Evitati casi di rigenerazione delle chiavi SSH. Gestito correttamente inserimento in sudoers.

This commit is contained in:
Emiliano Vavassori 2015-04-16 03:53:39 +02:00
parent f64474fc0f
commit fb109d8cf0
6 changed files with 65 additions and 9 deletions

View File

@ -1,5 +1,7 @@
---
- hosts: server
vars:
- ansible_ssh_user: root
roles:
- firstsetup

View File

@ -0,0 +1,38 @@
---
- name: Aggiunta pacchetti specifici ClearOS
yum: name={{ item }} state=present
sudo: yes
with_item:
- app-content-filter
- app-web-proxy
- app-filter-proxy-report
- app-openldap-directory
- app-ntp
- app-configuration-backup
- app-backuppc
- app-firewall
- app-network
- app-users
- app-groups
- app-administrators
- app-password-policies
- app-accounts
- app-account-import
- app-services
- app-software-repository
- app-software-updates
- app-ssh-server
- app-dhcp
- app-flexshare
- app-process-viewer
- app-log-viewer
- app-print-server
- app-samba
- app-samba-core
- app-user-profile
- app-date
- app-marketplace
- app-registration
- app-dashboard
- app-base

View File

@ -1,9 +1,6 @@
---
- include: add_centos_repos.yml
when: ansible_os_family == 'ClearOS'
- include: packages.yml
when: ansible_os_family == 'ClearOS'
- include: clearos_pkg.yml
- include: ansible.yml

View File

@ -1,3 +1,4 @@
---
ansible_ssh_user: root
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub

View File

@ -2,12 +2,22 @@
- name: Creazione account di gestione Ansible
user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
remote_user: root
- name: Concessione permessi sudo
lineinfile: dest=/etc/sudoers line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" validate="visudo -cf %s" state=present
remote_user: root
- name: Creo copia di backup di sudoers
shell: test -f {{ item }} || cp -fv /etc/sudoers {{ item }}
with_items:
- /etc/sudoers.bak
- /etc/sudoers.tmp
register: copylog
changed_when: "'/etc/sudoers' in copylog.stdout"
- name: Concessione diritti all'utente di gestione Ansible
lineinfile: dest=/etc/sudoers.tmp regexp="^amgmt.*NOPASSWD" line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" state=present
register: sudotmp
- name: Applicazione diritti utente Ansible
shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers && rm /etc/sudoers.tmp
when: sudotmp|changed
- name: Installazione chiave privata PC locale
authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present
remote_user: root

View File

@ -1,6 +1,14 @@
---
- name: Verifica chiave ssh
shell: test -f /root/.ssh/id_rsa
changed_when: false
ignore_errors: true
register: check_key
- name: Gestione creazione chiave ssh
shell: ssh-keygen -t rsa -b 1024 -f id_rsa -N ''
sudo: yes
sudo_user: root
when: check_key|failed
changed_when: '"non-existant" in sshkeycheck.stdout'