Chapter 27. Configuring a system for session recording by using the tlog RHEL system role

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording
     hosts: managed-node-01.example.com
     roles:
       - rhel-system-roles.tlog
     vars:
       tlog_scope_sssd: some
       tlog_users_sssd:
         - recorded-user

   tlog_scope_sssd

   The some value specifies you want to record only certain users and groups, not all or none.

   tlog_users_sssd

   Specifies the user you want to record a session from. Note that this does not add the user for you. You must set the user by yourself.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Navigate to the folder where the SSSD configuration drop file is created:

   # cd /etc/sssd/conf.d/

2. Check the file content:

   # cat /etc/sssd/conf.d/sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

3. Log in as a user whose session will be recorded.
4. Play back a recorded session.

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording excluding users and groups
     hosts: managed-node-01.example.com
     roles:
       - rhel-system-roles.tlog
     vars:
       tlog_scope_sssd: all
       tlog_exclude_users_sssd:
         - jeff
         - james
       tlog_exclude_groups_sssd:
         - admins

   tlog_scope_sssd

   The value all specifies that you want to record all users and groups.

   tlog_exclude_users_sssd

   Specifies the user names of the users you want to exclude from the session recording.

   tlog_exclude_groups_sssd

   Specifies the group you want to exclude from the session recording.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Navigate to the folder where the SSSD configuration drop file is created:

   # cd /etc/sssd/conf.d/

2. Check the file content:

   # cat sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

3. Log in as a user whose session will be recorded.
4. Play back a recorded session.