diff --git a/roles/ansible-pull/files/logrotate b/roles/ansible-pull/files/logrotate index 5eccdd2..51510a6 100644 --- a/roles/ansible-pull/files/logrotate +++ b/roles/ansible-pull/files/logrotate @@ -5,3 +5,10 @@ missingok notifempty } +/var/log/ansible-pull.log { + rotate 7 + daily + compress + missingok + notifempty +} diff --git a/roles/nethcfg/tasks/reconfig_srv.yml b/roles/nethcfg/tasks/reconfig_srv.yml index a7fc305..42c47a2 100644 --- a/roles/nethcfg/tasks/reconfig_srv.yml +++ b/roles/nethcfg/tasks/reconfig_srv.yml @@ -1,53 +1,99 @@ --- +- name: Verifica configurazione organizzazione + shell: /sbin/e-smith/db configuration printprop OrganizationContact City + register: check_org + changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout" + ignore_errors: yes + sudo: yes + - name: Configurazione organizzazione shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}" sudo: yes + when: check_org|changed - name: Configurazione nome server shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }} sudo: yes + register: chg_hostname + when: "'{{ ansible_hostnameĀ }}' != '{{ ansible_local.domain.server }}'" - name: Configurazione nome dominio shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }} sudo: yes + register: chg_domainname + when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfullĀ }}'" - name: Attivazione cambiamenti hostname shell: /sbin/e-smith/signal-event hostname-modify sudo: yes + when: chg_hostname|changed or chg_domainname|changed + +- name: Verifica robustezza password + shell: /sbin/e-smith/db configuration printprop passwordstrength Users + register: chk_passstr + changed_when: "'Users=none' not in chk_passstr.stdout" + sudo: yes + ignore_errors: true - name: Configurazione forza password shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none sudo: yes + when: chk_passstr|changed - name: Attivo configurazione policy password shell: /sbin/e-smith/signal-event password-policy-update sudo: yes + when: chk_passstr|changed + +- name: Verifica configurazione DHCP + shell: /sbin/e-smith/db dhcp getprop eth1 DhcpRangeStart + sudo: yes + ignore_errors: true + register: chk_dhcp - name: Configurazione servizio DHCP shell: /sbin/e-smith/db dhcp set eth1 range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled sudo: yes + when: chk_dhcp|failed - name: Attivazione configurazione DHCP shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save sudo: yes + when: chk_dhcp|failed + +- name: Verifica configurazione DNS + shell: /sbin/e-smith/db configuration printprop dns NameServers + sudo: yes + register: chk_dns + changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}' not in chk_dns.stdout" + ignore_errors: yes - name: Configurazione servizio DNS shell: /sbin/e-smith/db configuration setprop dns role resolver NameServers "{{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }}" sudo: yes - register: cfg_dns + when: chk_dns|changed - name: Attivo configurazione DNS shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save - when: cfg_dns|changed + when: chk_dns|changed sudo: yes +- name: Verifica configurazione NTP + shell: /sbin/e-smith/db configuration printprop ntpd NTPServer + sudo: yes + register: chk_ntp + changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout" + ignore_errors: true + - name: Configuro NTP shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled sudo: yes + when: chk_ntp|changed - name: Attivazione NTP shell: /sbin/e-smith/signal-event nethserver-ntp-update sudo: yes + when: chk_ntp|changed - name: Utilizzo unix extensions nei template per ibay replace: @@ -56,29 +102,54 @@ replace: 'unix extensions = yes' sudo: yes +- name: Verifica configurazione SMB + shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles + sudo: yes + register: chk_smb + changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" + ignore_errors: true + - name: Configurazione SMB shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled sudo: yes + when: chk_smb|changed - name: Attivo configurazione SMB shell: /sbin/e-smith/signal-event nethserver-samba-save sudo: yes + when: chk_smb|changed + +- name: Verifico la presenza del gruppo Domain Users + shell: /sbin/e-smith/db accounts show domusers + register: check_domusers + sudo: yes + ignore_errors: true - name: Creazione gruppo Domain Users shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no sudo: yes + when: check_domusers|failed - name: Configurazione nuovo gruppo Domain Users shell: /sbin/e-smith/signal-event group-create domusers sudo: yes + when: check_domusers|failed + +- name: Verifico la presenza del gruppo Domain Operators + shell: /sbin/e-smith/db accounts show domopers + register: check_domopers + sudo: yes + ignore_errors: true - name: Creazione gruppo Domain Operators shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no sudo: yes + when: check_domopers|failed - name: Configurazione nuovo gruppo Domain Operators shell: /sbin/e-smith/signal-event group-create domopers sudo: yes + when: check_domopers|failed - name: Abilito il ricaricamento dei servizi smb su ibay-create file: src="reload" dest="{{ item }}/smb" state=link force=yes @@ -88,38 +159,91 @@ - /etc/e-smith/events/ibay-modify/services2adjust sudo: yes +- name: Verifica creazione share condiviso + shell: /sbin/e-smith/db accounts show shared + sudo: yes + ignore_errors: true + register: chk_shared + - name: Configurazione share Condiviso shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled sudo: yes + when: chk_shared|failed - name: Attivazione share condiviso shell: /sbin/e-smith/signal-event ibay-create shared sudo: yes + when: chk_shared|failed + +- name: Verifica configurazione squid + shell: /sbin/e-smith/db configuration printprop squid GreenMode + sudo: yes + ignore_errors: yes + register: chk_squid + changed_when: "'GreenMode=transparent_ssl' not in chk_squid.stdout" - name: Configurazione squid shell: /sbin/e-smith/db configuration setprop squid BlueMode transparent_ssl GreenMode transparent_ssl PortBlock enabled status enabled DiskCache enabled DiskCacheSize 500 sudo: yes + when: chk_squid|changed - name: Attivazione configurazione squid shell: /sbin/e-smith/signal-event nethserver-squid-update sudo: yes + when: chk_squid|changed + +- name: Verifica configurazione squidguard + shell: /sbin/e-smith/db configuration printprop squidguard Lists + sudo: yes + ignore_errors: true + register: chk_squidguard + changed_when: "'Lists=shalla' not in chk_squidguard.stdout" - name: Configurazione squidguard shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled sudo: yes + when: chk_squidguard|changed - name: Scarico liste di filtraggio shell: /sbin/e-smith/signal-event nethserver-squidguard-downloadlists sudo: yes + when: chk_squidguard|changed - name: Attivazione squidguard shell: /sbin/e-smith/signal-event nethserver-squidguard-update sudo: yes + when: chk_squidguard|changed + +- name: Verifica configurazione squidclamav + shell: /sbin/e-smith/db configuration printprop squidclamav status + sudo: yes + ignore_errors: true + register: chk_squidclamav + changed_when: "'status=enabled' not in chk_squidclamav.stdout" - name: Configurazione squidclamav shell: /sbin/e-smith/db configuration setprop squidclamav status enabled sudo: yes + when: chk_squidclamav|changed - name: Attivazione squidclamav shell: /sbin/e-smith/signal-event nethserver-squidclamav-update sudo: yes + when: chk_squidclamav|changed + +- name: Verifica completamento configurazione per certificato + shell: /sbin/e-smith/db configuration printprop pki CommonName + sudo: yes + ignore_errors: true + register: chk_crt + changed_when: "'CommonName={{ ansible_local.domain.serverfqdn }}' not in chk_crt.stdout" + +- name: Completo la configurazione per produzione certificato + shell: /sbin/e-smith/db configuration setprop pki CertificateDuration 3650 CommonName {{ ansible_local.domain.serverfqdn }} + sudo: yes + when: chk_crt|changed + +- name: Rigenero il certificato con le informazioni inserite + shell: /sbin/e-smith/signal-event certificate-update + sudo: yes + tags: regen-ca