evolinux-users: loop by task intead of loop by user
This commit is contained in:
parent
1c48df025c
commit
f9c7758e23
|
@ -1,57 +1,61 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: "Test if '{{ user.name }}' exists"
|
|
||||||
command: 'getent passwd {{ user.name }}'
|
|
||||||
register: loginisbusy
|
|
||||||
failed_when: False
|
|
||||||
changed_when: False
|
|
||||||
check_mode: no
|
|
||||||
|
|
||||||
- name: "Test if uid exists for '{{ user.name }}'"
|
|
||||||
command: 'getent passwd {{ user.uid }}'
|
|
||||||
register: uidisbusy
|
|
||||||
failed_when: False
|
|
||||||
changed_when: False
|
|
||||||
check_mode: no
|
|
||||||
|
|
||||||
- name: "Add Unix account with classical uid for '{{ user.name }}'"
|
|
||||||
user:
|
|
||||||
state: present
|
|
||||||
uid: '{{ user.uid }}'
|
|
||||||
name: '{{ user.name }}'
|
|
||||||
comment: '{{ user.fullname }}'
|
|
||||||
shell: /bin/bash
|
|
||||||
password: '{{ user.password_hash }}'
|
|
||||||
update_password: on_create
|
|
||||||
when: loginisbusy.rc != 0 and uidisbusy.rc != 0
|
|
||||||
|
|
||||||
- name: "Add Unix account with random uid for '{{ user.name }}'"
|
|
||||||
user:
|
|
||||||
state: present
|
|
||||||
name: '{{ user.name }}'
|
|
||||||
comment: '{{ user.fullname }}'
|
|
||||||
shell: /bin/bash
|
|
||||||
password: '{{ user.password_hash }}'
|
|
||||||
update_password: on_create
|
|
||||||
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
|
||||||
|
|
||||||
- name: "Create secondary groups"
|
- name: "Create secondary groups"
|
||||||
group:
|
group:
|
||||||
name: "{{ group }}"
|
name: "{{ item }}"
|
||||||
with_items: "{{ user.groups }}"
|
with_items: "{{ evolinux_users.values() | map(attribute='groups') | list | unique }}"
|
||||||
loop_control:
|
|
||||||
loop_var: group
|
|
||||||
when: user.groups is defined
|
|
||||||
|
|
||||||
- name: "Add user '{{ user.name }}' to secondary groups"
|
#- name: "Test if '{{ user }}' exists"
|
||||||
|
# command: 'getent passwd {{ user }}'
|
||||||
|
# register: loginisbusy
|
||||||
|
# failed_when: False
|
||||||
|
# changed_when: False
|
||||||
|
# check_mode: no
|
||||||
|
#
|
||||||
|
#- name: "Test if uid exists for '{{ user }}'"
|
||||||
|
# command: 'getent passwd {{ user }}'
|
||||||
|
# register: uidisbusy
|
||||||
|
# failed_when: False
|
||||||
|
# changed_when: False
|
||||||
|
# check_mode: no
|
||||||
|
#
|
||||||
|
#- name: "Add Unix account with classical uid for '{{ user }}'"
|
||||||
|
# user:
|
||||||
|
# state: present
|
||||||
|
# uid: '{{ evolinux_users[user].value.uid }}'
|
||||||
|
# name: '{{ user.name }}'
|
||||||
|
# comment: '{{ user.fullname }}'
|
||||||
|
# shell: /bin/bash
|
||||||
|
# password: '{{ user.password_hash }}'
|
||||||
|
# update_password: on_create
|
||||||
|
# when: loginisbusy.rc != 0 and uidisbusy.rc != 0
|
||||||
|
#
|
||||||
|
- name: "Add Unix account"
|
||||||
user:
|
user:
|
||||||
name: '{{ user.name }}'
|
state: present
|
||||||
groups: "{{ user.groups }}"
|
uid: '{{ item.value.uid }}'
|
||||||
append: yes
|
name: '{{ item.key }}'
|
||||||
when: user.groups is defined
|
groups: '{{ item.value.groups }}'
|
||||||
|
comment: '{{ item.value.fullname }}'
|
||||||
|
shell: /bin/bash
|
||||||
|
password: '{{ item.value.password_hash }}'
|
||||||
|
update_password: on_create
|
||||||
|
when: loginisbusy.rc != 0 and uidisbusy.rc == 0
|
||||||
|
with_dict: "{{ evolinux_users }}"
|
||||||
|
|
||||||
- name: "Fix perms on home directory for '{{ user.name }}'"
|
- name: "Fix perms on home directory"
|
||||||
file:
|
file:
|
||||||
name: '/home/{{ user.name }}'
|
name: "/home/{{ item }}"
|
||||||
mode: "0700"
|
state: directory
|
||||||
state: directory
|
owner: "{{ item }}"
|
||||||
|
group: "{{ item }}"
|
||||||
|
mode: "0700"
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
|
|
||||||
|
- name: "Add evomaintenance trap"
|
||||||
|
lineinfile:
|
||||||
|
state: present
|
||||||
|
dest: '/home/{{ item }}/.profile'
|
||||||
|
insertafter: EOF
|
||||||
|
regexp: "evomaintenance.sh"
|
||||||
|
line: 'trap "sudo /usr/share/scripts/evomaintenance.sh" 0'
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
|
|
|
@ -9,11 +9,18 @@
|
||||||
msg: "Warning: empty 'evolinux_users' variable, tasks will be skipped!"
|
msg: "Warning: empty 'evolinux_users' variable, tasks will be skipped!"
|
||||||
when: evolinux_users == {}
|
when: evolinux_users == {}
|
||||||
|
|
||||||
- name: Create user accounts
|
- block:
|
||||||
include: user.yml
|
- include: account.yml
|
||||||
vars:
|
|
||||||
user: "{{ item.value }}"
|
- include: ssh.yml
|
||||||
with_dict: "{{ evolinux_users }}"
|
|
||||||
|
- include: sudo_jessie.yml
|
||||||
|
when: ansible_distribution_release == "jessie"
|
||||||
|
|
||||||
|
- include: sudo_stretch.yml
|
||||||
|
when: ansible_distribution_major_version | version_compare('9', '>=')
|
||||||
|
|
||||||
|
- meta: flush_handlers
|
||||||
when: evolinux_users != {}
|
when: evolinux_users != {}
|
||||||
|
|
||||||
- include: root_disable_ssh.yml
|
- include: root_disable_ssh.yml
|
||||||
|
|
|
@ -1,16 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- name: search profile for presence of evomaintenance
|
|
||||||
command: 'grep -q "trap.*sudo.*evomaintenance.sh"'
|
|
||||||
changed_when: False
|
|
||||||
failed_when: False
|
|
||||||
register: grep_profile_evomaintenance
|
|
||||||
|
|
||||||
# Don't add the trap if it is present or commented
|
|
||||||
- name: "Add evomaintenance trap for '{{ user.name }}'"
|
|
||||||
lineinfile:
|
|
||||||
state: present
|
|
||||||
dest: '/home/{{ user.name }}/.profile'
|
|
||||||
insertafter: EOF
|
|
||||||
line: 'trap "sudo /usr/share/scripts/evomaintenance.sh" 0'
|
|
||||||
when: grep_profile_evomaintenance.rc != 0
|
|
|
@ -1,30 +1,20 @@
|
||||||
---
|
---
|
||||||
|
- name: "Fix perms on ssh directory"
|
||||||
|
|
||||||
- name: "Create .ssh directory for '{{ user.name }}'"
|
|
||||||
file:
|
file:
|
||||||
dest: '/home/{{ user.name }}/.ssh/'
|
name: "/home/{{ item }}/.ssh"
|
||||||
state: directory
|
state: directory
|
||||||
|
owner: "{{ item }}"
|
||||||
|
group: "{{ item }}"
|
||||||
mode: "0700"
|
mode: "0700"
|
||||||
owner: '{{ user.name }}'
|
with_items: "{{ evolinux_users | list }}"
|
||||||
group: '{{ user.name }}'
|
|
||||||
|
|
||||||
- name: "Add user's SSH public key for '{{ user.name }}'"
|
- name: "Add user's SSH public key"
|
||||||
authorized_key:
|
authorized_key:
|
||||||
user: "{{ user.name }}"
|
user: "{{ item.key }}"
|
||||||
key: "{{ user.ssh_key }}"
|
key: "{{ item.value.ssh_key }}"
|
||||||
state: present
|
state: present
|
||||||
when: user.ssh_key is defined
|
when: item.value.ssh_key is defined
|
||||||
|
with_dict: "{{ evolinux_users }}"
|
||||||
- name: "Add user's SSH public keys for '{{ user.name }}'"
|
|
||||||
authorized_key:
|
|
||||||
user: "{{ user.name }}"
|
|
||||||
key: "{{ ssk_key }}"
|
|
||||||
state: present
|
|
||||||
with_items: "{{ user.ssh_keys }}"
|
|
||||||
loop_control:
|
|
||||||
loop_var: ssk_key
|
|
||||||
when: user.ssh_keys is defined
|
|
||||||
|
|
||||||
# we must double-escape caracters, because python
|
# we must double-escape caracters, because python
|
||||||
- name: verify AllowUsers directive
|
- name: verify AllowUsers directive
|
||||||
|
@ -34,22 +24,23 @@
|
||||||
register: grep_allowusers_ssh
|
register: grep_allowusers_ssh
|
||||||
check_mode: no
|
check_mode: no
|
||||||
|
|
||||||
- name: "Add AllowUsers sshd directive for '{{ user.name }}'"
|
- name: "Add AllowUsers sshd directive"
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/ssh/sshd_config
|
dest: /etc/ssh/sshd_config
|
||||||
line: "\nAllowUsers {{ user.name }}"
|
line: "\nAllowUsers {{ evolinux_users | list | join(' ') }}"
|
||||||
insertafter: 'Subsystem'
|
insertafter: 'Subsystem'
|
||||||
validate: '/usr/sbin/sshd -T -f %s'
|
validate: '/usr/sbin/sshd -T -f %s'
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
when: grep_allowusers_ssh.rc != 0
|
when: grep_allowusers_ssh.rc != 0
|
||||||
|
|
||||||
- name: "Modify AllowUsers sshd directive for '{{ user.name }}'"
|
- name: "Update AllowUsers sshd directive"
|
||||||
replace:
|
replace:
|
||||||
dest: /etc/ssh/sshd_config
|
dest: /etc/ssh/sshd_config
|
||||||
regexp: '^(AllowUsers ((?!\b{{ user.name }}\b).)*)$'
|
regexp: '^(AllowUsers ((?!\b{{ item }}\b).)*)$'
|
||||||
replace: '\1 {{ user.name }}'
|
replace: '\1 {{ item }}'
|
||||||
validate: '/usr/sbin/sshd -T -f %s'
|
validate: '/usr/sbin/sshd -T -f %s'
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
when: grep_allowusers_ssh.rc == 0
|
when: grep_allowusers_ssh.rc == 0
|
||||||
|
|
||||||
- name: "verify Match User directive"
|
- name: "verify Match User directive"
|
||||||
|
@ -59,10 +50,10 @@
|
||||||
register: grep_matchuser_ssh
|
register: grep_matchuser_ssh
|
||||||
check_mode: no
|
check_mode: no
|
||||||
|
|
||||||
- name: "Add Match User sshd directive for '{{ user.name }}' (Jessie)"
|
- name: "Add Match User sshd directive (Jessie)"
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/ssh/sshd_config
|
dest: /etc/ssh/sshd_config
|
||||||
line: "\nMatch User {{ user.name }}\n PasswordAuthentication no"
|
line: "\nMatch User {{ evolinux_users | list | join(',') }}\n PasswordAuthentication no"
|
||||||
insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
|
insertafter: "# END EVOLINUX PASSWORD RESTRICTIONS BY ADDRESS"
|
||||||
validate: '/usr/sbin/sshd -T -f %s'
|
validate: '/usr/sbin/sshd -T -f %s'
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
|
@ -70,13 +61,14 @@
|
||||||
- ansible_distribution_release == "jessie"
|
- ansible_distribution_release == "jessie"
|
||||||
- grep_matchuser_ssh.rc != 0
|
- grep_matchuser_ssh.rc != 0
|
||||||
|
|
||||||
- name: "Modify Match User's sshd directive for '{{ user.name }}' (Jessie)"
|
- name: "Update Match User's sshd directive (Jessie)"
|
||||||
replace:
|
replace:
|
||||||
dest: /etc/ssh/sshd_config
|
dest: /etc/ssh/sshd_config
|
||||||
regexp: '^(Match User ((?!{{ user.name }}).)*)$'
|
regexp: '^(Match User ((?!{{ item }}).)*)$'
|
||||||
replace: '\1,{{ user.name }}'
|
replace: '\1,{{ item }}'
|
||||||
validate: '/usr/sbin/sshd -T -f %s'
|
validate: '/usr/sbin/sshd -T -f %s'
|
||||||
notify: reload sshd
|
notify: reload sshd
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
when:
|
when:
|
||||||
- ansible_distribution_release == "jessie"
|
- ansible_distribution_release == "jessie"
|
||||||
- grep_matchuser_ssh.rc == 0
|
- grep_matchuser_ssh.rc == 0
|
||||||
|
|
|
@ -1,5 +1,4 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (jessie)"
|
- name: "Verify Evolinux sudoers file presence (jessie)"
|
||||||
template:
|
template:
|
||||||
src: sudoers_jessie.j2
|
src: sudoers_jessie.j2
|
||||||
|
@ -9,10 +8,11 @@
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
register: copy_sudoers_evolinux
|
register: copy_sudoers_evolinux
|
||||||
|
|
||||||
- name: "Add user in sudoers file for '{{ user.name }}' (jessie)"
|
- name: "Add user in sudoers file for '{{ item }}' (jessie)"
|
||||||
replace:
|
replace:
|
||||||
dest: /etc/sudoers.d/evolinux
|
dest: /etc/sudoers.d/evolinux
|
||||||
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ user.name }}).)*)$'
|
regexp: '^(User_Alias\s+ADMINS\s+=((?!{{ item }}).)*)$'
|
||||||
replace: '\1,{{ user.name }}'
|
replace: '\1,{{ item }}'
|
||||||
validate: '/usr/sbin/visudo -cf %s'
|
validate: '/usr/sbin/visudo -cf %s'
|
||||||
when: not copy_sudoers_evolinux.changed
|
when: not copy_sudoers_evolinux.changed
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
|
|
|
@ -1,5 +1,4 @@
|
||||||
---
|
---
|
||||||
|
|
||||||
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
- name: "Verify Evolinux sudoers file presence (Debian 9 or later)"
|
||||||
template:
|
template:
|
||||||
src: sudoers_stretch.j2
|
src: sudoers_stretch.j2
|
||||||
|
@ -15,6 +14,7 @@
|
||||||
|
|
||||||
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
- name: "Add user to evolinux-sudo group (Debian 9 or later)"
|
||||||
user:
|
user:
|
||||||
name: '{{ user.name }}'
|
name: '{{ item }}'
|
||||||
groups: "{{ evolinux_sudo_group }}"
|
groups: "{{ evolinux_sudo_group }}"
|
||||||
append: yes
|
append: yes
|
||||||
|
with_items: "{{ evolinux_users | list }}"
|
||||||
|
|
|
@ -1,15 +0,0 @@
|
||||||
---
|
|
||||||
|
|
||||||
- include: account.yml
|
|
||||||
|
|
||||||
- include: profile.yml
|
|
||||||
|
|
||||||
- include: ssh.yml
|
|
||||||
|
|
||||||
- include: sudo_jessie.yml
|
|
||||||
when: ansible_distribution_release == "jessie"
|
|
||||||
|
|
||||||
- include: sudo_stretch.yml
|
|
||||||
when: ansible_distribution_major_version | version_compare('9', '>=')
|
|
||||||
|
|
||||||
- meta: flush_handlers
|
|
Loading…
Reference in a new issue