79 lines
2.2 KiB
YAML
79 lines
2.2 KiB
YAML
|
---
|
||
|
|
- name: Configure local users
|
||
|
|
hosts: all:!network
|
||
|
|
tags:
|
||
|
|
- auth
|
||
|
|
- ssh
|
||
|
|
- users
|
||
|
|
tasks:
|
||
|
|
- import_tasks: tasks/preprocess-local-users.yml
|
||
|
|
|
||
|
|
- name: Create local user accounts
|
||
|
|
tags: users_create
|
||
|
|
become: true
|
||
|
|
block:
|
||
|
|
- name: Create groups
|
||
|
|
group:
|
||
|
|
name: "{{ item }}"
|
||
|
|
state: present
|
||
|
|
loop: "{{ local_targets + ['omni'] }}"
|
||
|
|
|
||
|
|
- name: Load user passwords
|
||
|
|
include_vars:
|
||
|
|
file: secrets/passwords.yml
|
||
|
|
|
||
|
|
- name: Create users
|
||
|
|
user:
|
||
|
|
name: "{{ item.name }}"
|
||
|
|
comment: "{{ item.fullname | default('') }}"
|
||
|
|
shell: /bin/bash
|
||
|
|
groups: "{{ item.targets | intersect(local_targets) + ['omni'] }}"
|
||
|
|
system: "{{ item.svc | default(False) }}"
|
||
|
|
state: present
|
||
|
|
generate_ssh_key: false
|
||
|
|
password: "{{ users_secrets[item.name] }}"
|
||
|
|
loop: "{{ users_local }}"
|
||
|
|
|
||
|
|
- name: Delete removed user accounts
|
||
|
|
become: true
|
||
|
|
user:
|
||
|
|
name: "{{ item }}"
|
||
|
|
state: absent
|
||
|
|
loop: "{{ users_local_removed | default([]) | difference(protected_users) }}"
|
||
|
|
|
||
|
|
- name: Grant sudo permissions to admin user accounts
|
||
|
|
become: true
|
||
|
|
user:
|
||
|
|
name: "{{ item.name }}"
|
||
|
|
groups: "{{ 'wheel' if ansible_os_family | lower == 'redhat' else 'sudo' }}"
|
||
|
|
state: present
|
||
|
|
loop: "{{ users_local_admin }}"
|
||
|
|
|
||
|
|
- name: Disable sudo password for ansible
|
||
|
|
become: true
|
||
|
|
lineinfile:
|
||
|
|
create: true
|
||
|
|
path: /etc/sudoers.d/30-ansible
|
||
|
|
line: "ansible ALL=(ALL) NOPASSWD:ALL"
|
||
|
|
mode: 0644
|
||
|
|
|
||
|
|
- name: Disable sudo password for admin users
|
||
|
|
become: true
|
||
|
|
lineinfile:
|
||
|
|
create: true
|
||
|
|
path: /etc/sudoers.d/40-admin
|
||
|
|
line: "{{ item.name }} ALL=(ALL) NOPASSWD:ALL"
|
||
|
|
mode: 0644
|
||
|
|
state: "{{ 'present' if disable_sudo_password | bool == true else 'absent' }}"
|
||
|
|
loop: "{{ users_local_admin }}"
|
||
|
|
|
||
|
|
- name: Ensure proper ownership of user home directories
|
||
|
|
become: true
|
||
|
|
file:
|
||
|
|
group: "{{ item.name }}"
|
||
|
|
owner: "{{ item.name }}"
|
||
|
|
path: /home/{{ item.name }}
|
||
|
|
recurse: true
|
||
|
|
state: directory
|
||
|
|
loop: "{{ users_local }}"
|