RavenHawkTech LLC

Rocky Linux 9.7 Active Directory Group-Based Access Control for /opt/ansible

Linux Access Control

Rocky Linux systems joined to Microsoft Active Directory can use centralized group membership to control access to sensitive automation directories. This guide shows how to secure /opt/ansible so only members of a specific Active Directory group can access it, while also handling common SSSD cache issues.

This guide explains how to configure a Rocky Linux 9.7 system joined to Microsoft Active Directory so that only members of a specific Active Directory group can access a secured directory under /opt/ansible.

The article also covers troubleshooting SSSD cache behavior when newly added Active Directory group members are not immediately reflected on the Linux system.

Environment

  • Rocky Linux 9.7
  • System joined to Microsoft Active Directory using SSSD
  • Active Directory group: ansible_mgmt
  • Target directory: /opt/ansible

Verify the Active Directory Group

Before configuring permissions, verify that the Active Directory group is visible to the Rocky Linux system.

getent group ansible_mgmt
id username

If the group does not appear, confirm the system is properly joined to Active Directory and that SSSD services are running.

Configure the Directory Permissions

Set the directory ownership so the ansible_mgmt Active Directory group controls access.

sudo chown root:ansible_mgmt /opt/ansible
sudo chmod 2770 /opt/ansible

The permission mode 2770 provides the following access:

  • root: full access
  • ansible_mgmt group members: full access
  • Everyone else: no access

Permission note: The leading 2 in 2770 enables the setgid bit. This causes newly created files and directories under /opt/ansible to inherit the ansible_mgmt group automatically.

Configure Default ACL Permissions

Using Access Control Lists, or ACLs, helps ensure consistent permissions for newly created files.

sudo setfacl -d -m g:ansible_mgmt:rwx /opt/ansible
sudo setfacl -m g:ansible_mgmt:rwx /opt/ansible

Verify the ACL settings with:

getfacl /opt/ansible

Troubleshooting Group Membership Changes

A common issue occurs when a new user is added to the ansible_mgmt Active Directory group, but the Rocky Linux server does not immediately reflect the updated membership. This behavior is typically caused by SSSD caching.

Verify Current Group Membership

getent group ansible_mgmt
id username

Clear the SSSD Cache

sudo sss_cache -E
sudo systemctl restart sssd

After clearing the cache, verify the user membership again using the id command.

Clear Cache for a Specific User or Group

sudo sss_cache -u username
sudo sss_cache -g ansible_mgmt

Login session note: If the user was already logged into the Linux system before being added to the Active Directory group, they must log out and back in before the new group membership takes effect.

Optional SSSD Nested Group Configuration

If your Active Directory environment uses nested groups, configure the following option within /etc/sssd/sssd.conf:

ldap_group_nesting_level = 5

After making changes to the SSSD configuration, restart the SSSD service.

Final Verification

Verify the final directory permissions:

ls -ld /opt/ansible

Expected output example:

drwxrws--- root ansible_mgmt /opt/ansible

Conclusion

By combining Active Directory integration through SSSD with Linux file permissions and ACLs, Rocky Linux 9.7 can securely restrict access to shared Ansible directories using centralized Active Directory group membership management.

This approach keeps access control centralized while still using native Linux permission behavior, making it practical for enterprise automation directories such as /opt/ansible.