1171 lines
35 KiB
XML
1171 lines
35 KiB
XML
<?xml version="1.0"?>
|
|
<!DOCTYPE profile>
|
|
<profile xmlns="http://www.suse.com/1.0/yast2ns" xmlns:config="http://www.suse.com/1.0/configns">
|
|
<bootloader t="map">
|
|
<global t="map">
|
|
<append>splash=silent mitigations=auto quiet security=apparmor crashkernel=309M,high</append>
|
|
<cpu_mitigations>auto</cpu_mitigations>
|
|
<gfxmode>auto</gfxmode>
|
|
<hiddenmenu>false</hiddenmenu>
|
|
<os_prober>false</os_prober>
|
|
<secure_boot>true</secure_boot>
|
|
<terminal>gfxterm</terminal>
|
|
<timeout t="integer">8</timeout>
|
|
<trusted_grub>false</trusted_grub>
|
|
<update_nvram>true</update_nvram>
|
|
<xen_kernel_append>vga=gfx-1024x768x16 crashkernel=309M\<4G</xen_kernel_append>
|
|
</global>
|
|
<loader_type>grub2</loader_type>
|
|
</bootloader>
|
|
<firewall t="map">
|
|
<default_zone>public</default_zone>
|
|
<enable_firewall t="boolean">true</enable_firewall>
|
|
<log_denied_packets>off</log_denied_packets>
|
|
<start_firewall t="boolean">true</start_firewall>
|
|
<zones t="list">
|
|
<zone t="map">
|
|
<description>Unsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>block</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list"/>
|
|
<short>Block</short>
|
|
<target>%%REJECT%%</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>dmz</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>DMZ</short>
|
|
<target>default</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>All network connections are accepted.</description>
|
|
<interfaces t="list">
|
|
<interface>docker0</interface>
|
|
</interfaces>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>docker</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list"/>
|
|
<short>docker</short>
|
|
<target>ACCEPT</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>drop</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list"/>
|
|
<short>Drop</short>
|
|
<target>DROP</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">true</masquerade>
|
|
<name>external</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>External</short>
|
|
<target>default</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>home</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>dhcpv6-client</service>
|
|
<service>mdns</service>
|
|
<service>samba-client</service>
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>Home</short>
|
|
<target>default</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>internal</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>dhcpv6-client</service>
|
|
<service>mdns</service>
|
|
<service>samba-client</service>
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>Internal</short>
|
|
<target>default</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list">
|
|
<interface>eth0</interface>
|
|
</interfaces>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>public</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>dhcpv6-client</service>
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>Public</short>
|
|
<target>default</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>All network connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>trusted</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list"/>
|
|
<short>Trusted</short>
|
|
<target>ACCEPT</target>
|
|
</zone>
|
|
<zone t="map">
|
|
<description>For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
|
|
<interfaces t="list"/>
|
|
<masquerade t="boolean">false</masquerade>
|
|
<name>work</name>
|
|
<ports t="list"/>
|
|
<protocols t="list"/>
|
|
<services t="list">
|
|
<service>dhcpv6-client</service>
|
|
<service>ssh</service>
|
|
</services>
|
|
<short>Work</short>
|
|
<target>default</target>
|
|
</zone>
|
|
</zones>
|
|
</firewall>
|
|
<general t="map">
|
|
<mode t="map">
|
|
<confirm t="boolean">false</confirm>
|
|
</mode>
|
|
</general>
|
|
<groups t="list">
|
|
<group t="map">
|
|
<gid>100</gid>
|
|
<groupname>users</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>483</gid>
|
|
<groupname>video</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>71</gid>
|
|
<groupname>ntadmin</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>486</gid>
|
|
<groupname>render</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>496</gid>
|
|
<groupname>systemd-timesync</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>479</gid>
|
|
<groupname>chrony</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>62</gid>
|
|
<groupname>man</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>473</gid>
|
|
<groupname>sshd</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>65533</gid>
|
|
<groupname>nogroup</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>51</gid>
|
|
<groupname>postfix</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>482</gid>
|
|
<groupname>mail</groupname>
|
|
<userlist>postfix</userlist>
|
|
</group>
|
|
<group t="map">
|
|
<gid>492</gid>
|
|
<groupname>audio</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>475</gid>
|
|
<groupname>polkitd</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>481</gid>
|
|
<groupname>wheel</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>15</gid>
|
|
<groupname>shadow</groupname>
|
|
<userlist>vnc</userlist>
|
|
</group>
|
|
<group t="map">
|
|
<gid>5</gid>
|
|
<groupname>tty</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>493</gid>
|
|
<groupname>utmp</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>36</gid>
|
|
<groupname>kvm</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>1</gid>
|
|
<groupname>bin</groupname>
|
|
<userlist>daemon</userlist>
|
|
</group>
|
|
<group t="map">
|
|
<gid>59</gid>
|
|
<groupname>maildrop</groupname>
|
|
<userlist>postfix</userlist>
|
|
</group>
|
|
<group t="map">
|
|
<gid>472</gid>
|
|
<groupname>vnc</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>487</gid>
|
|
<groupname>lp</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>477</gid>
|
|
<groupname>nscd</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>489</gid>
|
|
<groupname>disk</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>499</gid>
|
|
<groupname>messagebus</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>494</gid>
|
|
<groupname>lock</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>488</gid>
|
|
<groupname>input</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>480</gid>
|
|
<groupname>audit</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>2</gid>
|
|
<groupname>daemon</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>495</gid>
|
|
<groupname>kmem</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>484</gid>
|
|
<groupname>tape</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>498</gid>
|
|
<groupname>systemd-journal</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>491</gid>
|
|
<groupname>cdrom</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>0</gid>
|
|
<groupname>root</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>478</gid>
|
|
<groupname>systemd-coredump</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>497</gid>
|
|
<groupname>systemd-network</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>42</gid>
|
|
<groupname>trusted</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>65534</gid>
|
|
<groupname>nobody</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>485</gid>
|
|
<groupname>sgx</groupname>
|
|
<userlist/>
|
|
</group>
|
|
<group t="map">
|
|
<gid>490</gid>
|
|
<groupname>dialout</groupname>
|
|
<userlist/>
|
|
</group>
|
|
</groups>
|
|
<host t="map">
|
|
<hosts t="list">
|
|
<hosts_entry t="map">
|
|
<host_address>127.0.0.1</host_address>
|
|
<names t="list">
|
|
<name>localhost</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>::1</host_address>
|
|
<names t="list">
|
|
<name>localhost ipv6-localhost ipv6-loopback</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>fe00::0</host_address>
|
|
<names t="list">
|
|
<name>ipv6-localnet</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>ff00::0</host_address>
|
|
<names t="list">
|
|
<name>ipv6-mcastprefix</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>ff02::1</host_address>
|
|
<names t="list">
|
|
<name>ipv6-allnodes</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>ff02::2</host_address>
|
|
<names t="list">
|
|
<name>ipv6-allrouters</name>
|
|
</names>
|
|
</hosts_entry>
|
|
<hosts_entry t="map">
|
|
<host_address>ff02::3</host_address>
|
|
<names t="list">
|
|
<name>ipv6-allhosts</name>
|
|
</names>
|
|
</hosts_entry>
|
|
</hosts>
|
|
</host>
|
|
<kdump t="map">
|
|
<add_crash_kernel t="boolean">true</add_crash_kernel>
|
|
<crash_kernel>309M,high</crash_kernel>
|
|
<crash_xen_kernel>309M\<4G</crash_xen_kernel>
|
|
<general t="map">
|
|
<KDUMPTOOL_FLAGS/>
|
|
<KDUMP_AUTO_RESIZE>no</KDUMP_AUTO_RESIZE>
|
|
<KDUMP_COMMANDLINE/>
|
|
<KDUMP_COMMANDLINE_APPEND/>
|
|
<KDUMP_CONTINUE_ON_ERROR>true</KDUMP_CONTINUE_ON_ERROR>
|
|
<KDUMP_COPY_KERNEL>yes</KDUMP_COPY_KERNEL>
|
|
<KDUMP_CPUS/>
|
|
<KDUMP_DUMPFORMAT>lzo</KDUMP_DUMPFORMAT>
|
|
<KDUMP_DUMPLEVEL>31</KDUMP_DUMPLEVEL>
|
|
<KDUMP_FREE_DISK_SIZE>64</KDUMP_FREE_DISK_SIZE>
|
|
<KDUMP_HOST_KEY/>
|
|
<KDUMP_IMMEDIATE_REBOOT>yes</KDUMP_IMMEDIATE_REBOOT>
|
|
<KDUMP_KEEP_OLD_DUMPS>5</KDUMP_KEEP_OLD_DUMPS>
|
|
<KDUMP_KERNELVER/>
|
|
<KDUMP_NETCONFIG>auto</KDUMP_NETCONFIG>
|
|
<KDUMP_NET_TIMEOUT>30</KDUMP_NET_TIMEOUT>
|
|
<KDUMP_NOTIFICATION_CC/>
|
|
<KDUMP_NOTIFICATION_TO/>
|
|
<KDUMP_POSTSCRIPT/>
|
|
<KDUMP_PRESCRIPT/>
|
|
<KDUMP_REQUIRED_PROGRAMS/>
|
|
<KDUMP_SAVEDIR>/var/crash</KDUMP_SAVEDIR>
|
|
<KDUMP_SMTP_PASSWORD/>
|
|
<KDUMP_SMTP_SERVER/>
|
|
<KDUMP_SMTP_USER/>
|
|
<KDUMP_TRANSFER/>
|
|
<KDUMP_VERBOSE>3</KDUMP_VERBOSE>
|
|
<KEXEC_OPTIONS/>
|
|
</general>
|
|
</kdump>
|
|
<networking t="map">
|
|
<dhcp_options t="map">
|
|
<dhclient_client_id/>
|
|
<dhclient_hostname_option>AUTO</dhclient_hostname_option>
|
|
</dhcp_options>
|
|
<dns t="map">
|
|
<dhcp_hostname t="boolean">true</dhcp_hostname>
|
|
<hostname>dhcp213</hostname>
|
|
<resolv_conf_policy>auto</resolv_conf_policy>
|
|
</dns>
|
|
<interfaces t="list">
|
|
<interface t="map">
|
|
<bootproto>dhcp</bootproto>
|
|
<name>eth0</name>
|
|
<startmode>auto</startmode>
|
|
<zone>public</zone>
|
|
</interface>
|
|
</interfaces>
|
|
<ipv6 t="boolean">true</ipv6>
|
|
<keep_install_network t="boolean">true</keep_install_network>
|
|
<managed t="boolean">false</managed>
|
|
<net-udev t="list">
|
|
<rule t="map">
|
|
<name>eth0</name>
|
|
<rule>KERNELS</rule>
|
|
<value>0000:00:03.0</value>
|
|
</rule>
|
|
</net-udev>
|
|
<routing t="map">
|
|
<ipv4_forward t="boolean">false</ipv4_forward>
|
|
<ipv6_forward t="boolean">false</ipv6_forward>
|
|
</routing>
|
|
</networking>
|
|
<ntp-client t="map">
|
|
<ntp_policy>auto</ntp_policy>
|
|
<ntp_servers t="list">
|
|
<ntp_server t="map">
|
|
<address>2.suse.pool.ntp.org</address>
|
|
<iburst t="boolean">true</iburst>
|
|
<offline t="boolean">false</offline>
|
|
</ntp_server>
|
|
</ntp_servers>
|
|
<ntp_sync>manual</ntp_sync>
|
|
</ntp-client>
|
|
<partitioning t="list">
|
|
<drive t="map">
|
|
<device>/dev/system</device>
|
|
<enable_snapshots t="boolean">true</enable_snapshots>
|
|
<partitions t="list">
|
|
<partition t="map">
|
|
<create t="boolean">true</create>
|
|
<filesystem t="symbol">xfs</filesystem>
|
|
<format t="boolean">false</format>
|
|
<lv_name>home</lv_name>
|
|
<mount>/home</mount>
|
|
<mountby t="symbol">device</mountby>
|
|
<pool t="boolean">false</pool>
|
|
<resize t="boolean">false</resize>
|
|
<size>5792333824</size>
|
|
<stripes t="integer">1</stripes>
|
|
<stripesize t="integer">0</stripesize>
|
|
</partition>
|
|
<partition t="map">
|
|
<create t="boolean">true</create>
|
|
<create_subvolumes t="boolean">true</create_subvolumes>
|
|
<filesystem t="symbol">btrfs</filesystem>
|
|
<format t="boolean">false</format>
|
|
<lv_name>root</lv_name>
|
|
<mount>/</mount>
|
|
<mountby t="symbol">device</mountby>
|
|
<pool t="boolean">false</pool>
|
|
<quotas t="boolean">true</quotas>
|
|
<resize t="boolean">false</resize>
|
|
<size>13522436096</size>
|
|
<stripes t="integer">1</stripes>
|
|
<stripesize t="integer">0</stripesize>
|
|
<subvolumes t="list">
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">false</copy_on_write>
|
|
<path>var</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>usr/local</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>tmp</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>srv</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>root</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>opt</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>boot/grub2/x86_64-efi</path>
|
|
</subvolume>
|
|
<subvolume t="map">
|
|
<copy_on_write t="boolean">true</copy_on_write>
|
|
<path>boot/grub2/i386-pc</path>
|
|
</subvolume>
|
|
</subvolumes>
|
|
<subvolumes_prefix>@</subvolumes_prefix>
|
|
</partition>
|
|
<partition t="map">
|
|
<create t="boolean">true</create>
|
|
<filesystem t="symbol">swap</filesystem>
|
|
<format t="boolean">false</format>
|
|
<lv_name>swap</lv_name>
|
|
<mount>swap</mount>
|
|
<mountby t="symbol">device</mountby>
|
|
<pool t="boolean">false</pool>
|
|
<resize t="boolean">false</resize>
|
|
<size>2147483648</size>
|
|
<stripes t="integer">1</stripes>
|
|
<stripesize t="integer">0</stripesize>
|
|
</partition>
|
|
</partitions>
|
|
<pesize>4194304</pesize>
|
|
<type t="symbol">CT_LVM</type>
|
|
</drive>
|
|
<drive t="map">
|
|
<device>/dev/sda</device>
|
|
<disklabel>gpt</disklabel>
|
|
<partitions t="list">
|
|
<partition t="map">
|
|
<create t="boolean">true</create>
|
|
<format t="boolean">false</format>
|
|
<partition_id t="integer">263</partition_id>
|
|
<partition_nr t="integer">1</partition_nr>
|
|
<resize t="boolean">false</resize>
|
|
<size>8388608</size>
|
|
</partition>
|
|
<partition t="map">
|
|
<create t="boolean">true</create>
|
|
<format t="boolean">false</format>
|
|
<lvm_group>system</lvm_group>
|
|
<partition_id t="integer">142</partition_id>
|
|
<partition_nr t="integer">2</partition_nr>
|
|
<resize t="boolean">false</resize>
|
|
<size>21465382400</size>
|
|
</partition>
|
|
</partitions>
|
|
<type t="symbol">CT_DISK</type>
|
|
<use>all</use>
|
|
</drive>
|
|
</partitioning>
|
|
<proxy t="map">
|
|
<enabled t="boolean">false</enabled>
|
|
</proxy>
|
|
<security t="map">
|
|
<console_shutdown>reboot</console_shutdown>
|
|
<cracklib_dict_path>/usr/lib/cracklib_dict</cracklib_dict_path>
|
|
<disable_restart_on_update>no</disable_restart_on_update>
|
|
<disable_stop_on_removal>no</disable_stop_on_removal>
|
|
<extra_services>insecure</extra_services>
|
|
<fail_delay>3</fail_delay>
|
|
<gid_max>60000</gid_max>
|
|
<gid_min>1000</gid_min>
|
|
<hibernate_system>active_console</hibernate_system>
|
|
<kernel.sysrq>184</kernel.sysrq>
|
|
<lsm_select>apparmor</lsm_select>
|
|
<mandatory_services>secure</mandatory_services>
|
|
<net.ipv4.ip_forward>0</net.ipv4.ip_forward>
|
|
<net.ipv4.tcp_syncookies>0</net.ipv4.tcp_syncookies>
|
|
<net.ipv6.conf.all.forwarding>0</net.ipv6.conf.all.forwarding>
|
|
<pass_max_days>99999</pass_max_days>
|
|
<pass_min_days>0</pass_min_days>
|
|
<pass_min_len>5</pass_min_len>
|
|
<pass_warn_age>7</pass_warn_age>
|
|
<passwd_encryption>sha512</passwd_encryption>
|
|
<passwd_remember_history>0</passwd_remember_history>
|
|
<passwd_use_cracklib>yes</passwd_use_cracklib>
|
|
<permission_security>easy</permission_security>
|
|
<run_updatedb_as/>
|
|
<smtpd_listen_remote>no</smtpd_listen_remote>
|
|
<sys_gid_max>499</sys_gid_max>
|
|
<sys_gid_min>100</sys_gid_min>
|
|
<sys_uid_max>499</sys_uid_max>
|
|
<sys_uid_min>100</sys_uid_min>
|
|
<syslog_on_no_error>no</syslog_on_no_error>
|
|
<uid_max>60000</uid_max>
|
|
<uid_min>1000</uid_min>
|
|
<useradd_cmd>/usr/sbin/useradd.local</useradd_cmd>
|
|
<userdel_postcmd>/usr/sbin/userdel-post.local</userdel_postcmd>
|
|
<userdel_precmd>/usr/sbin/userdel-pre.local</userdel_precmd>
|
|
</security>
|
|
<services-manager t="map">
|
|
<default_target>multi-user</default_target>
|
|
<services t="map">
|
|
<enable t="list">
|
|
<service>YaST2-Firstboot</service>
|
|
<service>YaST2-Second-Stage</service>
|
|
<service>apparmor</service>
|
|
<service>auditd</service>
|
|
<service>klog</service>
|
|
<service>cron</service>
|
|
<service>firewalld</service>
|
|
<service>wickedd-auto4</service>
|
|
<service>wickedd-dhcp4</service>
|
|
<service>wickedd-dhcp6</service>
|
|
<service>wickedd-nanny</service>
|
|
<service>display-manager</service>
|
|
<service>irqbalance</service>
|
|
<service>issue-generator</service>
|
|
<service>kbdsettings</service>
|
|
<service>kdump</service>
|
|
<service>kdump-early</service>
|
|
<service>lvm2-monitor</service>
|
|
<service>wicked</service>
|
|
<service>nscd</service>
|
|
<service>postfix</service>
|
|
<service>purge-kernels</service>
|
|
<service>rollback</service>
|
|
<service>rsyslog</service>
|
|
<service>smartd</service>
|
|
<service>sshd</service>
|
|
<service>systemd-pstore</service>
|
|
<service>systemd-remount-fs</service>
|
|
</enable>
|
|
</services>
|
|
</services-manager>
|
|
<software t="map">
|
|
<install_recommended t="boolean">true</install_recommended>
|
|
<instsource/>
|
|
<packages t="list">
|
|
<package>xfsprogs</package>
|
|
<package>wicked</package>
|
|
<package>snapper</package>
|
|
<package>sles-release</package>
|
|
<package>sle-module-server-applications-release</package>
|
|
<package>sle-module-basesystem-release</package>
|
|
<package>openssh</package>
|
|
<package>numactl</package>
|
|
<package>lvm2</package>
|
|
<package>kexec-tools</package>
|
|
<package>kdump</package>
|
|
<package>irqbalance</package>
|
|
<package>grub2</package>
|
|
<package>glibc</package>
|
|
<package>firewalld</package>
|
|
<package>e2fsprogs</package>
|
|
<package>btrfsprogs</package>
|
|
<package>autoyast2</package>
|
|
</packages>
|
|
<patterns t="list">
|
|
<pattern>apparmor</pattern>
|
|
<pattern>base</pattern>
|
|
<pattern>basic_desktop</pattern>
|
|
<pattern>enhanced_base</pattern>
|
|
<pattern>minimal_base</pattern>
|
|
<pattern>x11</pattern>
|
|
<pattern>x11_yast</pattern>
|
|
<pattern>yast2_basis</pattern>
|
|
</patterns>
|
|
<products t="list">
|
|
<product>SLES</product>
|
|
</products>
|
|
</software>
|
|
<ssh_import t="map">
|
|
<copy_config t="boolean">false</copy_config>
|
|
<import t="boolean">false</import>
|
|
</ssh_import>
|
|
<suse_register t="map">
|
|
<do_registration t="boolean">false</do_registration>
|
|
</suse_register>
|
|
<timezone t="map">
|
|
<timezone>America/New_York</timezone>
|
|
</timezone>
|
|
<user_defaults t="map">
|
|
<expire/>
|
|
<group>100</group>
|
|
<home>/home</home>
|
|
<inactive>-1</inactive>
|
|
<shell>/bin/bash</shell>
|
|
<umask>022</umask>
|
|
</user_defaults>
|
|
<users t="list">
|
|
<user t="map">
|
|
<authorized_keys t="list"/>
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>tux</fullname>
|
|
<gid>100</gid>
|
|
<home>/home/tux</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max>99999</max>
|
|
<min>0</min>
|
|
<warn>7</warn>
|
|
</password_settings>
|
|
<shell>/bin/bash</shell>
|
|
<uid>1000</uid>
|
|
<user_password>$6$epM6.b193j7ZvUaw$/oMPS9pQR9X9i1MAJag20ZFy0XSI4985uVQDGLugwoCbDJVoXKCWLMFM.WncHr/bpkjecwb.LLaJeheYatq8f.</user_password>
|
|
<username>tux</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>bin</fullname>
|
|
<gid>1</gid>
|
|
<home>/bin</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>1</uid>
|
|
<user_password>!</user_password>
|
|
<username>bin</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>systemd Network Management</fullname>
|
|
<gid>497</gid>
|
|
<home>/</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>497</uid>
|
|
<user_password>!*</user_password>
|
|
<username>systemd-network</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>systemd Core Dumper</fullname>
|
|
<gid>478</gid>
|
|
<home>/</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>478</uid>
|
|
<user_password>!*</user_password>
|
|
<username>systemd-coredump</username>
|
|
</user>
|
|
<user t="map">
|
|
<authorized_keys t="list"/>
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>root</fullname>
|
|
<gid>0</gid>
|
|
<home>/root</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/bin/bash</shell>
|
|
<uid>0</uid>
|
|
<user_password>$6$sxZ921ci.szwhCIw$9lrLQTtanJcpPeJkqv9pU0LsKQLO3RcPhBPBDMfc1uGUDCfgiyEyGPNr/ZKXAgqZsL61DANvr4uAYYDkif/Ma0</user_password>
|
|
<username>root</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>user for rpcbind</fullname>
|
|
<gid>65534</gid>
|
|
<home>/var/lib/empty</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/sbin/nologin</shell>
|
|
<uid>477</uid>
|
|
<user_password>!</user_password>
|
|
<username>rpc</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Printing daemon</fullname>
|
|
<gid>487</gid>
|
|
<home>/var/spool/lpd</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>494</uid>
|
|
<user_password>!</user_password>
|
|
<username>lp</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>User for nscd</fullname>
|
|
<gid>477</gid>
|
|
<home>/run/nscd</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/sbin/nologin</shell>
|
|
<uid>476</uid>
|
|
<user_password>!</user_password>
|
|
<username>nscd</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>nobody</fullname>
|
|
<gid>65534</gid>
|
|
<home>/var/lib/nobody</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/bin/bash</shell>
|
|
<uid>65534</uid>
|
|
<user_password>!</user_password>
|
|
<username>nobody</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>user for VNC</fullname>
|
|
<gid>472</gid>
|
|
<home>/var/lib/empty</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>472</uid>
|
|
<user_password>!</user_password>
|
|
<username>vnc</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Manual pages viewer</fullname>
|
|
<gid>62</gid>
|
|
<home>/var/lib/empty</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>13</uid>
|
|
<user_password>!</user_password>
|
|
<username>man</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>SSH daemon</fullname>
|
|
<gid>473</gid>
|
|
<home>/var/lib/sshd</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>473</uid>
|
|
<user_password>!</user_password>
|
|
<username>sshd</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Daemon</fullname>
|
|
<gid>2</gid>
|
|
<home>/sbin</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>2</uid>
|
|
<user_password>!</user_password>
|
|
<username>daemon</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Chrony Daemon</fullname>
|
|
<gid>479</gid>
|
|
<home>/var/lib/chrony</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>493</uid>
|
|
<user_password>!</user_password>
|
|
<username>chrony</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>systemd Time Synchronization</fullname>
|
|
<gid>496</gid>
|
|
<home>/</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>496</uid>
|
|
<user_password>!*</user_password>
|
|
<username>systemd-timesync</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>NFS statd daemon</fullname>
|
|
<gid>65533</gid>
|
|
<home>/var/lib/nfs</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/sbin/nologin</shell>
|
|
<uid>474</uid>
|
|
<user_password>!</user_password>
|
|
<username>statd</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>User for D-Bus</fullname>
|
|
<gid>499</gid>
|
|
<home>/run/dbus</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/bin/false</shell>
|
|
<uid>499</uid>
|
|
<user_password>!</user_password>
|
|
<username>messagebus</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>User for polkitd</fullname>
|
|
<gid>475</gid>
|
|
<home>/var/lib/polkit</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>475</uid>
|
|
<user_password>!</user_password>
|
|
<username>polkitd</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Mailer daemon</fullname>
|
|
<gid>482</gid>
|
|
<home>/var/spool/clientmqueue</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>495</uid>
|
|
<user_password>!</user_password>
|
|
<username>mail</username>
|
|
</user>
|
|
<user t="map">
|
|
<encrypted t="boolean">true</encrypted>
|
|
<fullname>Postfix Daemon</fullname>
|
|
<gid>51</gid>
|
|
<home>/var/spool/postfix</home>
|
|
<home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
|
|
<password_settings t="map">
|
|
<expire/>
|
|
<flag/>
|
|
<inact/>
|
|
<max/>
|
|
<min/>
|
|
<warn/>
|
|
</password_settings>
|
|
<shell>/usr/sbin/nologin</shell>
|
|
<uid>51</uid>
|
|
<user_password>!</user_password>
|
|
<username>postfix</username>
|
|
</user>
|
|
</users>
|
|
<scripts>
|
|
<init-scripts config:type="list">
|
|
<script>
|
|
<!--
|
|
retrieving the scripts from FTP source doesn't work since YaST seems to
|
|
retrieve the stuff before we have (again) network ...
|
|
-->
|
|
<filename>02-install_scripts</filename>
|
|
<location/>
|
|
<source>
|
|
#!/bin/sh
|
|
mkdir /tmp/scripts cd /tmp/scripts
|
|
wget http://perf-vm-lp.arch.suse.cz/autoinst/scripts/after_install.sh
|
|
sh after_install.sh
|
|
rm -fr /tmp/scripts
|
|
</source>
|
|
</script>
|
|
<script>
|
|
<!--
|
|
this script makes sure sshd gets started even if autoyast or systemd fail
|
|
-->
|
|
<source>
|
|
systemctl enable sshd && systemctl start sshd
|
|
</source>
|
|
</script>
|
|
</init-scripts>
|
|
</scripts>
|
|
<files config:type="list">
|
|
<file>
|
|
<file_path>/etc/apache2/httpd.conf</file_path>
|
|
<file_contents>
|
|
|
|
<![CDATA[
|
|
some content
|
|
]]>
|
|
|
|
</file_contents>
|
|
</file>
|
|
<file>
|
|
<file_path>/etc/someconf.conf</file_path>
|
|
<file_contents>
|
|
|
|
<![CDATA[
|
|
some content
|
|
]]>
|
|
|
|
</file_contents>
|
|
<file_owner>tux.users</file_owner>
|
|
<file_permissions>444</file_permissions>
|
|
</file>
|
|
</files>
|
|
</profile>
|
|
|