Evitati casi di rigenerazione delle chiavi SSH. Gestito correttamente inserimento in sudoers.
This commit is contained in:
parent
f64474fc0f
commit
fb109d8cf0
@ -1,5 +1,7 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- hosts: server
|
- hosts: server
|
||||||
|
vars:
|
||||||
|
- ansible_ssh_user: root
|
||||||
roles:
|
roles:
|
||||||
- firstsetup
|
- firstsetup
|
||||||
|
38
roles/base/tasks/clearos_pkg.yml
Normal file
38
roles/base/tasks/clearos_pkg.yml
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
---
|
||||||
|
|
||||||
|
- name: Aggiunta pacchetti specifici ClearOS
|
||||||
|
yum: name={{ item }} state=present
|
||||||
|
sudo: yes
|
||||||
|
with_item:
|
||||||
|
- app-content-filter
|
||||||
|
- app-web-proxy
|
||||||
|
- app-filter-proxy-report
|
||||||
|
- app-openldap-directory
|
||||||
|
- app-ntp
|
||||||
|
- app-configuration-backup
|
||||||
|
- app-backuppc
|
||||||
|
- app-firewall
|
||||||
|
- app-network
|
||||||
|
- app-users
|
||||||
|
- app-groups
|
||||||
|
- app-administrators
|
||||||
|
- app-password-policies
|
||||||
|
- app-accounts
|
||||||
|
- app-account-import
|
||||||
|
- app-services
|
||||||
|
- app-software-repository
|
||||||
|
- app-software-updates
|
||||||
|
- app-ssh-server
|
||||||
|
- app-dhcp
|
||||||
|
- app-flexshare
|
||||||
|
- app-process-viewer
|
||||||
|
- app-log-viewer
|
||||||
|
- app-print-server
|
||||||
|
- app-samba
|
||||||
|
- app-samba-core
|
||||||
|
- app-user-profile
|
||||||
|
- app-date
|
||||||
|
- app-marketplace
|
||||||
|
- app-registration
|
||||||
|
- app-dashboard
|
||||||
|
- app-base
|
@ -1,9 +1,6 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- include: add_centos_repos.yml
|
- include: add_centos_repos.yml
|
||||||
when: ansible_os_family == 'ClearOS'
|
|
||||||
|
|
||||||
- include: packages.yml
|
- include: packages.yml
|
||||||
when: ansible_os_family == 'ClearOS'
|
- include: clearos_pkg.yml
|
||||||
|
|
||||||
- include: ansible.yml
|
- include: ansible.yml
|
||||||
|
@ -1,3 +1,4 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
|
ansible_ssh_user: root
|
||||||
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub
|
admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub
|
||||||
|
@ -2,12 +2,22 @@
|
|||||||
|
|
||||||
- name: Creazione account di gestione Ansible
|
- name: Creazione account di gestione Ansible
|
||||||
user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
|
user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
|
||||||
remote_user: root
|
|
||||||
|
|
||||||
- name: Concessione permessi sudo
|
- name: Creo copia di backup di sudoers
|
||||||
lineinfile: dest=/etc/sudoers line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" validate="visudo -cf %s" state=present
|
shell: test -f {{ item }} || cp -fv /etc/sudoers {{ item }}
|
||||||
remote_user: root
|
with_items:
|
||||||
|
- /etc/sudoers.bak
|
||||||
|
- /etc/sudoers.tmp
|
||||||
|
register: copylog
|
||||||
|
changed_when: "'/etc/sudoers' in copylog.stdout"
|
||||||
|
|
||||||
|
- name: Concessione diritti all'utente di gestione Ansible
|
||||||
|
lineinfile: dest=/etc/sudoers.tmp regexp="^amgmt.*NOPASSWD" line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" state=present
|
||||||
|
register: sudotmp
|
||||||
|
|
||||||
|
- name: Applicazione diritti utente Ansible
|
||||||
|
shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers && rm /etc/sudoers.tmp
|
||||||
|
when: sudotmp|changed
|
||||||
|
|
||||||
- name: Installazione chiave privata PC locale
|
- name: Installazione chiave privata PC locale
|
||||||
authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present
|
authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present
|
||||||
remote_user: root
|
|
||||||
|
@ -1,6 +1,14 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
|
- name: Verifica chiave ssh
|
||||||
|
shell: test -f /root/.ssh/id_rsa
|
||||||
|
changed_when: false
|
||||||
|
ignore_errors: true
|
||||||
|
register: check_key
|
||||||
|
|
||||||
- name: Gestione creazione chiave ssh
|
- name: Gestione creazione chiave ssh
|
||||||
shell: ssh-keygen -t rsa -b 1024 -f id_rsa -N ''
|
shell: ssh-keygen -t rsa -b 1024 -f id_rsa -N ''
|
||||||
sudo: yes
|
sudo: yes
|
||||||
sudo_user: root
|
sudo_user: root
|
||||||
|
when: check_key|failed
|
||||||
|
changed_when: '"non-existant" in sshkeycheck.stdout'
|
||||||
|
Loading…
x
Reference in New Issue
Block a user