Skip to content

[ansible/platform] Make service user shells configurable#498

Open
omribz156 wants to merge 1 commit into
jfrog:masterfrom
omribz156:codex/service-user-shell-vars
Open

[ansible/platform] Make service user shells configurable#498
omribz156 wants to merge 1 commit into
jfrog:masterfrom
omribz156:codex/service-user-shell-vars

Conversation

@omribz156

Copy link
Copy Markdown

PR Checklist

  • Title of the PR starts with installer/product name (e.g. [ansible/artifactory])
  • CHANGELOG.md updated
  • Variables and other changes are documented in the README.md

What this PR does / why we need it:

Adds service-user shell variables for the Ansible Platform roles:

  • artifactory_user_shell
  • xray_user_shell
  • distribution_user_shell

The defaults remain /bin/bash, so existing behavior is unchanged. Operators who need non-interactive service accounts can now set the relevant variable to /sbin/nologin, /usr/sbin/nologin, or another site-approved shell without patching the role tasks.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #488

Verification:

  • git diff --check
  • Parsed touched defaults/task YAML files with PyYAML.
  • rg "user_shell|service user shell|shell:" -n Ansible\ansible_collections\jfrog\platform\roles\artifactory Ansible\ansible_collections\jfrog\platform\roles\xray Ansible\ansible_collections\jfrog\platform\roles\distribution Ansible\ansible_collections\jfrog\platform\CHANGELOG.md

Not run:

  • ansible / ansible-lint, because they are not installed in this Windows workspace.

Special notes for your reviewer:

I kept the default shell unchanged to avoid a behavior change for existing installations; this only exposes the hardening knob.

This was implemented with Codex assistance, with the patch kept focused and manually reviewed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ansible/platform] Service accounts are created with interactive bash login shells

1 participant