diff --git a/roles/nethcfg/tasks/domain_groups.yml b/roles/nethcfg/tasks/domain_groups.yml index 719d037..831a4e6 100644 --- a/roles/nethcfg/tasks/domain_groups.yml +++ b/roles/nethcfg/tasks/domain_groups.yml @@ -1,32 +1,13 @@ --- # Domain groups -# Domain Users - -- name: domusers - Checking for group - shell: /sbin/e-smith/db accounts show domusers - register: check_domusers - ignore_errors: true - -- name: domusers - Creating new group - shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no - when: check_domusers|failed - -- name: domusers - Activating group - shell: /sbin/e-smith/signal-event group-create domusers - when: check_domusers|failed - # Domain Operators - name: domopers - Checking for group - shell: /sbin/e-smith/db accounts show domopers + shell: /bin/getent group domopers register: check_domopers ignore_errors: true -- name: domopers - Creating new group - shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no - when: check_domopers|failed - - name: domopers - Activating group shell: /sbin/e-smith/signal-event group-create domopers when: check_domopers|failed @@ -34,14 +15,10 @@ # Docenti - name: docenti - Checking for group - shell: /sbin/e-smith/db accounts show docenti + shell: /bin/getent group docenti register: check_docenti ignore_errors: true -- name: docenti - Creating new group - shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no - when: check_docenti|failed - - name: docenti - Activating group shell: /sbin/e-smith/signal-event group-create docenti when: check_docenti|failed diff --git a/roles/nethcfg/tasks/passwordpolicy.yml b/roles/nethcfg/tasks/passwordpolicy.yml index ba773cb..ab75a65 100644 --- a/roles/nethcfg/tasks/passwordpolicy.yml +++ b/roles/nethcfg/tasks/passwordpolicy.yml @@ -9,7 +9,7 @@ tags: password-policy - name: Configuring password policy - shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 + shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none MaxPassAge 180 MinPassAge 0 PassWarning 7 when: chk_passstr|changed tags: password-policy @@ -17,4 +17,3 @@ shell: /sbin/e-smith/signal-event password-policy-update when: chk_passstr|changed tags: password-policy - diff --git a/roles/nethcfg/tasks/samba.yml b/roles/nethcfg/tasks/samba.yml index a0fcd1c..43d1419 100644 --- a/roles/nethcfg/tasks/samba.yml +++ b/roles/nethcfg/tasks/samba.yml @@ -4,21 +4,13 @@ - name: Installing SAMBA and ibays packages yum: - name: "{{ item }}" + name: + - "@nethserver-file-server" + - nethserver-samba-audit state: present - with_items: - - nethserver-ibays - - nethserver-samba - - nethserver-samba-audit # SAMBA -- name: "Verifying modifications on templates-custom." - shell: grep -q 'server signing = mandatory' /etc/e-smith/templates-custom/etc/samba/smb.conf/10global - register: check_tempcust - changed_when: check_tempcust.rc != 0 - ignore_errors: true - - name: "Create directory structure for templates-custom" file: path: "/etc/e-smith/templates-custom/etc/samba/smb.conf" @@ -39,82 +31,83 @@ when: check_tempcust|changed - name: "Enabling unix extensions on SAMBA" - replace: - dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global - regexp: '^unix extensions = no$' - replace: 'unix extensions = yes' - when: check_tempcust|changed - -- name: Adding server signing as mandatory lineinfile: dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global - line: "server signing = mandatory" - insertafter: "^workgroup = " + line: 'unix extensions = yes' state: present + insertafter: EOF when: check_tempcust|changed -- name: Checking SMB configuration - shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles - register: chk_smb - changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" - ignore_errors: true +#- name: Adding server signing as mandatory +# lineinfile: +# dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global +# line: "server signing = mandatory" +# insertafter: "^workgroup = " +# state: present +# when: check_tempcust|changed -- name: Configuring SMB - shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled - when: chk_smb|changed +#- name: Checking SMB configuration +# shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles +# register: chk_smb +# changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" +# ignore_errors: true -- name: Activating SMB - shell: /sbin/e-smith/signal-event nethserver-samba-save - when: chk_smb|changed +#- name: Configuring SMB +# shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled +# when: chk_smb|changed +# +#- name: Activating SMB +# shell: /sbin/e-smith/signal-event nethserver-samba-save +# when: chk_smb|changed # ibays -- name: Enabling SMB services restart when managing ibays - file: - src: reload - dest: "{{ item }}/smb" - state: link - force: yes - with_items: - - /etc/e-smith/events/ibay-delete/services2adjust - - /etc/e-smith/events/ibay-create/services2adjust - - /etc/e-smith/events/ibay-modify/services2adjust +#- name: Enabling SMB services restart when managing ibays +# file: +# src: reload +# dest: "{{ item }}/smb" +# state: link +# force: yes +# with_items: +# - /etc/e-smith/events/ibay-delete/services2adjust +# - /etc/e-smith/events/ibay-create/services2adjust +# - /etc/e-smith/events/ibay-modify/services2adjust - name: Checking for shared ibay shell: /sbin/e-smith/db accounts show shared ignore_errors: true register: chk_shared -- name: Copying default templates for shared template type - shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring ibay-shared template structure (directory mask) - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'directory mask = 0775' - insertafter: '^create mask' - state: present - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring force create mode - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'force create mode = 0664' - insertafter: '^directory mask' - state: present - when: force_ibay_shared|bool or chk_shared|failed - -- name: Configuring force directory mode - lineinfile: - dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default - line: 'force directory mode = 0775' - insertafter: '^force create mode' - state: present - when: force_ibay_shared|bool or chk_shared|failed +#- name: Copying default templates for shared template type +# shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared +# when: force_ibay_shared|bool or chk_shared|failed +# +#- name: Configuring ibay-shared template structure (directory mask) +# lineinfile: +# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default +# line: 'directory mask = 0775' +# insertafter: '^create mask' +# state: present +# when: force_ibay_shared|bool or chk_shared|failed +# +#- name: Configuring force create mode +# lineinfile: +# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default +# line: 'force create mode = 0664' +# insertafter: '^directory mask' +# state: present +# when: force_ibay_shared|bool or chk_shared|failed +# +#- name: Configuring force directory mode +# lineinfile: +# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default +# line: 'force directory mode = 0775' +# insertafter: '^force create mode' +# state: present +# when: force_ibay_shared|bool or chk_shared|failed - name: Configuring shared ibay - shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled + shell: /sbin/e-smith/db accounts set shared ibay AclRead "domain users@{{ ansible_local.domain.domainfull }}" AclWrite "domain users@{{ ansible_local.domain.domainfull }}" Description "Cartella condivisa" GroupAccess rw OtherAccess "" OwningGroup "domain admins@{{ ansible_local.domain.domainfull }}" SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbShareBrowseable enabled when: chk_shared|failed - name: Activating shared ibay @@ -122,20 +115,20 @@ become: yes when: chk_shared|failed -- name: Changing ibay profile for shared - shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared - become: yes - when: force_ibay_shared|bool or chk_shared|failed +#- name: Changing ibay profile for shared +# shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared +# become: yes +# when: force_ibay_shared|bool or chk_shared|failed +# +#- name: Saving new version of smb.conf +# shell: /sbin/e-smith/signal-event nethserver-samba-save +# become: yes +# when: check_tempcust|changed -- name: Saving new version of smb.conf - shell: /sbin/e-smith/signal-event nethserver-samba-save - become: yes - when: check_tempcust|changed - -- name: Forcing regeneration of smb.conf - shell: /sbin/e-smith/signal-event nethserver-samba-update - become: yes - when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed +#- name: Forcing regeneration of smb.conf +# shell: /sbin/e-smith/signal-event nethserver-samba-update +# become: yes +# when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed # Fixing issue #3 - Configure sudo access for admin on server for operator # access @@ -143,7 +136,7 @@ - name: Configuring sudo access for admin account lineinfile: dest: /etc/sudoers.d/admin - line: 'admin ALL=(ALL:ALL) NOPASSWD: ALL' + line: 'admin@{{ ansible_local.domain.domainfull }} ALL=(ALL) NOPASSWD: ALL' create: yes owner: root group: root diff --git a/roles/setup/tasks/main.yml b/roles/setup/tasks/main.yml index c6e6fc4..a2c1138 100644 --- a/roles/setup/tasks/main.yml +++ b/roles/setup/tasks/main.yml @@ -10,8 +10,8 @@ - include: centos_pkgs.yml tags: centos -- include: libreschool-repo.yml - tags: libreschool +#- include: libreschool-repo.yml +# tags: libreschool - include: ansible.yml tags: diff --git a/setup.yml b/setup.yml index ef8fe44..0c14452 100644 --- a/setup.yml +++ b/setup.yml @@ -4,4 +4,4 @@ roles: - setup - nethcfg - - client-install + #- client-install