evolix/ansible-roles
22
2
Fork 2
Code Issues 61 Pull requests 18 Releases 33 Wiki Activity

Insert "Match User" if missing (Jessie only)

Browse source
This commit is contained in:
Jérémy Lecour 2017-10-17 10:28:02 +02:00 committed by Jérémy Lecour
parent b4e4b14fc6
commit 71cd04029c
1 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
evolinux-users/tasks/ssh.yml
View file

@ -52,27 +52,31 @@
notify: reload sshd notify: reload sshd
when: grep_allowusers_ssh.rc == 0 when: grep_allowusers_ssh.rc == 0
- name: verify Match User directive - name: "verify Match User directive"
command: "grep 'Match User' /etc/ssh/sshd_config" command: "grep 'Match User' /etc/ssh/sshd_config"
changed_when: False changed_when: False
failed_when: False failed_when: False
register: grep_matchuser_ssh register: grep_matchuser_ssh
check_mode: no check_mode: no
# - name: "Add Match User sshd directive for '{{ user.name }}'" - name: "Add Match User sshd directive for '{{ user.name }}' (Jessie)"
# lineinfile: lineinfile:
# dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
# line: "\nMatch User {{ user.name }}\n PasswordAuthentication no" line: "\nMatch User {{ user.name }}\n PasswordAuthentication no"
# insertbefore: "# BEGIN EVOLINUX PASSWORD RESTRICTIONS" insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
# validate: '/usr/sbin/sshd -T -f %s' validate: '/usr/sbin/sshd -T -f %s'
# notify: reload sshd notify: reload sshd
# when: grep_matchuser_ssh.rc != 0 when:
- ansible_distribution_release == "jessie"
- grep_matchuser_ssh.rc != 0
- name: "Modify Match User's sshd directive for '{{ user.name }}'" - name: "Modify Match User's sshd directive for '{{ user.name }}' (Jessie)"
replace: replace:
dest: /etc/ssh/sshd_config dest: /etc/ssh/sshd_config
regexp: '^(Match User ((?!{{ user.name }}).)*)$' regexp: '^(Match User ((?!{{ user.name }}).)*)$'
replace: '\1,{{ user.name }}' replace: '\1,{{ user.name }}'
validate: '/usr/sbin/sshd -T -f %s' validate: '/usr/sbin/sshd -T -f %s'
notify: reload sshd notify: reload sshd
when: grep_matchuser_ssh.rc == 0 when:
- ansible_distribution_release == "jessie"
- grep_matchuser_ssh.rc == 0