the ACL to just the manager
cp -v /etc/salt/master /etc/salt/master.upgrade
echo "peer:" >> /etc/salt/master
echo " *_manager:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
echo " *_standalone:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
echo " *_managersearch:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
echo " *_eval:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
echo " *_helix:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
echo " *_import:" >> /etc/salt/master
echo " - .*" >> /etc/salt/master
}
masterunlock() {
mv /etc/salt/master.upgrade /etc/salt/master
}
pillar_changes() { pillar_changes() {
# This function is to add any new pillar items if needed. # This function is to add any new pillar items if needed.
echo "Checking to see if pillar changes are needed." echo "Checking to see if pillar changes are needed."
@@ -343,6 +365,19 @@ copy_new_files
echo "" echo ""
update_version update_version
echo ""
echo "Locking down Salt Master for upgrade"
masterlock
echo ""
echo "Starting Salt Master service."
systemctl start salt-master
echo ""
echo "Stopping Salt Master to remove ACL"
systemctl stop salt-master
masterunlock
echo "" echo ""
echo "Starting Salt Master service." echo "Starting Salt Master service."