From fb109d8cf07366ba5cdc608cb23e991fff1b96f6 Mon Sep 17 00:00:00 2001
From: Emiliano Vavassori <syntaxerrormmm@gmail.com>
Date: Thu, 16 Apr 2015 03:53:39 +0200
Subject: [PATCH] Evitati casi di rigenerazione delle chiavi SSH. Gestito
 correttamente inserimento in sudoers.

---
 firstsetup.yml                        |  2 ++
 roles/base/tasks/clearos_pkg.yml      | 38 +++++++++++++++++++++++++++
 roles/base/tasks/main.yml             |  5 +---
 roles/firstsetup/defaults/main.yml    |  1 +
 roles/firstsetup/tasks/mgmtuser.yml   | 20 ++++++++++----
 roles/firstsetup/tasks/ssh-keygen.yml |  8 ++++++
 6 files changed, 65 insertions(+), 9 deletions(-)
 create mode 100644 roles/base/tasks/clearos_pkg.yml

diff --git a/firstsetup.yml b/firstsetup.yml
index ac431da..e9aa5d2 100644
--- a/firstsetup.yml
+++ b/firstsetup.yml
@@ -1,5 +1,7 @@
 ---
 
 - hosts: server
+  vars:
+    - ansible_ssh_user: root
   roles:
     - firstsetup
diff --git a/roles/base/tasks/clearos_pkg.yml b/roles/base/tasks/clearos_pkg.yml
new file mode 100644
index 0000000..aec0055
--- /dev/null
+++ b/roles/base/tasks/clearos_pkg.yml
@@ -0,0 +1,38 @@
+---
+
+- name: Aggiunta pacchetti specifici ClearOS
+  yum: name={{ item }} state=present 
+  sudo: yes
+  with_item:
+    - app-content-filter
+    - app-web-proxy
+    - app-filter-proxy-report
+    - app-openldap-directory
+    - app-ntp
+    - app-configuration-backup
+    - app-backuppc
+    - app-firewall
+    - app-network
+    - app-users
+    - app-groups
+    - app-administrators
+    - app-password-policies
+    - app-accounts
+    - app-account-import
+    - app-services
+    - app-software-repository
+    - app-software-updates
+    - app-ssh-server
+    - app-dhcp
+    - app-flexshare
+    - app-process-viewer
+    - app-log-viewer
+    - app-print-server
+    - app-samba
+    - app-samba-core
+    - app-user-profile
+    - app-date
+    - app-marketplace
+    - app-registration
+    - app-dashboard
+    - app-base
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index d702803..529e380 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -1,9 +1,6 @@
 ---
 
 - include: add_centos_repos.yml
-  when: ansible_os_family == 'ClearOS'
-
 - include: packages.yml
-  when: ansible_os_family == 'ClearOS'
-
+- include: clearos_pkg.yml
 - include: ansible.yml
diff --git a/roles/firstsetup/defaults/main.yml b/roles/firstsetup/defaults/main.yml
index fed0f63..0f66ae8 100644
--- a/roles/firstsetup/defaults/main.yml
+++ b/roles/firstsetup/defaults/main.yml
@@ -1,3 +1,4 @@
 ---
 
+ansible_ssh_user: root
 admin_sshkey: /Users/syntaxerrormmm/.ssh/id_rsa.pub
diff --git a/roles/firstsetup/tasks/mgmtuser.yml b/roles/firstsetup/tasks/mgmtuser.yml
index 3a0af3f..69544f2 100644
--- a/roles/firstsetup/tasks/mgmtuser.yml
+++ b/roles/firstsetup/tasks/mgmtuser.yml
@@ -2,12 +2,22 @@
 
 - name: Creazione account di gestione Ansible
   user: name=amgmt comment="Ansible Management User" group=wheel state=present password=$6$rounds=100000$XvHuMoXtpCksx379$nhlfUn38.oBB7JrDrtwfUisw8T0Bg5InzFq1fw31mcEmGZ2AYFkFK2zC2g04lSfw.kpdSgqH3Dl5q9r1fY6.k.
-  remote_user: root
 
-- name: Concessione permessi sudo
-  lineinfile: dest=/etc/sudoers line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" validate="visudo -cf %s" state=present
-  remote_user: root
+- name: Creo copia di backup di sudoers
+  shell: test -f {{ item }} || cp -fv /etc/sudoers {{ item }}
+  with_items:
+    - /etc/sudoers.bak
+    - /etc/sudoers.tmp
+  register: copylog
+  changed_when: "'/etc/sudoers' in copylog.stdout"
+
+- name: Concessione diritti all'utente di gestione Ansible
+  lineinfile: dest=/etc/sudoers.tmp regexp="^amgmt.*NOPASSWD" line="amgmt ALL=(ALL:ALL) NOPASSWD:ALL" state=present
+  register: sudotmp
+
+- name: Applicazione diritti utente Ansible
+  shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers && rm /etc/sudoers.tmp
+  when: sudotmp|changed
 
 - name: Installazione chiave privata PC locale
   authorized_key: user=amgmt key="{{ lookup('file', admin_sshkey) }}" state=present
-  remote_user: root
diff --git a/roles/firstsetup/tasks/ssh-keygen.yml b/roles/firstsetup/tasks/ssh-keygen.yml
index c976ffc..158d6d6 100644
--- a/roles/firstsetup/tasks/ssh-keygen.yml
+++ b/roles/firstsetup/tasks/ssh-keygen.yml
@@ -1,6 +1,14 @@
 ---
 
+- name: Verifica chiave ssh
+  shell: test -f /root/.ssh/id_rsa
+  changed_when: false
+  ignore_errors: true
+  register: check_key
+
 - name: Gestione creazione chiave ssh
   shell: ssh-keygen -t rsa -b 1024 -f id_rsa -N ''
   sudo: yes
   sudo_user: root
+  when: check_key|failed
+  changed_when: '"non-existant" in sshkeycheck.stdout'