evolinux-users: deal with AllowGroups and AllowUsers differently

evolinux-users/tasks/ssh.yml

@@ -26,57 +26,72 @@
     loop_var: ssk_key
   when: user.ssh_keys is defined
 
-# we must double-escape caracters, because python
+- name: verify AllowGroups directive
-- name: verify AllowUsers directive
+  shell: "grep -E '^AllowGroups' /etc/ssh/sshd_config"
-  shell: "grep -E '^AllowUsers' /etc/ssh/sshd_config"
   changed_when: False
   failed_when: False
-  register: grep_allowusers_ssh
+  register: grep_allowgroups_ssh
   check_mode: no
 
-- name: "Add AllowUsers sshd directive for '{{ user.name }}'"
+  # If AllowGroups is present, we don't change
-  lineinfile:
+- debug:
-    dest: /etc/ssh/sshd_config
+    msg: "AllowGroups detected : You have to configure SSH manually"
-    line: "\nAllowUsers {{ user.name }}"
+  when: grep_allowgroups_ssh.rc == 0
-    insertafter: 'Subsystem'
-    validate: '/usr/sbin/sshd -T -f %s'
-  notify: reload sshd
-  when: grep_allowusers_ssh.rc != 0
 
-- name: "Modify AllowUsers sshd directive for '{{ user.name }}'"
+- block:
-  replace:
+  # If AllowGroups is not present, we proceed as usual
-    dest: /etc/ssh/sshd_config
+  - name: verify AllowUsers directive
-    regexp: '^(AllowUsers ((?!\b{{ user.name }}\b).)*)$'
+    shell: "grep -E '^AllowUsers' /etc/ssh/sshd_config"
-    replace: '\1 {{ user.name }}'
+    changed_when: False
-    validate: '/usr/sbin/sshd -T -f %s'
+    failed_when: False
-  notify: reload sshd
+    register: grep_allowusers_ssh
-  when: grep_allowusers_ssh.rc == 0
+    check_mode: no
 
-- name: "verify Match User directive"
+  - name: "Add AllowUsers sshd directive for '{{ user.name }}'"
-  command: "grep 'Match User' /etc/ssh/sshd_config"
+    lineinfile:
-  changed_when: False
+      dest: /etc/ssh/sshd_config
-  failed_when: False
+      line: "\nAllowUsers {{ user.name }}"
-  register: grep_matchuser_ssh
+      insertafter: 'Subsystem'
-  check_mode: no
+      validate: '/usr/sbin/sshd -T -f %s'
+    notify: reload sshd
+    when: grep_allowusers_ssh.rc != 0
 
-- name: "Add Match User sshd directive for '{{ user.name }}' (Jessie)"
+  - name: "Modify AllowUsers sshd directive for '{{ user.name }}'"
-  lineinfile:
+    replace:
-    dest: /etc/ssh/sshd_config
+      dest: /etc/ssh/sshd_config
-    line: "\nMatch User {{ user.name }}\n    PasswordAuthentication no"
+      regexp: '^(AllowUsers ((?!\b{{ user.name }}\b).)*)$'
-    insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
+      replace: '\1 {{ user.name }}'
-    validate: '/usr/sbin/sshd -T -f %s'
+      validate: '/usr/sbin/sshd -T -f %s'
-  notify: reload sshd
+    notify: reload sshd
-  when:
+    when: grep_allowusers_ssh.rc == 0
-    - ansible_distribution_release == "jessie"
-    - grep_matchuser_ssh.rc != 0
 
-- name: "Modify Match User's sshd directive for '{{ user.name }}' (Jessie)"
+  - name: "verify Match User directive"
-  replace:
+    command: "grep 'Match User' /etc/ssh/sshd_config"
-    dest: /etc/ssh/sshd_config
+    changed_when: False
-    regexp: '^(Match User ((?!{{ user.name }}).)*)$'
+    failed_when: False
-    replace: '\1,{{ user.name }}'
+    register: grep_matchuser_ssh
-    validate: '/usr/sbin/sshd -T -f %s'
+    check_mode: no
-  notify: reload sshd
+
-  when:
+  - name: "Add Match User sshd directive for '{{ user.name }}' (Jessie)"
-    - ansible_distribution_release == "jessie"
+    lineinfile:
-    - grep_matchuser_ssh.rc == 0
+      dest: /etc/ssh/sshd_config
+      line: "\nMatch User {{ user.name }}\n    PasswordAuthentication no"
+      insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
+      validate: '/usr/sbin/sshd -T -f %s'
+    notify: reload sshd
+    when:
+      - ansible_distribution_release == "jessie"
+      - grep_matchuser_ssh.rc != 0
+
+  - name: "Modify Match User's sshd directive for '{{ user.name }}' (Jessie)"
+    replace:
+      dest: /etc/ssh/sshd_config
+      regexp: '^(Match User ((?!{{ user.name }}).)*)$'
+      replace: '\1,{{ user.name }}'
+      validate: '/usr/sbin/sshd -T -f %s'
+    notify: reload sshd
+    when:
+      - ansible_distribution_release == "jessie"
+      - grep_matchuser_ssh.rc == 0
+
+  when: grep_allowgroups_ssh.rc != 0