diff --git a/roles/base/tasks/base.yml b/roles/base/tasks/base.yml index 2c9b8aa..14ecebc 100644 --- a/roles/base/tasks/base.yml +++ b/roles/base/tasks/base.yml @@ -27,6 +27,9 @@ - name: Installazione pacchetti aggiuntivi apt: pkg={{ item }} state=installed with_items: + - vim + - screen + - cifs-utils - ubuntu-edu-secondary - epoptes-client sudo: yes diff --git a/roles/domain/tasks/.gui-customizations.yml.swp b/roles/domain/tasks/.gui-customizations.yml.swp deleted file mode 100644 index 5ed7b97..0000000 Binary files a/roles/domain/tasks/.gui-customizations.yml.swp and /dev/null differ diff --git a/roles/domain/tasks/main.yml b/roles/domain/tasks/main.yml index e764f5f..f01e324 100644 --- a/roles/domain/tasks/main.yml +++ b/roles/domain/tasks/main.yml @@ -16,3 +16,24 @@ tags: - domain - gui + +- include: pkgs.yml + tags: + - domain + - pkgs + +- include: pam_base.yml + tags: + - domain + - pam + +- include: pam_mount.yml + tags: + - domain + - pam + - pam_mount + +- include: smb_config.yml + tags: + - domain + - smb diff --git a/roles/domain/tasks/pam_base.yml b/roles/domain/tasks/pam_base.yml new file mode 100644 index 0000000..283f09e --- /dev/null +++ b/roles/domain/tasks/pam_base.yml @@ -0,0 +1,54 @@ +--- +# Configurazione di base di PAM per dominio + +- name: 'installazione libpam-winbind' + apt: name=libpam-winbind state=present + sudo: yes + +# common-auth + +- name: 'common-auth: modifica pam_unix' + replace: + dest: /etc/pam.d/common-auth + regexp: '^.*pam_unix\.so.*nullok_secure$' + replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass' + backup: yes + sudo: yes + +- name: 'common-auth: aggiunta pam_winbind' + lineinfile: + dest: /etc/pam.d/common-auth + regexp: '^auth.*pam_winbind\.so$' + insertbefore: '^auth.*pam_unix\.so' + line: 'auth [success=2 default=ignore] pam_winbind.so' + state: present + sudo: yes + +- name: 'common-auth: rimuovo config auto pam_winbind' + lineinfile: + dest: /etc/pam.d/common-auth + regexp: 'pam_winbind\.so krb5' + state: absent + sudo: yes + +# common-password + +- name: 'common-password: configurazione pam_unix' + replace: + dest: /etc/pam.d/common-password + regexp: '^(password.*pam_unix\.so.*sha512)$' + replace: '\1 min=4 max=20' + backup: yes + sudo: yes + +# common-session + +- name: 'common-session: configurazione pam_mkhomedir' + lineinfile: + dest: /etc/pam.d/common-session + regexp: '^session.*pam_mkhomedir\.so.*$' + insertafter: '^session\s*required.*pam_permit.so' + line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent' + state: present + backup: yes + sudo: yes diff --git a/roles/domain/tasks/pam_mount.yml b/roles/domain/tasks/pam_mount.yml new file mode 100644 index 0000000..4846260 --- /dev/null +++ b/roles/domain/tasks/pam_mount.yml @@ -0,0 +1,32 @@ +--- +# Configurazione base per pam_mount + +- name: Installazione pam_mount + apt: name=libpam-mount state=present + sudo: yes + +- name: Configurazione di pam_mount + template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes + sudo: yes + +- name: Creazione directory di default per Condiviso + file: path=/etc/skel/Condiviso state=directory + sudo: yes + +- name: 'common-auth: aggiunta pam_mount' + lineinfile: + dest: /etc/pam.d/common-auth + regexp: '^auth.*pam_mount\.so$' + insertafter: EOF + line: 'auth optional pam_mount.so' + state: present + sudo: yes + +- name: 'common-session: aggiunta pam_mount' + lineinfile: + dest: /etc/pam.d/common-session + regexp: '^session.*pam_mount\.so$' + insertafter: 'session.*pam_winbind\.so' + line: 'session optional pam_mount.so' + state: present + sudo: yes diff --git a/roles/domain/tasks/pkgs.yml b/roles/domain/tasks/pkgs.yml new file mode 100644 index 0000000..c7be7c3 --- /dev/null +++ b/roles/domain/tasks/pkgs.yml @@ -0,0 +1,7 @@ +--- +- name: Installazione pacchetti necessari per dominio + apt: pkg={{ item }} state=present + sudo: yes + with_items: + - winbind + - samba diff --git a/roles/domain/tasks/smb_config.yml b/roles/domain/tasks/smb_config.yml new file mode 100644 index 0000000..6a4d41e --- /dev/null +++ b/roles/domain/tasks/smb_config.yml @@ -0,0 +1,19 @@ +--- +- name: Configurazione smb.conf + template: src=smb.conf dest=/etc/samba/smb.conf validate='testparm -s %s' backup=yes + sudo: yes + register: cfg_samba + +- name: Riavvio samba + shell: restart smbd + sudo: yes + when: cfg_samba|changed + +- name: Riavvio winbind + shell: restart winbind + sudo: yes + when: cfg_samba|changed + +- name: Creazione home base + file: path=/home/{{ domainshort }} owner=root group=root state=directory + sudo: yes diff --git a/roles/domain/templates/pam_mount.conf.xml b/roles/domain/templates/pam_mount.conf.xml new file mode 100644 index 0000000..15e5e18 --- /dev/null +++ b/roles/domain/templates/pam_mount.conf.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/roles/domain/templates/smb.conf b/roles/domain/templates/smb.conf new file mode 100644 index 0000000..a3e587e --- /dev/null +++ b/roles/domain/templates/smb.conf @@ -0,0 +1,18 @@ +# {{ ansible_managed }} +[global] + security = domain + netbios name = {{ ansible_hostname }} + password server = {{ serverfqdn }} + workgroup = {{ domainshort }} + idmap uid = 10000000-19999999 + idmap gid = 10000000-19999999 + winbind use default domain = yes + winbind enum users = no + winbind enum groups = no + winbind use default domain = yes + template shell = /bin/bash + template homedir = /home/%D/%U + domain master = no + winbind enum users = yes + winbind enum groups = yes + add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u