Aggiunta di un po' di task: pam base e mount, smb installazione e configurazione.
This commit is contained in:
parent
0a4776d91c
commit
181c845e67
@ -27,6 +27,9 @@
|
||||
- name: Installazione pacchetti aggiuntivi
|
||||
apt: pkg={{ item }} state=installed
|
||||
with_items:
|
||||
- vim
|
||||
- screen
|
||||
- cifs-utils
|
||||
- ubuntu-edu-secondary
|
||||
- epoptes-client
|
||||
sudo: yes
|
||||
|
Binary file not shown.
@ -16,3 +16,24 @@
|
||||
tags:
|
||||
- domain
|
||||
- gui
|
||||
|
||||
- include: pkgs.yml
|
||||
tags:
|
||||
- domain
|
||||
- pkgs
|
||||
|
||||
- include: pam_base.yml
|
||||
tags:
|
||||
- domain
|
||||
- pam
|
||||
|
||||
- include: pam_mount.yml
|
||||
tags:
|
||||
- domain
|
||||
- pam
|
||||
- pam_mount
|
||||
|
||||
- include: smb_config.yml
|
||||
tags:
|
||||
- domain
|
||||
- smb
|
||||
|
54
roles/domain/tasks/pam_base.yml
Normal file
54
roles/domain/tasks/pam_base.yml
Normal file
@ -0,0 +1,54 @@
|
||||
---
|
||||
# Configurazione di base di PAM per dominio
|
||||
|
||||
- name: 'installazione libpam-winbind'
|
||||
apt: name=libpam-winbind state=present
|
||||
sudo: yes
|
||||
|
||||
# common-auth
|
||||
|
||||
- name: 'common-auth: modifica pam_unix'
|
||||
replace:
|
||||
dest: /etc/pam.d/common-auth
|
||||
regexp: '^.*pam_unix\.so.*nullok_secure$'
|
||||
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
|
||||
backup: yes
|
||||
sudo: yes
|
||||
|
||||
- name: 'common-auth: aggiunta pam_winbind'
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/common-auth
|
||||
regexp: '^auth.*pam_winbind\.so$'
|
||||
insertbefore: '^auth.*pam_unix\.so'
|
||||
line: 'auth [success=2 default=ignore] pam_winbind.so'
|
||||
state: present
|
||||
sudo: yes
|
||||
|
||||
- name: 'common-auth: rimuovo config auto pam_winbind'
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/common-auth
|
||||
regexp: 'pam_winbind\.so krb5'
|
||||
state: absent
|
||||
sudo: yes
|
||||
|
||||
# common-password
|
||||
|
||||
- name: 'common-password: configurazione pam_unix'
|
||||
replace:
|
||||
dest: /etc/pam.d/common-password
|
||||
regexp: '^(password.*pam_unix\.so.*sha512)$'
|
||||
replace: '\1 min=4 max=20'
|
||||
backup: yes
|
||||
sudo: yes
|
||||
|
||||
# common-session
|
||||
|
||||
- name: 'common-session: configurazione pam_mkhomedir'
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/common-session
|
||||
regexp: '^session.*pam_mkhomedir\.so.*$'
|
||||
insertafter: '^session\s*required.*pam_permit.so'
|
||||
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
|
||||
state: present
|
||||
backup: yes
|
||||
sudo: yes
|
32
roles/domain/tasks/pam_mount.yml
Normal file
32
roles/domain/tasks/pam_mount.yml
Normal file
@ -0,0 +1,32 @@
|
||||
---
|
||||
# Configurazione base per pam_mount
|
||||
|
||||
- name: Installazione pam_mount
|
||||
apt: name=libpam-mount state=present
|
||||
sudo: yes
|
||||
|
||||
- name: Configurazione di pam_mount
|
||||
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
|
||||
sudo: yes
|
||||
|
||||
- name: Creazione directory di default per Condiviso
|
||||
file: path=/etc/skel/Condiviso state=directory
|
||||
sudo: yes
|
||||
|
||||
- name: 'common-auth: aggiunta pam_mount'
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/common-auth
|
||||
regexp: '^auth.*pam_mount\.so$'
|
||||
insertafter: EOF
|
||||
line: 'auth optional pam_mount.so'
|
||||
state: present
|
||||
sudo: yes
|
||||
|
||||
- name: 'common-session: aggiunta pam_mount'
|
||||
lineinfile:
|
||||
dest: /etc/pam.d/common-session
|
||||
regexp: '^session.*pam_mount\.so$'
|
||||
insertafter: 'session.*pam_winbind\.so'
|
||||
line: 'session optional pam_mount.so'
|
||||
state: present
|
||||
sudo: yes
|
7
roles/domain/tasks/pkgs.yml
Normal file
7
roles/domain/tasks/pkgs.yml
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: Installazione pacchetti necessari per dominio
|
||||
apt: pkg={{ item }} state=present
|
||||
sudo: yes
|
||||
with_items:
|
||||
- winbind
|
||||
- samba
|
19
roles/domain/tasks/smb_config.yml
Normal file
19
roles/domain/tasks/smb_config.yml
Normal file
@ -0,0 +1,19 @@
|
||||
---
|
||||
- name: Configurazione smb.conf
|
||||
template: src=smb.conf dest=/etc/samba/smb.conf validate='testparm -s %s' backup=yes
|
||||
sudo: yes
|
||||
register: cfg_samba
|
||||
|
||||
- name: Riavvio samba
|
||||
shell: restart smbd
|
||||
sudo: yes
|
||||
when: cfg_samba|changed
|
||||
|
||||
- name: Riavvio winbind
|
||||
shell: restart winbind
|
||||
sudo: yes
|
||||
when: cfg_samba|changed
|
||||
|
||||
- name: Creazione home base
|
||||
file: path=/home/{{ domainshort }} owner=root group=root state=directory
|
||||
sudo: yes
|
45
roles/domain/templates/pam_mount.conf.xml
Normal file
45
roles/domain/templates/pam_mount.conf.xml
Normal file
@ -0,0 +1,45 @@
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
||||
<!--
|
||||
See pam_mount.conf(5) for a description.
|
||||
-->
|
||||
|
||||
<pam_mount>
|
||||
|
||||
<!-- debug should come before everything else,
|
||||
since this file is still processed in a single pass
|
||||
from top-to-bottom -->
|
||||
|
||||
<debug enable="0" />
|
||||
|
||||
<!-- Volume definitions -->
|
||||
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
|
||||
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
|
||||
|
||||
<!-- pam_mount parameters: General tunables -->
|
||||
|
||||
<!--
|
||||
<luserconf name=".pam_mount.conf.xml" />
|
||||
-->
|
||||
|
||||
<!-- Note that commenting out mntoptions will give you the defaults.
|
||||
You will need to explicitly initialize it with the empty string
|
||||
to reset the defaults to nothing. -->
|
||||
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
|
||||
<!--
|
||||
<mntoptions deny="suid,dev" />
|
||||
<mntoptions allow="*" />
|
||||
<mntoptions deny="*" />
|
||||
-->
|
||||
<mntoptions require="nosuid,nodev" />
|
||||
|
||||
<logout wait="0" hup="0" term="0" kill="0" />
|
||||
|
||||
|
||||
<!-- pam_mount parameters: Volume-related -->
|
||||
|
||||
<mkmountpoint enable="1" remove="true" />
|
||||
|
||||
|
||||
</pam_mount>
|
||||
<!-- {{ ansible_managed }} -->
|
18
roles/domain/templates/smb.conf
Normal file
18
roles/domain/templates/smb.conf
Normal file
@ -0,0 +1,18 @@
|
||||
# {{ ansible_managed }}
|
||||
[global]
|
||||
security = domain
|
||||
netbios name = {{ ansible_hostname }}
|
||||
password server = {{ serverfqdn }}
|
||||
workgroup = {{ domainshort }}
|
||||
idmap uid = 10000000-19999999
|
||||
idmap gid = 10000000-19999999
|
||||
winbind use default domain = yes
|
||||
winbind enum users = no
|
||||
winbind enum groups = no
|
||||
winbind use default domain = yes
|
||||
template shell = /bin/bash
|
||||
template homedir = /home/%D/%U
|
||||
domain master = no
|
||||
winbind enum users = yes
|
||||
winbind enum groups = yes
|
||||
add machine script = /usr/sbin/useradd -d /var/lib/nobody -g 100 -s /bin/false -M %u
|
Loading…
x
Reference in New Issue
Block a user