fix: create working version of rpcbind configuration

.gitlab-ci.yml

@@ -15,7 +15,7 @@ default:
 variables:
   SCENARIO: "default"
   # ANSIBLE_VAULT_PASSWORD_FILE: "molecule/lza_server_hardening.pass"
-  ANSIBLE_VAULT_PASSWORD_FILE: "../../../lza_server_hardening.pass"
+  ANSIBLE_VAULT_PASSWORD_FILE: "../lza_server_hardening.pass"
     
 
 test-job:
@@ -26,7 +26,7 @@ test-job:
     - echo "CURRENT PATH= '$(pwd)'" 
     # make sure that Ansible Vaults are present and can be decrypted
     - echo "${VAULT_SERVER_HARDENING}" > ${ANSIBLE_VAULT_PASSWORD_FILE}
-    - export ANSIBLE_VAULT_PASSWORD_FILE
+    - export ANSIBLE_VAULT_PASSWORD_FILE="../../${ANSIBLE_VAULT_PASSWORD_FILE}"
     - tree
     - rm -rf ../ansible_vaults/
     - git clone https://gitlab+deploy-token-25:${VAULT_ACCESS_TOKEN}@git.slub-dresden.de/slub-referat-2-3/ansible_vaults.git ../ansible_vaults/; \

tasks/configure_rpcbind.yml

@@ -19,6 +19,7 @@
   ansible.builtin.blockinfile:
     path: "/etc/systemd/system/rpcbind.socket.d/override.conf"
     create: true
+    mode: "0644"
     marker: "### {mark} ANSIBLE MANAGED BLOCK - clear previous settings"
     block: |
       # from `man 5 systemd.socket`:
@@ -34,24 +35,25 @@
   when: rpcbind_installed
   notify: daemon_reload
 
-- name: implement access control in rpcbind socket unit by creating an override - general settings
+- name: implement access control in rpcbind socket unit by creating an override - interface specific settings
   ansible.builtin.blockinfile:
     path: "/etc/systemd/system/rpcbind.socket.d/override.conf"
     create: true
-    marker: ### {mark} ANSIBLE MANAGED BLOCK - allow access for {{ item.source }}
+    mode: "0644"
+    marker: "### {mark} ANSIBLE MANAGED BLOCK - allow access for {{ item.source }}"
     block: |
       ListenStream={{ item.source }}
       ListenDatagram={{ item.source }}
-  loop: "{{ nfs_server_interfaces }}"
+  loop: "{{ vault_nfs_server_interfaces }}"
   when: rpcbind_installed
   notify: daemon_reload
 
 - name: implement rpcbind access control in iptables
   ansible.builtin.iptables:
     action: "insert"
-    chain: "INPUP"
-    comment: "{{ item.comment }}"
+    chain: "INPUT"
+    comment: "allow rpcbind access from {{ item.comment }} for NFSv3"
     source: "{{ item.source }}"
     jump: "ACCEPT"
-  loop: "{{ nfs_server_interfaces }}"
+  loop: "{{ vault_nfs_server_interfaces }}"
   notify: "save iptables rules"