From fb109d8cf07366ba5cdc608cb23e991fff1b96f6 Mon Sep 17 00:00:00 2001 From: Emiliano Vavassori Date: Thu, 16 Apr 2015 03:53:39 +0200 Subject: [PATCH] Evitati casi di rigenerazione delle chiavi SSH. Gestito correttamente inserimento in sudoers. --- firstsetup.yml | 2 ++ roles/base/tasks/clearos_pkg.yml | 38 +++++++++++++++++++++++++++ roles/base/tasks/main.yml | 5 +--- roles/firstsetup/defaults/main.yml | 1 + roles/firstsetup/tasks/mgmtuser.yml | 20 ++++++++++---- roles/firstsetup/tasks/ssh-keygen.yml | 8 ++++++ 6 files changed, 65 insertions(+), 9 deletions(-) create mode 100644 roles/base/tasks/clearos_pkg.yml diff --git a/firstsetup.yml b/firstsetup.yml index ac431da..e9aa5d2 100644 --- a/firstsetup.yml +++ b/firstsetup.yml @@ -1,5 +1,7 @@ --- - hosts: server + vars: + - ansible_ssh_user: root roles: - firstsetup diff --git a/roles/base/tasks/clearos_pkg.yml b/roles/base/tasks/clearos_pkg.yml new file mode 100644 index 0000000..aec0055 --- /dev/null +++ b/roles/base/tasks/clearos_pkg.yml @@ -0,0 +1,38 @@ +--- + +- name: Aggiunta pacchetti specifici ClearOS + yum: name={{ item }} state=present + sudo: yes + with_item: + - app-content-filter + - app-web-proxy + - app-filter-proxy-report + - app-openldap-directory + - app-ntp + - app-configuration-backup + - app-backuppc + - app-firewall + - app-network + - app-users + - app-groups + - app-administrators + - app-password-policies + - app-accounts + - app-account-import + - app-services + - app-software-repository + - app-software-updates + - app-ssh-server + - app-dhcp + - app-flexshare + - app-process-viewer + - app-log-viewer + - app-print-server + - app-samba + - app-samba-core + - app-user-profile + - app-date + - app-marketplace + - app-registration + - app-dashboard + - app-base diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml index d702803..529e380 100644 --- a/roles/base/tasks/main.yml +++ b/roles/base/tasks/main.yml @@ -1,9 +1,6 @@ --- - include: add_centos_repos.yml - when: ansible_os_family == 'ClearOS' - - include: packages.yml - when: ansible_os_family == 'ClearOS' - +- include: clearos_pkg.yml - include: ansible.yml diff --git a/roles/firstsetup/defaults/main.yml b/roles/firstsetup/defaults/main.yml index fed0f63..0f66ae8 100644 --- a/roles/firstsetup/defaults/main.yml +++ b/roles/firstsetup/defaults/main.yml @@ -1,3 +1,4 @@ --- +ansible_ssh_user: root admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub diff --git a/roles/firstsetup/tasks/mgmtuser.yml b/roles/firstsetup/tasks/mgmtuser.yml index 3a0af3f..69544f2 100644 --- a/roles/firstsetup/tasks/mgmtuser.yml +++ b/roles/firstsetup/tasks/mgmtuser.yml @@ -2,12 +2,22 @@ - name: Creazione account di gestione Ansible user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k. - remote_user: root -- name: Concessione permessi sudo - lineinfile: dest=/etc/sudoers line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" validate="visudo -cf %s" state=present - remote_user: root +- name: Creo copia di backup di sudoers + shell: test -f {{ item }} || cp -fv /etc/sudoers {{ item }} + with_items: + - /etc/sudoers.bak + - /etc/sudoers.tmp + register: copylog + changed_when: "'/etc/sudoers' in copylog.stdout" + +- name: Concessione diritti all'utente di gestione Ansible + lineinfile: dest=/etc/sudoers.tmp regexp="^amgmt.*NOPASSWD" line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" state=present + register: sudotmp + +- name: Applicazione diritti utente Ansible + shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers && rm /etc/sudoers.tmp + when: sudotmp|changed - name: Installazione chiave privata PC locale authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present - remote_user: root diff --git a/roles/firstsetup/tasks/ssh-keygen.yml b/roles/firstsetup/tasks/ssh-keygen.yml index c976ffc..158d6d6 100644 --- a/roles/firstsetup/tasks/ssh-keygen.yml +++ b/roles/firstsetup/tasks/ssh-keygen.yml @@ -1,6 +1,14 @@ --- +- name: Verifica chiave ssh + shell: test -f /root/.ssh/id_rsa + changed_when: false + ignore_errors: true + register: check_key + - name: Gestione creazione chiave ssh shell: ssh-keygen -t rsa -b 1024 -f id_rsa -N '' sudo: yes sudo_user: root + when: check_key|failed + changed_when: '"non-existant" in sshkeycheck.stdout'