Browse Source

Refactoring of admin-users + evolinux-base roles

* rename admin-users to evolinux-users
* splitting the "sudo" part for users between jessie and stretch
* with stretch, the sudo group is customizable and properly configured
* import evolinux-users role from evolinux-base at proper time
  to ensure ssh connections are possible for other users before
  cutting root's access
* evomaintenance is also included in evolinux-base to have it available
  when users are created
evolinux-users
Jérémy Lecour 2 years ago
parent
commit
7b88393ccf
23 changed files with 115 additions and 109 deletions
  1. +0
    -3
      admin-users/defaults/main.yml
  2. +0
    -11
      admin-users/tasks/admin_user.yml
  3. +0
    -48
      admin-users/tasks/sudo.yml
  4. +17
    -9
      evolinux-base/defaults/main.yml
  5. +13
    -3
      evolinux-base/tasks/main.yml
  6. +8
    -0
      evolinux-base/tasks/root.yml
  7. +0
    -8
      evolinux-base/tasks/ssh.yml
  8. +1
    -1
      evolinux-users/.kitchen.yml
  9. +4
    -4
      evolinux-users/README.md
  10. +3
    -0
      evolinux-users/defaults/main.yml
  11. +0
    -0
      evolinux-users/handlers/main.yml
  12. +1
    -1
      evolinux-users/meta/main.yml
  13. +0
    -12
      evolinux-users/tasks/account.yml
  14. +5
    -5
      evolinux-users/tasks/main.yml
  15. +0
    -0
      evolinux-users/tasks/profile.yml
  16. +0
    -0
      evolinux-users/tasks/ssh.yml
  17. +21
    -0
      evolinux-users/tasks/sudo_jessie.yml
  18. +23
    -0
      evolinux-users/tasks/sudo_stretch.yml
  19. +15
    -0
      evolinux-users/tasks/user.yml
  20. +0
    -0
      evolinux-users/templates/sudoers_jessie.j2
  21. +2
    -2
      evolinux-users/templates/sudoers_stretch.j2
  22. +0
    -0
      evolinux-users/tests/spec/evolinux-users_spec.rb
  23. +2
    -2
      evolinux-users/tests/test.yml

+ 0
- 3
admin-users/defaults/main.yml View File

@@ -1,3 +0,0 @@
---
admin_users: {}
admin_users_group: adm

+ 0
- 11
admin-users/tasks/admin_user.yml View File

@@ -1,11 +0,0 @@
---

- include: user.yml

- include: profile.yml

- include: ssh.yml

- include: sudo.yml

- meta: flush_handlers

+ 0
- 48
admin-users/tasks/sudo.yml View File

@@ -1,48 +0,0 @@
---

- name: "Verify Evolinux sudoers file presence (jessie)"
template:
src: sudoers_jessie.j2
dest: /etc/sudoers.d/evolinux
force: no
validate: '/usr/sbin/visudo -cf %s'
register: copy_sudoers_evolinux
when: ansible_distribution_release == "jessie"

- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
template:
src: sudoers_stretch.j2
dest: /etc/sudoers.d/evolinux
force: no
validate: '/usr/sbin/visudo -cf %s'
register: copy_sudoers_evolinux
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Verify Evolinux sudoers file permissions"
file:
path: /etc/sudoers.d/evolinux
mode: "0440"
state: file

- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
replace:
dest: /etc/sudoers.d/evolinux
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
replace: '\1,{{ user.name }}'
validate: '/usr/sbin/visudo -cf %s'
when:
- ansible_distribution_release == "jessie"
- not copy_sudoers_evolinux.changed

- name: "Create evolinux-sudo group (Debian 9 or later)"
group:
name: evolinux-sudo
system: yes
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Add user to evolinux-sudo group (Debian 9 or later)"
user:
name: '{{ user.name }}'
groups: 'evolinux-sudo'
append: yes
when: ansible_distribution_major_version | version_compare('9', '>=')

+ 17
- 9
evolinux-base/defaults/main.yml View File

@@ -100,6 +100,22 @@ evolinux_system_alert5_init: True
evolinux_system_alert5_enable: True
evolinux_system_eni_auto: True

# evomaintenance

evolinux_evomaintenance_include: True

# ssh

evolinux_ssh_include: True

evolinux_ssh_password_auth_addresses: []
evolinux_ssh_match_address: True
evolinux_ssh_disable_acceptenv: True

# evolinux users

evolinux_users_include: True

# root

evolinux_root_include: True
@@ -112,15 +128,7 @@ evolinux_root_gitconfig: True
evolinux_root_bash_history_appendonly: True
evolinux_root_vim_default: True
evolinux_root_vim_conf: True

# ssh

evolinux_ssh_include: True

evolinux_ssh_password_auth_addresses: []
evolinux_ssh_match_address: True
evolinux_ssh_disable_root: False
evolinux_ssh_disable_acceptenv: True
evolinux_root_disable_ssh: True

# postfix



+ 13
- 3
evolinux-base/tasks/main.yml View File

@@ -34,14 +34,24 @@
include: system.yml
when: evolinux_system_include

- name: Root user configuration
include: root.yml
when: evolinux_root_include
- name: Evomaintenance
include_role:
name: evomaintenance
when: evolinux_evomaintenance_include

- name: SSH configuration
include: ssh.yml
when: evolinux_ssh_include

- name: Create evolinux users
include_role:
name: evolinux-users
when: evolinux_users_include

- name: Root user configuration
include: root.yml
when: evolinux_root_include

- name: Postfix
include: postfix.yml
when: evolinux_postfix_include


+ 8
- 0
evolinux-base/tasks/root.yml View File

@@ -80,4 +80,12 @@
- "set shiftwidth=4"
when: evolinux_root_vim_conf

- name: disable SSH access for root
replace:
dest: /etc/ssh/sshd_config
regexp: '^PermitRootLogin (yes|without-password)'
replace: "PermitRootLogin no"
notify: reload sshd
when: evolinux_root_disable_ssh

- meta: flush_handlers

+ 0
- 8
evolinux-base/tasks/ssh.yml View File

@@ -17,14 +17,6 @@
notify: reload sshd
when: not evolinux_ssh_password_auth_addresses == []

- name: disable SSH access for root
replace:
dest: /etc/ssh/sshd_config
regexp: '^PermitRootLogin (yes|without-password)'
replace: "PermitRootLogin no"
notify: reload sshd
when: evolinux_ssh_disable_root

# We disable AcceptEnv because it can be a security issue, but also because we
# do not want clients to push their environment variables like LANG.
- name: disable AcceptEnv in ssh config


admin-users/.kitchen.yml → evolinux-users/.kitchen.yml View File

@@ -31,7 +31,7 @@ suites:
playbook: ./tests/test.yml
verifier:
patterns:
- admin-users/tests/spec/admin-users_spec.rb
- evolinux-users/tests/spec/evolinux-users_spec.rb
bundler_path: '/usr/local/bin'
rspec_path: '/usr/local/bin'


admin-users/README.md → evolinux-users/README.md View File

@@ -1,6 +1,6 @@
# admin-users
# evolinux-users

Creates admin users accounts, based on a configuration data structure.
Creates evolinux users accounts, based on a configuration data structure.

## Tasks

@@ -8,10 +8,10 @@ Everything is in the `tasks/main.yml` file.

## Available variables

The variable `admin_users` must be a "dict" of one or more users :
The variable `evolinux_users` must be a "dict" of one or more users :

```
admin_users:
evolinux_users:
foo:
name: foo
uid: 1001

+ 3
- 0
evolinux-users/defaults/main.yml View File

@@ -0,0 +1,3 @@
---
evolinux_users: {}
evolinux_sudo_group: "evolinux-sudo"

admin-users/handlers/main.yml → evolinux-users/handlers/main.yml View File


admin-users/meta/main.yml → evolinux-users/meta/main.yml View File

@@ -1,6 +1,6 @@
galaxy_info:
author: Evolix
description: Creates admin users accounts.
description: Creates evolinux users accounts.

issue_tracker_url: https://forge.evolix.org/projects/ansible-roles/issues


admin-users/tasks/user.yml → evolinux-users/tasks/account.yml View File

@@ -35,18 +35,6 @@
update_password: on_create
when: loginisbusy.rc != 0 and uidisbusy.rc == 0

- name: "Create {{ admin_users_group }} group (Debian 9 or later)"
group:
name: "{{ admin_users_group }}"
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Add user to {{ admin_users_group }} group (Debian 9 or later)"
user:
name: '{{ user.name }}'
groups: '{{ admin_users_group }}'
append: yes
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Fix perms on homedirectory for '{{ user.name }}'"
file:
name: '/home/{{ user.name }}'

admin-users/tasks/main.yml → evolinux-users/tasks/main.yml View File

@@ -6,11 +6,11 @@
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')

- debug:
msg: "Warning: empty 'admin_users' variable, tasks will be skipped!"
when: admin_users == {}
msg: "Warning: empty 'evolinux_users' variable, tasks will be skipped!"
when: evolinux_users == {}

- include: admin_user.yml
- include: user.yml
vars:
user: "{{ item.value }}"
with_dict: "{{ admin_users }}"
when: admin_users != {}
with_dict: "{{ evolinux_users }}"
when: evolinux_users != {}

admin-users/tasks/profile.yml → evolinux-users/tasks/profile.yml View File


admin-users/tasks/ssh.yml → evolinux-users/tasks/ssh.yml View File


+ 21
- 0
evolinux-users/tasks/sudo_jessie.yml View File

@@ -0,0 +1,21 @@
---

- name: "Verify Evolinux sudoers file presence (jessie)"
template:
src: sudoers_jessie.j2
dest: /etc/sudoers.d/evolinux
force: no
mode: "0440"
validate: '/usr/sbin/visudo -cf %s'
register: copy_sudoers_evolinux
when: ansible_distribution_release == "jessie"

- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
replace:
dest: /etc/sudoers.d/evolinux
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
replace: '\1,{{ user.name }}'
validate: '/usr/sbin/visudo -cf %s'
when:
- ansible_distribution_release == "jessie"
- not copy_sudoers_evolinux.changed

+ 23
- 0
evolinux-users/tasks/sudo_stretch.yml View File

@@ -0,0 +1,23 @@
---

- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
template:
src: sudoers_stretch.j2
dest: /etc/sudoers.d/evolinux
force: no
validate: '/usr/sbin/visudo -cf %s'
register: copy_sudoers_evolinux
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Create evolinux-sudo group (Debian 9 or later)"
group:
name: "{{ evolinux_sudo_group }}"
system: yes
when: ansible_distribution_major_version | version_compare('9', '>=')

- name: "Add user to evolinux-sudo group (Debian 9 or later)"
user:
name: '{{ user.name }}'
groups: "{{ evolinux_sudo_group }}"
append: yes
when: ansible_distribution_major_version | version_compare('9', '>=')

+ 15
- 0
evolinux-users/tasks/user.yml View File

@@ -0,0 +1,15 @@
---

- include: account.yml

- include: profile.yml

- include: ssh.yml

- include: sudo_jessie.yml
when: ansible_distribution_release == "jessie"

- include: sudo_stretch.yml
when: ansible_distribution_major_version | version_compare('9', '>=')

- meta: flush_handlers

admin-users/templates/sudoers_jessie.j2 → evolinux-users/templates/sudoers_jessie.j2 View File


admin-users/templates/sudoers_stretch.j2 → evolinux-users/templates/sudoers_stretch.j2 View File

@@ -5,5 +5,5 @@ Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh, /usr/share/scripts
nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt

%evolinux-sudo ALL=(ALL:ALL) ALL
%evolinux-sudo ALL = NOPASSWD: MAINT
%{{ evolinux_sudo_group }} ALL=(ALL:ALL) ALL
%{{ evolinux_sudo_group }} ALL = NOPASSWD: MAINT

admin-users/tests/spec/admin-users_spec.rb → evolinux-users/tests/spec/evolinux-users_spec.rb View File


admin-users/tests/test.yml → evolinux-users/tests/test.yml View File

@@ -2,7 +2,7 @@
- hosts: test-kitchen

vars:
admin_users:
evolinux_users:
foo:
name: foo
uid: 1001
@@ -20,4 +20,4 @@
# state: directory

roles:
- role: admin-users
- role: evolinux-users

Loading…
Cancel
Save