From fda17c06a38017033160c2a0a38609cf8364e3db Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Thu, 30 Jul 2026 16:26:23 +0200 Subject: [PATCH] Configure SSH AllowUsers on Rocky Linux 10 Without this setting, only the user applying CIS benchmark hardening was authorised to log in, breaking the growroot.yml playbook. --- etc/kayobe/inventory/group_vars/cis-hardening/cis | 3 +++ .../notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml | 7 +++++++ 2 files changed, 10 insertions(+) create mode 100644 releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml diff --git a/etc/kayobe/inventory/group_vars/cis-hardening/cis b/etc/kayobe/inventory/group_vars/cis-hardening/cis index 2226183669..82f1ecd499 100644 --- a/etc/kayobe/inventory/group_vars/cis-hardening/cis +++ b/etc/kayobe/inventory/group_vars/cis-hardening/cis @@ -149,6 +149,9 @@ rhel10cis_selinux_disable: true # Disable setting of bootloader password rhel10cis_set_boot_pass: false +# Allow specific users to log in via SSH +rhel10cis_sshd_allowusers: "{{ bootstrap_user }} kolla stack" + ############################################################################## # Ubuntu Noble CIS Hardening Configuration diff --git a/releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml b/releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml new file mode 100644 index 0000000000..cae924c542 --- /dev/null +++ b/releasenotes/notes/rhel10cis-sshd-allowusers-60e902bfbd8b6c16.yaml @@ -0,0 +1,7 @@ +--- +fixes: + - | + Configures Rocky Linux 10 CIS benchmark hardening to allow SSH for users + ``{{ bootstrap_user }}``, ``kolla`` and ``stack``. This resolves issues + with running the ``growroot.yml`` playbook after applying hardening + configuration.