Aggiunta di un po' di task: pam base e mount, smb installazione e configurazione.
This commit is contained in:
parent
0a4776d91c
commit
181c845e67
@ -27,6 +27,9 @@
|
|||||||
- name: Installazione pacchetti aggiuntivi
|
- name: Installazione pacchetti aggiuntivi
|
||||||
apt: pkg={{ item }} state=installed
|
apt: pkg={{ item }} state=installed
|
||||||
with_items:
|
with_items:
|
||||||
|
- vim
|
||||||
|
- screen
|
||||||
|
- cifs-utils
|
||||||
- ubuntu-edu-secondary
|
- ubuntu-edu-secondary
|
||||||
- epoptes-client
|
- epoptes-client
|
||||||
sudo: yes
|
sudo: yes
|
||||||
|
Binary file not shown.
@ -16,3 +16,24 @@
|
|||||||
tags:
|
tags:
|
||||||
- domain
|
- domain
|
||||||
- gui
|
- gui
|
||||||
|
|
||||||
|
- include: pkgs.yml
|
||||||
|
tags:
|
||||||
|
- domain
|
||||||
|
- pkgs
|
||||||
|
|
||||||
|
- include: pam_base.yml
|
||||||
|
tags:
|
||||||
|
- domain
|
||||||
|
- pam
|
||||||
|
|
||||||
|
- include: pam_mount.yml
|
||||||
|
tags:
|
||||||
|
- domain
|
||||||
|
- pam
|
||||||
|
- pam_mount
|
||||||
|
|
||||||
|
- include: smb_config.yml
|
||||||
|
tags:
|
||||||
|
- domain
|
||||||
|
- smb
|
||||||
|
54
roles/domain/tasks/pam_base.yml
Normal file
54
roles/domain/tasks/pam_base.yml
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
---
|
||||||
|
# Configurazione di base di PAM per dominio
|
||||||
|
|
||||||
|
- name: 'installazione libpam-winbind'
|
||||||
|
apt: name=libpam-winbind state=present
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
# common-auth
|
||||||
|
|
||||||
|
- name: 'common-auth: modifica pam_unix'
|
||||||
|
replace:
|
||||||
|
dest: /etc/pam.d/common-auth
|
||||||
|
regexp: '^.*pam_unix\.so.*nullok_secure$'
|
||||||
|
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
|
||||||
|
backup: yes
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: 'common-auth: aggiunta pam_winbind'
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/common-auth
|
||||||
|
regexp: '^auth.*pam_winbind\.so$'
|
||||||
|
insertbefore: '^auth.*pam_unix\.so'
|
||||||
|
line: 'auth [success=2 default=ignore] pam_winbind.so'
|
||||||
|
state: present
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: 'common-auth: rimuovo config auto pam_winbind'
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/common-auth
|
||||||
|
regexp: 'pam_winbind\.so krb5'
|
||||||
|
state: absent
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
# common-password
|
||||||
|
|
||||||
|
- name: 'common-password: configurazione pam_unix'
|
||||||
|
replace:
|
||||||
|
dest: /etc/pam.d/common-password
|
||||||
|
regexp: '^(password.*pam_unix\.so.*sha512)$'
|
||||||
|
replace: '\1 min=4 max=20'
|
||||||
|
backup: yes
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
# common-session
|
||||||
|
|
||||||
|
- name: 'common-session: configurazione pam_mkhomedir'
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/common-session
|
||||||
|
regexp: '^session.*pam_mkhomedir\.so.*$'
|
||||||
|
insertafter: '^session\s*required.*pam_permit.so'
|
||||||
|
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
|
||||||
|
state: present
|
||||||
|
backup: yes
|
||||||
|
sudo: yes
|
32
roles/domain/tasks/pam_mount.yml
Normal file
32
roles/domain/tasks/pam_mount.yml
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
---
|
||||||
|
# Configurazione base per pam_mount
|
||||||
|
|
||||||
|
- name: Installazione pam_mount
|
||||||
|
apt: name=libpam-mount state=present
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: Configurazione di pam_mount
|
||||||
|
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: Creazione directory di default per Condiviso
|
||||||
|
file: path=/etc/skel/Condiviso state=directory
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: 'common-auth: aggiunta pam_mount'
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/common-auth
|
||||||
|
regexp: '^auth.*pam_mount\.so$'
|
||||||
|
insertafter: EOF
|
||||||
|
line: 'auth optional pam_mount.so'
|
||||||
|
state: present
|
||||||
|
sudo: yes
|
||||||
|
|
||||||
|
- name: 'common-session: aggiunta pam_mount'
|
||||||
|
lineinfile:
|
||||||
|
dest: /etc/pam.d/common-session
|
||||||
|
regexp: '^session.*pam_mount\.so$'
|
||||||
|
insertafter: 'session.*pam_winbind\.so'
|
||||||
|
line: 'session optional pam_mount.so'
|
||||||
|
state: present
|
||||||
|
sudo: yes
|
7
roles/domain/tasks/pkgs.yml
Normal file
7
roles/domain/tasks/pkgs.yml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
- name: Installazione pacchetti necessari per dominio
|
||||||
|
apt: pkg={{ item }} state=present
|
||||||
|
sudo: yes
|
||||||
|
with_items:
|
||||||
|
- winbind
|
||||||
|
- samba
|
19
roles/domain/tasks/smb_config.yml
Normal file
19
roles/domain/tasks/smb_config.yml
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
- name: Configurazione smb.conf
|
||||||
|
template: src=smb.conf dest=/etc/samba/smb.conf validate='testparm -s %s' backup=yes
|
||||||
|
sudo: yes
|
||||||
|
register: cfg_samba
|
||||||
|
|
||||||
|
- name: Riavvio samba
|
||||||
|
shell: restart smbd
|
||||||
|
sudo: yes
|
||||||
|
when: cfg_samba|changed
|
||||||
|
|
||||||
|
- name: Riavvio winbind
|
||||||
|
shell: restart winbind
|
||||||
|
sudo: yes
|
||||||
|
when: cfg_samba|changed
|
||||||
|
|
||||||
|
- name: Creazione home base
|
||||||
|
file: path=/home/{{ domainshort }} owner=root group=root state=directory
|
||||||
|
sudo: yes
|
45
roles/domain/templates/pam_mount.conf.xml
Normal file
45
roles/domain/templates/pam_mount.conf.xml
Normal file
@ -0,0 +1,45 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
||||||
|
<!--
|
||||||
|
See pam_mount.conf(5) for a description.
|
||||||
|
-->
|
||||||
|
|
||||||
|
<pam_mount>
|
||||||
|
|
||||||
|
<!-- debug should come before everything else,
|
||||||
|
since this file is still processed in a single pass
|
||||||
|
from top-to-bottom -->
|
||||||
|
|
||||||
|
<debug enable="0" />
|
||||||
|
|
||||||
|
<!-- Volume definitions -->
|
||||||
|
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
|
||||||
|
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
|
||||||
|
|
||||||
|
<!-- pam_mount parameters: General tunables -->
|
||||||
|
|
||||||
|
<!--
|
||||||
|
<luserconf name=".pam_mount.conf.xml" />
|
||||||
|
-->
|
||||||
|
|
||||||
|
<!-- Note that commenting out mntoptions will give you the defaults.
|
||||||
|
You will need to explicitly initialize it with the empty string
|
||||||
|
to reset the defaults to nothing. -->
|
||||||
|
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
|
||||||
|
<!--
|
||||||
|
<mntoptions deny="suid,dev" />
|
||||||
|
<mntoptions allow="*" />
|
||||||
|
<mntoptions deny="*" />
|
||||||
|
-->
|
||||||
|
<mntoptions require="nosuid,nodev" />
|
||||||
|
|
||||||
|
<logout wait="0" hup="0" term="0" kill="0" />
|
||||||
|
|
||||||
|
|
||||||
|
<!-- pam_mount parameters: Volume-related -->
|
||||||
|
|
||||||
|
<mkmountpoint enable="1" remove="true" />
|
||||||
|
|
||||||
|
|
||||||
|
</pam_mount>
|
||||||
|
<!-- {{ ansible_managed }} -->
|
18
roles/domain/templates/smb.conf
Normal file
18
roles/domain/templates/smb.conf
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
# {{ ansible_managed }}
|
||||||
|
[global]
|
||||||
|
security = domain
|
||||||
|
netbios name = {{ ansible_hostname }}
|
||||||
|
password server = {{ serverfqdn }}
|
||||||
|
workgroup = {{ domainshort }}
|
||||||
|
idmap uid = 10000000-19999999
|
||||||
|
idmap gid = 10000000-19999999
|
||||||
|
winbind use default domain = yes
|
||||||
|
winbind enum users = no
|
||||||
|
winbind enum groups = no
|
||||||
|
winbind use default domain = yes
|
||||||
|
template shell = /bin/bash
|
||||||
|
template homedir = /home/%D/%U
|
||||||
|
domain master = no
|
||||||
|
winbind enum users = yes
|
||||||
|
winbind enum groups = yes
|
||||||
|
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u
|
Loading…
x
Reference in New Issue
Block a user