forked from LibreSchool/server-config
WIP. Reviewed nethcfg role and disabled libreschool repository. Disabled other role for security.
This commit is contained in:
parent
a84be475bc
commit
93a68f626d
@ -1,32 +1,13 @@
|
|||||||
---
|
---
|
||||||
# Domain groups
|
# Domain groups
|
||||||
|
|
||||||
# Domain Users
|
|
||||||
|
|
||||||
- name: domusers - Checking for group
|
|
||||||
shell: /sbin/e-smith/db accounts show domusers
|
|
||||||
register: check_domusers
|
|
||||||
ignore_errors: true
|
|
||||||
|
|
||||||
- name: domusers - Creating new group
|
|
||||||
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
|
|
||||||
when: check_domusers|failed
|
|
||||||
|
|
||||||
- name: domusers - Activating group
|
|
||||||
shell: /sbin/e-smith/signal-event group-create domusers
|
|
||||||
when: check_domusers|failed
|
|
||||||
|
|
||||||
# Domain Operators
|
# Domain Operators
|
||||||
|
|
||||||
- name: domopers - Checking for group
|
- name: domopers - Checking for group
|
||||||
shell: /sbin/e-smith/db accounts show domopers
|
shell: /bin/getent group domopers
|
||||||
register: check_domopers
|
register: check_domopers
|
||||||
ignore_errors: true
|
ignore_errors: true
|
||||||
|
|
||||||
- name: domopers - Creating new group
|
|
||||||
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
|
|
||||||
when: check_domopers|failed
|
|
||||||
|
|
||||||
- name: domopers - Activating group
|
- name: domopers - Activating group
|
||||||
shell: /sbin/e-smith/signal-event group-create domopers
|
shell: /sbin/e-smith/signal-event group-create domopers
|
||||||
when: check_domopers|failed
|
when: check_domopers|failed
|
||||||
@ -34,14 +15,10 @@
|
|||||||
# Docenti
|
# Docenti
|
||||||
|
|
||||||
- name: docenti - Checking for group
|
- name: docenti - Checking for group
|
||||||
shell: /sbin/e-smith/db accounts show docenti
|
shell: /bin/getent group docenti
|
||||||
register: check_docenti
|
register: check_docenti
|
||||||
ignore_errors: true
|
ignore_errors: true
|
||||||
|
|
||||||
- name: docenti - Creating new group
|
|
||||||
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
|
|
||||||
when: check_docenti|failed
|
|
||||||
|
|
||||||
- name: docenti - Activating group
|
- name: docenti - Activating group
|
||||||
shell: /sbin/e-smith/signal-event group-create docenti
|
shell: /sbin/e-smith/signal-event group-create docenti
|
||||||
when: check_docenti|failed
|
when: check_docenti|failed
|
||||||
|
@ -9,7 +9,7 @@
|
|||||||
tags: password-policy
|
tags: password-policy
|
||||||
|
|
||||||
- name: Configuring password policy
|
- name: Configuring password policy
|
||||||
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
|
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none MaxPassAge 180 MinPassAge 0 PassWarning 7
|
||||||
when: chk_passstr|changed
|
when: chk_passstr|changed
|
||||||
tags: password-policy
|
tags: password-policy
|
||||||
|
|
||||||
@ -17,4 +17,3 @@
|
|||||||
shell: /sbin/e-smith/signal-event password-policy-update
|
shell: /sbin/e-smith/signal-event password-policy-update
|
||||||
when: chk_passstr|changed
|
when: chk_passstr|changed
|
||||||
tags: password-policy
|
tags: password-policy
|
||||||
|
|
||||||
|
@ -4,21 +4,13 @@
|
|||||||
|
|
||||||
- name: Installing SAMBA and ibays packages
|
- name: Installing SAMBA and ibays packages
|
||||||
yum:
|
yum:
|
||||||
name: "{{ item }}"
|
name:
|
||||||
|
- "@nethserver-file-server"
|
||||||
|
- nethserver-samba-audit
|
||||||
state: present
|
state: present
|
||||||
with_items:
|
|
||||||
- nethserver-ibays
|
|
||||||
- nethserver-samba
|
|
||||||
- nethserver-samba-audit
|
|
||||||
|
|
||||||
# SAMBA
|
# SAMBA
|
||||||
|
|
||||||
- name: "Verifying modifications on templates-custom."
|
|
||||||
shell: grep -q 'server signing = mandatory' /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
|
||||||
register: check_tempcust
|
|
||||||
changed_when: check_tempcust.rc != 0
|
|
||||||
ignore_errors: true
|
|
||||||
|
|
||||||
- name: "Create directory structure for templates-custom"
|
- name: "Create directory structure for templates-custom"
|
||||||
file:
|
file:
|
||||||
path: "/etc/e-smith/templates-custom/etc/samba/smb.conf"
|
path: "/etc/e-smith/templates-custom/etc/samba/smb.conf"
|
||||||
@ -39,82 +31,83 @@
|
|||||||
when: check_tempcust|changed
|
when: check_tempcust|changed
|
||||||
|
|
||||||
- name: "Enabling unix extensions on SAMBA"
|
- name: "Enabling unix extensions on SAMBA"
|
||||||
replace:
|
|
||||||
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
|
||||||
regexp: '^unix extensions = no$'
|
|
||||||
replace: 'unix extensions = yes'
|
|
||||||
when: check_tempcust|changed
|
|
||||||
|
|
||||||
- name: Adding server signing as mandatory
|
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||||
line: "server signing = mandatory"
|
line: 'unix extensions = yes'
|
||||||
insertafter: "^workgroup = "
|
|
||||||
state: present
|
state: present
|
||||||
|
insertafter: EOF
|
||||||
when: check_tempcust|changed
|
when: check_tempcust|changed
|
||||||
|
|
||||||
- name: Checking SMB configuration
|
#- name: Adding server signing as mandatory
|
||||||
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
|
# lineinfile:
|
||||||
register: chk_smb
|
# dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||||
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
|
# line: "server signing = mandatory"
|
||||||
ignore_errors: true
|
# insertafter: "^workgroup = "
|
||||||
|
# state: present
|
||||||
|
# when: check_tempcust|changed
|
||||||
|
|
||||||
- name: Configuring SMB
|
#- name: Checking SMB configuration
|
||||||
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
|
# shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
|
||||||
when: chk_smb|changed
|
# register: chk_smb
|
||||||
|
# changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
|
||||||
|
# ignore_errors: true
|
||||||
|
|
||||||
- name: Activating SMB
|
#- name: Configuring SMB
|
||||||
shell: /sbin/e-smith/signal-event nethserver-samba-save
|
# shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
|
||||||
when: chk_smb|changed
|
# when: chk_smb|changed
|
||||||
|
#
|
||||||
|
#- name: Activating SMB
|
||||||
|
# shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||||
|
# when: chk_smb|changed
|
||||||
|
|
||||||
# ibays
|
# ibays
|
||||||
|
|
||||||
- name: Enabling SMB services restart when managing ibays
|
#- name: Enabling SMB services restart when managing ibays
|
||||||
file:
|
# file:
|
||||||
src: reload
|
# src: reload
|
||||||
dest: "{{ item }}/smb"
|
# dest: "{{ item }}/smb"
|
||||||
state: link
|
# state: link
|
||||||
force: yes
|
# force: yes
|
||||||
with_items:
|
# with_items:
|
||||||
- /etc/e-smith/events/ibay-delete/services2adjust
|
# - /etc/e-smith/events/ibay-delete/services2adjust
|
||||||
- /etc/e-smith/events/ibay-create/services2adjust
|
# - /etc/e-smith/events/ibay-create/services2adjust
|
||||||
- /etc/e-smith/events/ibay-modify/services2adjust
|
# - /etc/e-smith/events/ibay-modify/services2adjust
|
||||||
|
|
||||||
- name: Checking for shared ibay
|
- name: Checking for shared ibay
|
||||||
shell: /sbin/e-smith/db accounts show shared
|
shell: /sbin/e-smith/db accounts show shared
|
||||||
ignore_errors: true
|
ignore_errors: true
|
||||||
register: chk_shared
|
register: chk_shared
|
||||||
|
|
||||||
- name: Copying default templates for shared template type
|
#- name: Copying default templates for shared template type
|
||||||
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
|
# shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
|
||||||
when: force_ibay_shared|bool or chk_shared|failed
|
# when: force_ibay_shared|bool or chk_shared|failed
|
||||||
|
#
|
||||||
- name: Configuring ibay-shared template structure (directory mask)
|
#- name: Configuring ibay-shared template structure (directory mask)
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||||
line: 'directory mask = 0775'
|
# line: 'directory mask = 0775'
|
||||||
insertafter: '^create mask'
|
# insertafter: '^create mask'
|
||||||
state: present
|
# state: present
|
||||||
when: force_ibay_shared|bool or chk_shared|failed
|
# when: force_ibay_shared|bool or chk_shared|failed
|
||||||
|
#
|
||||||
- name: Configuring force create mode
|
#- name: Configuring force create mode
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||||
line: 'force create mode = 0664'
|
# line: 'force create mode = 0664'
|
||||||
insertafter: '^directory mask'
|
# insertafter: '^directory mask'
|
||||||
state: present
|
# state: present
|
||||||
when: force_ibay_shared|bool or chk_shared|failed
|
# when: force_ibay_shared|bool or chk_shared|failed
|
||||||
|
#
|
||||||
- name: Configuring force directory mode
|
#- name: Configuring force directory mode
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||||
line: 'force directory mode = 0775'
|
# line: 'force directory mode = 0775'
|
||||||
insertafter: '^force create mode'
|
# insertafter: '^force create mode'
|
||||||
state: present
|
# state: present
|
||||||
when: force_ibay_shared|bool or chk_shared|failed
|
# when: force_ibay_shared|bool or chk_shared|failed
|
||||||
|
|
||||||
- name: Configuring shared ibay
|
- name: Configuring shared ibay
|
||||||
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled
|
shell: /sbin/e-smith/db accounts set shared ibay AclRead "domain users@{{ ansible_local.domain.domainfull }}" AclWrite "domain users@{{ ansible_local.domain.domainfull }}" Description "Cartella condivisa" GroupAccess rw OtherAccess "" OwningGroup "domain admins@{{ ansible_local.domain.domainfull }}" SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbShareBrowseable enabled
|
||||||
when: chk_shared|failed
|
when: chk_shared|failed
|
||||||
|
|
||||||
- name: Activating shared ibay
|
- name: Activating shared ibay
|
||||||
@ -122,20 +115,20 @@
|
|||||||
become: yes
|
become: yes
|
||||||
when: chk_shared|failed
|
when: chk_shared|failed
|
||||||
|
|
||||||
- name: Changing ibay profile for shared
|
#- name: Changing ibay profile for shared
|
||||||
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
|
# shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
|
||||||
become: yes
|
# become: yes
|
||||||
when: force_ibay_shared|bool or chk_shared|failed
|
# when: force_ibay_shared|bool or chk_shared|failed
|
||||||
|
#
|
||||||
|
#- name: Saving new version of smb.conf
|
||||||
|
# shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||||
|
# become: yes
|
||||||
|
# when: check_tempcust|changed
|
||||||
|
|
||||||
- name: Saving new version of smb.conf
|
#- name: Forcing regeneration of smb.conf
|
||||||
shell: /sbin/e-smith/signal-event nethserver-samba-save
|
# shell: /sbin/e-smith/signal-event nethserver-samba-update
|
||||||
become: yes
|
# become: yes
|
||||||
when: check_tempcust|changed
|
# when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
|
||||||
|
|
||||||
- name: Forcing regeneration of smb.conf
|
|
||||||
shell: /sbin/e-smith/signal-event nethserver-samba-update
|
|
||||||
become: yes
|
|
||||||
when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
|
|
||||||
|
|
||||||
# Fixing issue #3 - Configure sudo access for admin on server for operator
|
# Fixing issue #3 - Configure sudo access for admin on server for operator
|
||||||
# access
|
# access
|
||||||
@ -143,7 +136,7 @@
|
|||||||
- name: Configuring sudo access for admin account
|
- name: Configuring sudo access for admin account
|
||||||
lineinfile:
|
lineinfile:
|
||||||
dest: /etc/sudoers.d/admin
|
dest: /etc/sudoers.d/admin
|
||||||
line: 'admin ALL=(ALL:ALL) NOPASSWD: ALL'
|
line: 'admin@{{ ansible_local.domain.domainfull }} ALL=(ALL) NOPASSWD: ALL'
|
||||||
create: yes
|
create: yes
|
||||||
owner: root
|
owner: root
|
||||||
group: root
|
group: root
|
||||||
|
@ -10,8 +10,8 @@
|
|||||||
- include: centos_pkgs.yml
|
- include: centos_pkgs.yml
|
||||||
tags: centos
|
tags: centos
|
||||||
|
|
||||||
- include: libreschool-repo.yml
|
#- include: libreschool-repo.yml
|
||||||
tags: libreschool
|
# tags: libreschool
|
||||||
|
|
||||||
- include: ansible.yml
|
- include: ansible.yml
|
||||||
tags:
|
tags:
|
||||||
|
Loading…
x
Reference in New Issue
Block a user