admin-users: AllowUsers + Match User

This commit is contained in:
Jérémy Lecour 2016-12-27 14:04:02 +01:00 committed by Jérémy Lecour
parent b2971d1f7d
commit 65c57a61aa
1 changed files with 39 additions and 6 deletions

View File

@ -55,30 +55,63 @@
group: '{{ user.name }}'
- name: Add user's SSH public key for '{{ user.name }}'
authorized_key:
user: "{{ user.name }}"
key: "{{ user.ssh_key }}"
state: present
- name: verify AllowUsers directive
command: "grep AllowUsers /etc/ssh/sshd_config"
changed_when: False
failed_when: False
register: grep_allowusers_ssh
- name: Add AllowUsers' sshd directive for '{{ user.name }}'
lineinfile:
dest: '/home/{{ user.name }}/.ssh/authorized_keys'
create: yes
line: '{{ user.ssh_key }}'
owner: '{{ user.name }}'
group: '{{ user.name }}'
dest: /etc/ssh/sshd_config
line: "\nAllowUsers {{ user.name }}"
insertafter: '^UsePAM'
validate: '/usr/sbin/sshd -T -f %s'
notify:
- reload sshd
when: grep_allowusers_ssh.rc != 0
- name: Modify AllowUsers' sshd directive for '{{ user.name }}'
replace:
dest: /etc/ssh/sshd_config
regexp: '^(AllowUsers ((?!{{ user.name }}).)*)$'
replace: '\1 {{ user.name }}'
validate: '/usr/sbin/sshd -T -f %s'
notify:
- reload sshd
when: grep_allowusers_ssh.rc == 0
- name: verify Match User directive
command: "grep 'Match User' /etc/ssh/sshd_config"
changed_when: False
failed_when: False
register: grep_matchuser_ssh
- name: Add Match User sshd directive for '{{ user.name }}'
lineinfile:
dest: /etc/ssh/sshd_config
line: "\nMatch User {{ user.name }}\n PasswordAuthentication no"
validate: '/usr/sbin/sshd -T -f %s'
notify:
- reload sshd
when: grep_matchuser_ssh.rc != 0
- name: Modify Match User's sshd directive for '{{ user.name }}'
replace:
dest: /etc/ssh/sshd_config
regexp: '^(Match User ((?!{{ user.name }}).)*)$'
replace: '\1,{{ user.name }}'
validate: '/usr/sbin/sshd -T -f %s'
notify:
- reload sshd
when: grep_matchuser_ssh.rc == 0
- name: Evolinux sudoers file is present
- name: Verify Evolinux sudoers file presence
template:
src: sudoers_debian.j2
dest: /etc/sudoers.d/evolinux