#version=DEVEL
# System authorization information
auth --enableshadow --passalgo=sha512
# Use CDROM installation media
cdrom
# Use text mode install
text
# Run the Setup Agent on first boot
firstboot --enable
group --name=whee
ignoredisk --only-use=vda
# Keyboard layouts
keyboard --vckeymap=us --xlayouts='us'
# System language
lang en_US.UTF-8

# Network information
network  --bootproto=dhcp


# System services
services --enabled="chronyd"
# System timezone
timezone America/Chicago --isUtc
# X Window System configuration information
xconfig  --startxonboot
# System bootloader configuration
bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=vda
# Partition clearing information
clearpart --all --initlabel --drives=vda
# Disk partitioning information
part /boot --fstype="ext4" --size=275
part pv.57 --fstype="lvmpv" --size=102124
volgroup rootvg --pesize=32768 pv.57
logvol /opt  --fstype="xfs" --size=2048 --name=LogVol05 --vgname=rootvg
logvol /var/log/audit  --fstype="xfs" --size=100 --name=LogVol07 --vgname=rootvg
logvol swap  --fstype="swap" --size=2048 --name=LogVol03 --vgname=rootvg
logvol /var/log  --fstype="xfs" --size=2048 --name=LogVol06 --vgname=rootvg
logvol /home  --fstype="xfs" --size=1024 --name=LogVol01 --vgname=rootvg
logvol /tmp  --fstype="xfs" --size=2048 --name=LogVol04 --vgname=rootvg
logvol /  --fstype="xfs" --size=5120 --name=LogVol00 --vgname=rootvg
logvol /var  --fstype="xfs" --size=2048 --name=LogVol02 --vgname=rootvg

%post
#enable epel repository
#wget -O /tmp/epel-release.rpm http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm
wget -O /tmp/epel-release.rpm https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
rpm -Uvh /tmp/epel-release.rpm
sync
rm -f /tmp/epel-release.rpm
yum update epel-release -y
yum install rhn-client-tools -y
yum install ipa-client ipa-admintools -y
###Service startup config
sed -i 's/admin_space_left_action =.*/admin_space_left_action = SYSLOG/g' /etc/audit/auditd.conf
sed -i 's/^flush =.*/flush = DATA/g' /etc/audit/auditd.conf
cat <<EOF > /etc/dconf/db/local.d/00-media-automount
[org/gnome/desktop/media-handling]
automount=false
automount-open=false
autorun-never=true
EOF
cat <<EOF > /etc/dconf/db/local.d/locks/00-media-automount
/org/gnome/desktop/media-handling/automount
/org/gnome/desktop/media-handling/automount-open
/org/gnome/desktop/media-handling/autorun-never
EOF
#Disable thumbnailers for PEN test
cat <<EOF > /etc/dconf/db/local.d/00-thumbnailers
[org/gnome/desktop/thumbnailers]
disable-all=true
EOF
cat <<EOF > /etc/dconf/db/local.d/locks/00-thumbnailers
/org/gnome/desktop/thumbnailers/disable-all
EOF
#Gnome screensaver
cat <<EOF > /etc/dconf/db/local.d/00-gnome-screensaver
[org/gnome/desktop/session]
idle-delay=900
EOF
cat <<EOF > /etc/dconf/db/local.d/locks/00-gnome-screensaver
/org/gnome/desktop/session/idle-delay
EOF
#Gnome screensaver timeout
cat <<EOF > /etc/dconf/db/local.d/00-gnome-screensaver-idle
[org/gnome/desktop/screensaver]
idle-activation-enabled=true
lock-enabled=true
lock-delay=0
picture-uri=''
EOF
cat <<EOF > /etc/dconf/db/local.d/locks/00-gnome-screensaver-idle
/org/gnome/desktop/screensaver/idle-activation-enabled
/org/gnome/desktop/screensaver/lock-enabled
/org/gnome/desktop/screensaver/lock-delay
/org/gnome/desktop/screensaver/picture-uri
EOF
#Gnome Banner
mkdir /etc/dconf/db/gdm.d
mkdir /etc/dconf/db/gdm.d/locks
chmod 0755 /etc/dconf/db/gdm.d
chmod 0755 /etc/dconf/db/gdm.d/locks
cat <<EOF > /etc/dconf/db/gdm.d/00-banner-message-enable
[org/gnome/login-screen]
banner-message-enable=true
disable-user-list=true
EOF
cat <<EOF > /etc/dconf/db/gdm.d/locks/00-banner-message-enable
/org/gnome/login-screen/banner-message-enable
/org/gnome/login-screen/disable-user-list
EOF
dconf update
#Secure securetty
sed -i '/^vc\//d' /etc/securetty
sed -i '/^ttyS.*/d' /etc/securetty
####
#patch
sed -i 's/^installonly_limit=3/installonly_limit=2/g' /etc/yum.conf
/usr/bin/yum update -y
sync
#Antivirus (for any users who transfer infected files - don't be a virus storage vault)
yum install clamav clamav-update clamav-server clamav-scanner clamav-scanner-systemd clamav-server-systemd -y
/bin/systemctl enable [email protected]
sed -i 's/^Example/#Example/g' /etc/clamd.d/scan.conf
sed -i 's/^#LocalSocket/LocalSocket/g' /etc/clamd.d/scan.conf
sed -i 's/^LocalSocketGroup/#LocalSocketGroup/g' /etc/clamd.d/scan.conf
sed -i 's/^Example/#Example/g' /etc/freshclam.conf
sed -i 's/^FRESHCLAM_DELAY=disabled-warn/#FRESHCLAM_DELAY=disabled-warn/g' /etc/sysconfig/freshclam
#Switch from every 3 hours to daily @ 3am for virus definition updates
sed -i 's/^0  \*\/3 \* \* \* root \/usr\/share\/clamav\/freshclam-sleep/0  3 \* \* \* root \/usr\/share\/clamav\/freshclam-sleep/g' /etc/cron.d/clamav-update
#Modify daily script to scan with lowest priority after updating definitions
echo -e "nice -19 /usr/bin/freshclam --quiet; nice -19 /usr/bin/clamscan --recursive --no-summary --infected / 2>/dev/null" >> /usr/share/clamav/freshclam-sleep
#SELinux fix for "ERROR: During database load : LibClamAV Warning: RWX mapping denied: Can't allocate RWX Memory: Permission denied" error during daily updates
/sbin/setsebool -P clamd_use_jit on
####
#Get new virus definitions before clamd starts on reboot
/usr/bin/freshclam --quiet
systemctl set-default multi-user.target
%end

%packages
@base
@core
@desktop-debugging
@dial-up
@file-server
@fonts
@guest-agents
@guest-desktop-agents
@input-methods
@internet-browser
@multimedia
@print-client
@virtualization-tools
@x11
aide
chrony
kexec-tools
kexec-tools
samba
screen
-abrt
-abrt-addon-ccpp
-abrt-addon-kerneloops
-abrt-addon-pstoreoops
-abrt-addon-python
-abrt-addon-vmcore
-abrt-addon-xorg
-abrt-cli
-abrt-console-notification
-abrt-libs
-abrt-python
-abrt-tui
-aic94xx-firmware
-alsa-firmware
-alsa-tools-firmware
-augeas-libs
-crda
-fprintd
-fprintd-pam
-iprutils
-ivtv-firmware
-iw
-iwl100-firmware
-iwl1000-firmware
-iwl105-firmware
-iwl135-firmware
-iwl2000-firmware
-iwl2030-firmware
-iwl3160-firmware
-iwl3945-firmware
-iwl4965-firmware
-iwl5000-firmware
-iwl5150-firmware
-iwl6000-firmware
-iwl6000g2a-firmware
-iwl6000g2b-firmware
-iwl6050-firmware
-iwl7260-firmware
-ledmon
-libertas-sd8686-firmware
-libertas-sd8787-firmware
-libertas-usb8388-firmware
-libreport
-libreport-plugin-mailx
-libreport-python
-libstoragemgmt
-libstoragemgmt-python
-open-vm-tools-desktop
-rdate
-rfkill
-rng-tools
-satyr
-setuptool
-sg3_utils-libs
-smartmontools
-sos
-tuned
-usb_modeswitch
-usb_modeswitch-data
-yajl

%end

%addon com_redhat_kdump --enable --reserve-mb='auto'

%end