update readme

README.md

@@ -2,7 +2,7 @@
 
 ![Rocky Linux Infrastructure (develop)](https://img.shields.io/github/last-commit/rocky-linux/infrastructure/develop) ![Rocky Linux Infrastructure repo issues](https://img.shields.io/github/issues/rocky-linux/infrastructure) ![GitHub Workflow Status - Ansible Lint](https://img.shields.io/github/workflow/status/rocky-linux/infrastructure/Ansible%20Lint) ![GitHub Workflow Status - YAML Lint](https://img.shields.io/github/workflow/status/rocky-linux/infrastructure/YAML%20Lint)
 
-We will add more data here soon
+**This repository is being deprecated. Please see our WIP [wiki page](https://wiki.rockylinux.org/team/infrastructure/awx_scm_guidelines/) on guidelines for building playbooks for AWX.**
 
 ```
 ansible -> All ansible playbooks, modules, etc are here

ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-nsswitch.conf

@@ -0,0 +1,6 @@
+passwd:     {if "with-files-domain":sss files|files sss} systemd   {exclude if "with-custom-passwd"}
+group:      {if "with-files-domain":sss files|files sss} systemd   {exclude if "with-custom-group"}
+netgroup:   sss files           {exclude if "with-custom-netgroup"}
+automount:  sss files           {exclude if "with-custom-automount"}
+services:   sss files           {exclude if "with-custom-services"}
+sudoers:    files sss           {include if "with-sudo"}

ansible/playbooks/files/etc/authselect/custom/sssd-rocky/RedHat-9-system-auth

@@ -0,0 +1,40 @@
+{imply "with-smartcard" if "with-smartcard-required"}
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        required                                     pam_faillock.so preauth audit silent deny=5 unlock_time=900 {include if "with-faillock"}
+auth        [success=1 default=ignore]                   pam_succeed_if.so service notin login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"}
+auth        [success=done ignore=ignore default=die]     pam_sss.so require_cert_auth ignore_authinfo_unavail   {include if "with-smartcard-required"}
+auth        sufficient                                   pam_fprintd.so                                         {include if "with-fingerprint"}
+auth        sufficient                                   pam_u2f.so cue                                         {include if "with-pam-u2f"}
+auth        required                                     pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
+auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
+auth        [default=1 ignore=ignore success=ok]         pam_localuser.so                                       {exclude if "with-smartcard"}
+auth        [default=2 ignore=ignore success=ok]         pam_localuser.so                                       {include if "with-smartcard"}
+auth        [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth           {include if "with-smartcard"}
+auth        sufficient                                   pam_unix.so {if not "without-nullok":nullok} try_first_pass
+auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
+auth        sufficient                                   pam_sss.so forward_pass
+auth        required                                     pam_faillock.so authfail audit deny=5 unlock_time=900 fail_interval=900       {include if "with-faillock"}
+auth        required                                     pam_deny.so
+
+account     required                                     pam_access.so                                          {include if "with-pamaccess"}
+account     required                                     pam_faillock.so                                        {include if "with-faillock"}
+account     required                                     pam_unix.so
+account     sufficient                                   pam_localuser.so                                       {exclude if "with-files-access-provider"}
+account     sufficient                                   pam_usertype.so issystem
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+account     required                                     pam_permit.so
+
+password    requisite                                    pam_pwquality.so try_first_pass local_users_only minlen=14 dcredit=-1 lcredit=-1 ucredit=-1 ocredit=-1 retry=3
+password    requisite                                    pam_pwhistory.so use_authok remember=5
+password    sufficient                                   pam_unix.so sha512 shadow {if not "without-nullok":nullok} try_first_pass use_authtok
+password    sufficient                                   pam_sss.so use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     optional                                     pam_oddjob_mkhomedir.so umask=0077                    {include if "with-mkhomedir"}
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     required                                     pam_unix.so
+session     optional                                     pam_sss.so

ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-nsswitch.conf

@@ -0,0 +1 @@
+RedHat-9-nsswitch.conf

ansible/playbooks/files/etc/authselect/custom/sssd-rocky/Rocky-9-system-auth

@@ -0,0 +1 @@
+RedHat-9-system-auth

ansible/playbooks/tasks/ssh_config.yml

@@ -25,6 +25,15 @@
       when:
         - ansible_distribution_major_version == '8'
 
+    - name: Ensure sshd_config.d dir exists
+      ansible.builtin.file:
+        state: directory
+        path: "/etc/ssh/sshd_config.d"
+        owner: root
+        group: root
+        mode: '0700'
+      notify: restart_sshd
+
     - name: Ensure an empty file exists
       ansible.builtin.template:
         state: touch
@@ -36,15 +45,6 @@
       when:
         - ansible_distribution_major_version == '8'
 
-    - name: Ensure sshd_config.d dir exists
-      ansible.builtin.file:
-        state: directory
-        path: "/etc/ssh/sshd_config.d"
-        owner: root
-        group: root
-        mode: '0700'
-      notify: restart_sshd
-
     - name: Default Modular Configuration
       when:
         - (ansible_facts['distribution'] == 'Fedora') or