Implement signed fixes by default #6
42
roles/prereq/files/samba-downgrade_20161124.sh
Normal file
42
roles/prereq/files/samba-downgrade_20161124.sh
Normal file
@ -0,0 +1,42 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Define a fix name. This will be used to check if the fix was already
|
||||
# applied.
|
||||
name=samba-downgrade_20161124.sh
|
||||
|
||||
# If already applied, skip
|
||||
if [[ -f "/var/lib/topolin.ia/fixes/${name}.done" ]]; then
|
||||
echo "Already fixed with ${name}. Skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Make the required modifications.
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get install -q -y --force-yes \
|
||||
-o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
|
||||
libsmbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
python-samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba-common=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba-common-bin=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba-dsdb-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba-libs=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
samba-vfs-modules=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
smbclient=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
libnss-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
libpam-winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
libwbclient0=2:4.3.11+dfsg-0ubuntu0.14.04.1 \
|
||||
winbind=2:4.3.11+dfsg-0ubuntu0.14.04.1
|
||||
|
||||
pkglist="libsmbclient python-samba samba-common samba-common-bin samba-dsdb-modules samba-libs samba-vfs-modules smbclient libnss-winbind libpam-winbind libwbclient0"
|
||||
|
||||
for pkg in ${pkglist}; do
|
||||
apt-mark auto ${pkg}
|
||||
apt-mark hold ${pkg}
|
||||
done
|
||||
|
||||
# Once modified the system, ensure to create a check file to skip and not run
|
||||
# it again if not needed.
|
||||
mkdir -p /var/lib/topolin.ia/fixes
|
||||
echo "$(date --iso | tr -d '-')" > /var/lib/topolin.ia/fixes/${name}.done
|
18
roles/prereq/tasks/fixes.yml
Normal file
18
roles/prereq/tasks/fixes.yml
Normal file
@ -0,0 +1,18 @@
|
||||
---
|
||||
# Permits to apply per-site signed fixes automatically
|
||||
#
|
||||
# Prepare a script file, then crypt it with the Domain Administrator password:
|
||||
# gpg -r info@bglug.it --symmetric --encrypt script.sh > script.sh.gpg
|
||||
#
|
||||
# Put the script within the server directory /var/lib/nethserver/ibay/ks/fixes
|
||||
#
|
||||
# List the file within domain.yml:
|
||||
# apply_fixes:
|
||||
# - script.sh.gpg
|
||||
#
|
||||
# Please see roles/prereq/files/samba-downgrade_20161124.sh as a template.
|
||||
#
|
||||
|
||||
- name: Applying local signed fixes
|
||||
shell: "/usr/bin/curl -sSL http://{{ ansible_local.domain.serverfqdn }}/ks/fixes/{{ item }} | /usr/bin/gpg --passphrase {{ domainadminpasswd }} --decrypt | sudo /bin/bash"
|
||||
with_items: "{{ ansible_local.domain.apply_fixes|default([]) }}"
|
@ -10,3 +10,9 @@
|
||||
tags:
|
||||
- prereq
|
||||
- repos
|
||||
|
||||
- include: fixes.yml
|
||||
tags:
|
||||
- prereq
|
||||
- fixes
|
||||
when: ansible_local.domain.apply_fixes is defined
|
||||
|
Loading…
x
Reference in New Issue
Block a user