Aggiunta di un po' di task: pam base e mount, smb installazione e configurazione.

This commit is contained in:
Emiliano Vavassori 2015-07-12 23:13:12 +02:00
parent 0a4776d91c
commit 181c845e67
9 changed files with 199 additions and 0 deletions

View File

@ -27,6 +27,9 @@
- name: Installazione pacchetti aggiuntivi
apt: pkg={{ item }} state=installed
with_items:
- vim
- screen
- cifs-utils
- ubuntu-edu-secondary
- epoptes-client
sudo: yes

View File

@ -16,3 +16,24 @@
tags:
- domain
- gui
- include: pkgs.yml
tags:
- domain
- pkgs
- include: pam_base.yml
tags:
- domain
- pam
- include: pam_mount.yml
tags:
- domain
- pam
- pam_mount
- include: smb_config.yml
tags:
- domain
- smb

View File

@ -0,0 +1,54 @@
---
# Configurazione di base di PAM per dominio
- name: 'installazione libpam-winbind'
apt: name=libpam-winbind state=present
sudo: yes
# common-auth
- name: 'common-auth: modifica pam_unix'
replace:
dest: /etc/pam.d/common-auth
regexp: '^.*pam_unix\.so.*nullok_secure$'
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
backup: yes
sudo: yes
- name: 'common-auth: aggiunta pam_winbind'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_winbind\.so$'
insertbefore: '^auth.*pam_unix\.so'
line: 'auth [success=2 default=ignore] pam_winbind.so'
state: present
sudo: yes
- name: 'common-auth: rimuovo config auto pam_winbind'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: 'pam_winbind\.so krb5'
state: absent
sudo: yes
# common-password
- name: 'common-password: configurazione pam_unix'
replace:
dest: /etc/pam.d/common-password
regexp: '^(password.*pam_unix\.so.*sha512)$'
replace: '\1 min=4 max=20'
backup: yes
sudo: yes
# common-session
- name: 'common-session: configurazione pam_mkhomedir'
lineinfile:
dest: /etc/pam.d/common-session
regexp: '^session.*pam_mkhomedir\.so.*$'
insertafter: '^session\s*required.*pam_permit.so'
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
state: present
backup: yes
sudo: yes

View File

@ -0,0 +1,32 @@
---
# Configurazione base per pam_mount
- name: Installazione pam_mount
apt: name=libpam-mount state=present
sudo: yes
- name: Configurazione di pam_mount
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
sudo: yes
- name: Creazione directory di default per Condiviso
file: path=/etc/skel/Condiviso state=directory
sudo: yes
- name: 'common-auth: aggiunta pam_mount'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_mount\.so$'
insertafter: EOF
line: 'auth optional pam_mount.so'
state: present
sudo: yes
- name: 'common-session: aggiunta pam_mount'
lineinfile:
dest: /etc/pam.d/common-session
regexp: '^session.*pam_mount\.so$'
insertafter: 'session.*pam_winbind\.so'
line: 'session optional pam_mount.so'
state: present
sudo: yes

View File

@ -0,0 +1,7 @@
---
- name: Installazione pacchetti necessari per dominio
apt: pkg={{ item }} state=present
sudo: yes
with_items:
- winbind
- samba

View File

@ -0,0 +1,19 @@
---
- name: Configurazione smb.conf
template: src=smb.conf dest=/etc/samba/smb.conf validate='testparm -s %s' backup=yes
sudo: yes
register: cfg_samba
- name: Riavvio samba
shell: restart smbd
sudo: yes
when: cfg_samba|changed
- name: Riavvio winbind
shell: restart winbind
sudo: yes
when: cfg_samba|changed
- name: Creazione home base
file: path=/home/{{ domainshort }} owner=root group=root state=directory
sudo: yes

View File

@ -0,0 +1,45 @@
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
See pam_mount.conf(5) for a description.
-->
<pam_mount>
<!-- debug should come before everything else,
since this file is still processed in a single pass
from top-to-bottom -->
<debug enable="0" />
<!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
<!-- pam_mount parameters: General tunables -->
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!-- Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="true" />
</pam_mount>
<!-- {{ ansible_managed }} -->

View File

@ -0,0 +1,18 @@
# {{ ansible_managed }}
[global]
security = domain
netbios name = {{ ansible_hostname }}
password server = {{ serverfqdn }}
workgroup = {{ domainshort }}
idmap uid = 10000000-19999999
idmap gid = 10000000-19999999
winbind use default domain = yes
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template shell = /bin/bash
template homedir = /home/%D/%U
domain master = no
winbind enum users = yes
winbind enum groups = yes
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u