Refactoring of admin-users + evolinux-base roles
* rename admin-users to evolinux-users * splitting the "sudo" part for users between jessie and stretch * with stretch, the sudo group is customizable and properly configured * import evolinux-users role from evolinux-base at proper time to ensure ssh connections are possible for other users before cutting root's access * evomaintenance is also included in evolinux-base to have it available when users are created
This commit is contained in:
parent
116f086b86
commit
7b88393ccf
|
@ -1,3 +0,0 @@
|
||||||
---
|
|
||||||
admin_users: {}
|
|
||||||
admin_users_group: adm
|
|
|
@ -1,11 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- include: user.yml
|
|
||||||
|
|
||||||
- include: profile.yml
|
|
||||||
|
|
||||||
- include: ssh.yml
|
|
||||||
|
|
||||||
- include: sudo.yml
|
|
||||||
|
|
||||||
- meta: flush_handlers
|
|
|
@ -1,48 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (jessie)"
|
|
||||||
template:
|
|
||||||
src: sudoers_jessie.j2
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
force: no
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
register: copy_sudoers_evolinux
|
|
||||||
when: ansible_distribution_release == "jessie"
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
|
||||||
template:
|
|
||||||
src: sudoers_stretch.j2
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
force: no
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
register: copy_sudoers_evolinux
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file permissions"
|
|
||||||
file:
|
|
||||||
path: /etc/sudoers.d/evolinux
|
|
||||||
mode: "0440"
|
|
||||||
state: file
|
|
||||||
|
|
||||||
- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
|
|
||||||
replace:
|
|
||||||
dest: /etc/sudoers.d/evolinux
|
|
||||||
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
|
|
||||||
replace: '\1,{{ user.name }}'
|
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
|
||||||
when:
|
|
||||||
- ansible_distribution_release == "jessie"
|
|
||||||
- not copy_sudoers_evolinux.changed
|
|
||||||
|
|
||||||
- name: "Create evolinux-sudo group (Debian 9 or later)"
|
|
||||||
group:
|
|
||||||
name: evolinux-sudo
|
|
||||||
system: yes
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
|
||||||
user:
|
|
||||||
name: '{{ user.name }}'
|
|
||||||
groups: 'evolinux-sudo'
|
|
||||||
append: yes
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
|
@ -100,6 +100,22 @@ evolinux_system_alert5_init: True
|
||||||
evolinux_system_alert5_enable: True
|
evolinux_system_alert5_enable: True
|
||||||
evolinux_system_eni_auto: True
|
evolinux_system_eni_auto: True
|
||||||
|
|
||||||
|
# evomaintenance
|
||||||
|
|
||||||
|
evolinux_evomaintenance_include: True
|
||||||
|
|
||||||
|
# ssh
|
||||||
|
|
||||||
|
evolinux_ssh_include: True
|
||||||
|
|
||||||
|
evolinux_ssh_password_auth_addresses: []
|
||||||
|
evolinux_ssh_match_address: True
|
||||||
|
evolinux_ssh_disable_acceptenv: True
|
||||||
|
|
||||||
|
# evolinux users
|
||||||
|
|
||||||
|
evolinux_users_include: True
|
||||||
|
|
||||||
# root
|
# root
|
||||||
|
|
||||||
evolinux_root_include: True
|
evolinux_root_include: True
|
||||||
|
@ -112,15 +128,7 @@ evolinux_root_gitconfig: True
|
||||||
evolinux_root_bash_history_appendonly: True
|
evolinux_root_bash_history_appendonly: True
|
||||||
evolinux_root_vim_default: True
|
evolinux_root_vim_default: True
|
||||||
evolinux_root_vim_conf: True
|
evolinux_root_vim_conf: True
|
||||||
|
evolinux_root_disable_ssh: True
|
||||||
# ssh
|
|
||||||
|
|
||||||
evolinux_ssh_include: True
|
|
||||||
|
|
||||||
evolinux_ssh_password_auth_addresses: []
|
|
||||||
evolinux_ssh_match_address: True
|
|
||||||
evolinux_ssh_disable_root: False
|
|
||||||
evolinux_ssh_disable_acceptenv: True
|
|
||||||
|
|
||||||
# postfix
|
# postfix
|
||||||
|
|
||||||
|
|
|
@ -34,14 +34,24 @@
|
||||||
include: system.yml
|
include: system.yml
|
||||||
when: evolinux_system_include
|
when: evolinux_system_include
|
||||||
|
|
||||||
- name: Root user configuration
|
- name: Evomaintenance
|
||||||
include: root.yml
|
include_role:
|
||||||
when: evolinux_root_include
|
name: evomaintenance
|
||||||
|
when: evolinux_evomaintenance_include
|
||||||
|
|
||||||
- name: SSH configuration
|
- name: SSH configuration
|
||||||
include: ssh.yml
|
include: ssh.yml
|
||||||
when: evolinux_ssh_include
|
when: evolinux_ssh_include
|
||||||
|
|
||||||
|
- name: Create evolinux users
|
||||||
|
include_role:
|
||||||
|
name: evolinux-users
|
||||||
|
when: evolinux_users_include
|
||||||
|
|
||||||
|
- name: Root user configuration
|
||||||
|
include: root.yml
|
||||||
|
when: evolinux_root_include
|
||||||
|
|
||||||
- name: Postfix
|
- name: Postfix
|
||||||
include: postfix.yml
|
include: postfix.yml
|
||||||
when: evolinux_postfix_include
|
when: evolinux_postfix_include
|
||||||
|
|
|
@ -80,4 +80,12 @@
|
||||||
- "set shiftwidth=4"
|
- "set shiftwidth=4"
|
||||||
when: evolinux_root_vim_conf
|
when: evolinux_root_vim_conf
|
||||||
|
|
||||||
|
- name: disable SSH access for root
|
||||||
|
replace:
|
||||||
|
dest: /etc/ssh/sshd_config
|
||||||
|
regexp: '^PermitRootLogin (yes|without-password)'
|
||||||
|
replace: "PermitRootLogin no"
|
||||||
|
notify: reload sshd
|
||||||
|
when: evolinux_root_disable_ssh
|
||||||
|
|
||||||
- meta: flush_handlers
|
- meta: flush_handlers
|
||||||
|
|
|
@ -17,14 +17,6 @@
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
when: not evolinux_ssh_password_auth_addresses == []
|
when: not evolinux_ssh_password_auth_addresses == []
|
||||||
|
|
||||||
- name: disable SSH access for root
|
|
||||||
replace:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: '^PermitRootLogin (yes|without-password)'
|
|
||||||
replace: "PermitRootLogin no"
|
|
||||||
notify: reload sshd
|
|
||||||
when: evolinux_ssh_disable_root
|
|
||||||
|
|
||||||
# We disable AcceptEnv because it can be a security issue, but also because we
|
# We disable AcceptEnv because it can be a security issue, but also because we
|
||||||
# do not want clients to push their environment variables like LANG.
|
# do not want clients to push their environment variables like LANG.
|
||||||
- name: disable AcceptEnv in ssh config
|
- name: disable AcceptEnv in ssh config
|
||||||
|
|
|
@ -31,7 +31,7 @@ suites:
|
||||||
playbook: ./tests/test.yml
|
playbook: ./tests/test.yml
|
||||||
verifier:
|
verifier:
|
||||||
patterns:
|
patterns:
|
||||||
- admin-users/tests/spec/admin-users_spec.rb
|
- evolinux-users/tests/spec/evolinux-users_spec.rb
|
||||||
bundler_path: '/usr/local/bin'
|
bundler_path: '/usr/local/bin'
|
||||||
rspec_path: '/usr/local/bin'
|
rspec_path: '/usr/local/bin'
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
# admin-users
|
# evolinux-users
|
||||||
|
|
||||||
Creates admin users accounts, based on a configuration data structure.
|
Creates evolinux users accounts, based on a configuration data structure.
|
||||||
|
|
||||||
## Tasks
|
## Tasks
|
||||||
|
|
||||||
|
@ -8,10 +8,10 @@ Everything is in the `tasks/main.yml` file.
|
||||||
|
|
||||||
## Available variables
|
## Available variables
|
||||||
|
|
||||||
The variable `admin_users` must be a "dict" of one or more users :
|
The variable `evolinux_users` must be a "dict" of one or more users :
|
||||||
|
|
||||||
```
|
```
|
||||||
admin_users:
|
evolinux_users:
|
||||||
foo:
|
foo:
|
||||||
name: foo
|
name: foo
|
||||||
uid: 1001
|
uid: 1001
|
3
evolinux-users/defaults/main.yml
Normal file
3
evolinux-users/defaults/main.yml
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
---
|
||||||
|
evolinux_users: {}
|
||||||
|
evolinux_sudo_group: "evolinux-sudo"
|
|
@ -1,6 +1,6 @@
|
||||||
galaxy_info:
|
galaxy_info:
|
||||||
author: Evolix
|
author: Evolix
|
||||||
description: Creates admin users accounts.
|
description: Creates evolinux users accounts.
|
||||||
|
|
||||||
issue_tracker_url: https://forge.evolix.org/projects/ansible-roles/issues
|
issue_tracker_url: https://forge.evolix.org/projects/ansible-roles/issues
|
||||||
|
|
|
@ -35,18 +35,6 @@
|
||||||
update_password: on_create
|
update_password: on_create
|
||||||
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
||||||
|
|
||||||
- name: "Create {{ admin_users_group }} group (Debian 9 or later)"
|
|
||||||
group:
|
|
||||||
name: "{{ admin_users_group }}"
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Add user to {{ admin_users_group }} group (Debian 9 or later)"
|
|
||||||
user:
|
|
||||||
name: '{{ user.name }}'
|
|
||||||
groups: '{{ admin_users_group }}'
|
|
||||||
append: yes
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- name: "Fix perms on homedirectory for '{{ user.name }}'"
|
- name: "Fix perms on homedirectory for '{{ user.name }}'"
|
||||||
file:
|
file:
|
||||||
name: '/home/{{ user.name }}'
|
name: '/home/{{ user.name }}'
|
|
@ -6,11 +6,11 @@
|
||||||
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
- ansible_distribution != "Debian" or ansible_distribution_major_version | version_compare('8', '<')
|
||||||
|
|
||||||
- debug:
|
- debug:
|
||||||
msg: "Warning: empty 'admin_users' variable, tasks will be skipped!"
|
msg: "Warning: empty 'evolinux_users' variable, tasks will be skipped!"
|
||||||
when: admin_users == {}
|
when: evolinux_users == {}
|
||||||
|
|
||||||
- include: admin_user.yml
|
- include: user.yml
|
||||||
vars:
|
vars:
|
||||||
user: "{{ item.value }}"
|
user: "{{ item.value }}"
|
||||||
with_dict: "{{ admin_users }}"
|
with_dict: "{{ evolinux_users }}"
|
||||||
when: admin_users != {}
|
when: evolinux_users != {}
|
21
evolinux-users/tasks/sudo_jessie.yml
Normal file
21
evolinux-users/tasks/sudo_jessie.yml
Normal file
|
@ -0,0 +1,21 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: "Verify Evolinux sudoers file presence (jessie)"
|
||||||
|
template:
|
||||||
|
src: sudoers_jessie.j2
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
force: no
|
||||||
|
mode: "0440"
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
register: copy_sudoers_evolinux
|
||||||
|
when: ansible_distribution_release == "jessie"
|
||||||
|
|
||||||
|
- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
|
||||||
|
replace:
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
|
||||||
|
replace: '\1,{{ user.name }}'
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
when:
|
||||||
|
- ansible_distribution_release == "jessie"
|
||||||
|
- not copy_sudoers_evolinux.changed
|
23
evolinux-users/tasks/sudo_stretch.yml
Normal file
23
evolinux-users/tasks/sudo_stretch.yml
Normal file
|
@ -0,0 +1,23 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
||||||
|
template:
|
||||||
|
src: sudoers_stretch.j2
|
||||||
|
dest: /etc/sudoers.d/evolinux
|
||||||
|
force: no
|
||||||
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
|
register: copy_sudoers_evolinux
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
|
- name: "Create evolinux-sudo group (Debian 9 or later)"
|
||||||
|
group:
|
||||||
|
name: "{{ evolinux_sudo_group }}"
|
||||||
|
system: yes
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
|
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
||||||
|
user:
|
||||||
|
name: '{{ user.name }}'
|
||||||
|
groups: "{{ evolinux_sudo_group }}"
|
||||||
|
append: yes
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
15
evolinux-users/tasks/user.yml
Normal file
15
evolinux-users/tasks/user.yml
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
|
||||||
|
- include: account.yml
|
||||||
|
|
||||||
|
- include: profile.yml
|
||||||
|
|
||||||
|
- include: ssh.yml
|
||||||
|
|
||||||
|
- include: sudo_jessie.yml
|
||||||
|
when: ansible_distribution_release == "jessie"
|
||||||
|
|
||||||
|
- include: sudo_stretch.yml
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
|
- meta: flush_handlers
|
|
@ -5,5 +5,5 @@ Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh, /usr/share/scripts
|
||||||
nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
|
nagios ALL = NOPASSWD: /usr/lib/nagios/plugins/check_procs
|
||||||
nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt
|
nagios ALL = (clamav) NOPASSWD: /usr/bin/clamscan /tmp/safe.txt
|
||||||
|
|
||||||
%evolinux-sudo ALL=(ALL:ALL) ALL
|
%{{ evolinux_sudo_group }} ALL=(ALL:ALL) ALL
|
||||||
%evolinux-sudo ALL = NOPASSWD: MAINT
|
%{{ evolinux_sudo_group }} ALL = NOPASSWD: MAINT
|
|
@ -2,7 +2,7 @@
|
||||||
- hosts: test-kitchen
|
- hosts: test-kitchen
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
admin_users:
|
evolinux_users:
|
||||||
foo:
|
foo:
|
||||||
name: foo
|
name: foo
|
||||||
uid: 1001
|
uid: 1001
|
||||||
|
@ -20,4 +20,4 @@
|
||||||
# state: directory
|
# state: directory
|
||||||
|
|
||||||
roles:
|
roles:
|
||||||
- role: admin-users
|
- role: evolinux-users
|
Loading…
Reference in a new issue