WIP. Reviewed nethcfg role and disabled libreschool repository. Disabled other role for security.

This commit is contained in:
Emiliano Vavassori 2018-11-11 05:59:13 +01:00
parent a84be475bc
commit 93a68f626d
5 changed files with 82 additions and 113 deletions

View File

@ -1,32 +1,13 @@
--- ---
# Domain groups # Domain groups
# Domain Users
- name: domusers - Checking for group
shell: /sbin/e-smith/db accounts show domusers
register: check_domusers
ignore_errors: true
- name: domusers - Creating new group
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
when: check_domusers|failed
- name: domusers - Activating group
shell: /sbin/e-smith/signal-event group-create domusers
when: check_domusers|failed
# Domain Operators # Domain Operators
- name: domopers - Checking for group - name: domopers - Checking for group
shell: /sbin/e-smith/db accounts show domopers shell: /bin/getent group domopers
register: check_domopers register: check_domopers
ignore_errors: true ignore_errors: true
- name: domopers - Creating new group
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
when: check_domopers|failed
- name: domopers - Activating group - name: domopers - Activating group
shell: /sbin/e-smith/signal-event group-create domopers shell: /sbin/e-smith/signal-event group-create domopers
when: check_domopers|failed when: check_domopers|failed
@ -34,14 +15,10 @@
# Docenti # Docenti
- name: docenti - Checking for group - name: docenti - Checking for group
shell: /sbin/e-smith/db accounts show docenti shell: /bin/getent group docenti
register: check_docenti register: check_docenti
ignore_errors: true ignore_errors: true
- name: docenti - Creating new group
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
when: check_docenti|failed
- name: docenti - Activating group - name: docenti - Activating group
shell: /sbin/e-smith/signal-event group-create docenti shell: /sbin/e-smith/signal-event group-create docenti
when: check_docenti|failed when: check_docenti|failed

View File

@ -9,7 +9,7 @@
tags: password-policy tags: password-policy
- name: Configuring password policy - name: Configuring password policy
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none MaxPassAge 180 MinPassAge 0 PassWarning 7
when: chk_passstr|changed when: chk_passstr|changed
tags: password-policy tags: password-policy
@ -17,4 +17,3 @@
shell: /sbin/e-smith/signal-event password-policy-update shell: /sbin/e-smith/signal-event password-policy-update
when: chk_passstr|changed when: chk_passstr|changed
tags: password-policy tags: password-policy

View File

@ -4,21 +4,13 @@
- name: Installing SAMBA and ibays packages - name: Installing SAMBA and ibays packages
yum: yum:
name: "{{ item }}" name:
- "@nethserver-file-server"
- nethserver-samba-audit
state: present state: present
with_items:
- nethserver-ibays
- nethserver-samba
- nethserver-samba-audit
# SAMBA # SAMBA
- name: "Verifying modifications on templates-custom."
shell: grep -q 'server signing = mandatory' /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
register: check_tempcust
changed_when: check_tempcust.rc != 0
ignore_errors: true
- name: "Create directory structure for templates-custom" - name: "Create directory structure for templates-custom"
file: file:
path: "/etc/e-smith/templates-custom/etc/samba/smb.conf" path: "/etc/e-smith/templates-custom/etc/samba/smb.conf"
@ -39,82 +31,83 @@
when: check_tempcust|changed when: check_tempcust|changed
- name: "Enabling unix extensions on SAMBA" - name: "Enabling unix extensions on SAMBA"
replace:
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
regexp: '^unix extensions = no$'
replace: 'unix extensions = yes'
when: check_tempcust|changed
- name: Adding server signing as mandatory
lineinfile: lineinfile:
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
line: "server signing = mandatory" line: 'unix extensions = yes'
insertafter: "^workgroup = "
state: present state: present
insertafter: EOF
when: check_tempcust|changed when: check_tempcust|changed
- name: Checking SMB configuration #- name: Adding server signing as mandatory
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles # lineinfile:
register: chk_smb # dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout" # line: "server signing = mandatory"
ignore_errors: true # insertafter: "^workgroup = "
# state: present
# when: check_tempcust|changed
- name: Configuring SMB #- name: Checking SMB configuration
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled # shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
when: chk_smb|changed # register: chk_smb
# changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
# ignore_errors: true
- name: Activating SMB #- name: Configuring SMB
shell: /sbin/e-smith/signal-event nethserver-samba-save # shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
when: chk_smb|changed # when: chk_smb|changed
#
#- name: Activating SMB
# shell: /sbin/e-smith/signal-event nethserver-samba-save
# when: chk_smb|changed
# ibays # ibays
- name: Enabling SMB services restart when managing ibays #- name: Enabling SMB services restart when managing ibays
file: # file:
src: reload # src: reload
dest: "{{ item }}/smb" # dest: "{{ item }}/smb"
state: link # state: link
force: yes # force: yes
with_items: # with_items:
- /etc/e-smith/events/ibay-delete/services2adjust # - /etc/e-smith/events/ibay-delete/services2adjust
- /etc/e-smith/events/ibay-create/services2adjust # - /etc/e-smith/events/ibay-create/services2adjust
- /etc/e-smith/events/ibay-modify/services2adjust # - /etc/e-smith/events/ibay-modify/services2adjust
- name: Checking for shared ibay - name: Checking for shared ibay
shell: /sbin/e-smith/db accounts show shared shell: /sbin/e-smith/db accounts show shared
ignore_errors: true ignore_errors: true
register: chk_shared register: chk_shared
- name: Copying default templates for shared template type #- name: Copying default templates for shared template type
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared # shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
when: force_ibay_shared|bool or chk_shared|failed # when: force_ibay_shared|bool or chk_shared|failed
#
- name: Configuring ibay-shared template structure (directory mask) #- name: Configuring ibay-shared template structure (directory mask)
lineinfile: # lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default # dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'directory mask = 0775' # line: 'directory mask = 0775'
insertafter: '^create mask' # insertafter: '^create mask'
state: present # state: present
when: force_ibay_shared|bool or chk_shared|failed # when: force_ibay_shared|bool or chk_shared|failed
#
- name: Configuring force create mode #- name: Configuring force create mode
lineinfile: # lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default # dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force create mode = 0664' # line: 'force create mode = 0664'
insertafter: '^directory mask' # insertafter: '^directory mask'
state: present # state: present
when: force_ibay_shared|bool or chk_shared|failed # when: force_ibay_shared|bool or chk_shared|failed
#
- name: Configuring force directory mode #- name: Configuring force directory mode
lineinfile: # lineinfile:
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default # dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
line: 'force directory mode = 0775' # line: 'force directory mode = 0775'
insertafter: '^force create mode' # insertafter: '^force create mode'
state: present # state: present
when: force_ibay_shared|bool or chk_shared|failed # when: force_ibay_shared|bool or chk_shared|failed
- name: Configuring shared ibay - name: Configuring shared ibay
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled shell: /sbin/e-smith/db accounts set shared ibay AclRead "domain users@{{ ansible_local.domain.domainfull }}" AclWrite "domain users@{{ ansible_local.domain.domainfull }}" Description "Cartella condivisa" GroupAccess rw OtherAccess "" OwningGroup "domain admins@{{ ansible_local.domain.domainfull }}" SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbShareBrowseable enabled
when: chk_shared|failed when: chk_shared|failed
- name: Activating shared ibay - name: Activating shared ibay
@ -122,20 +115,20 @@
become: yes become: yes
when: chk_shared|failed when: chk_shared|failed
- name: Changing ibay profile for shared #- name: Changing ibay profile for shared
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared # shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
become: yes # become: yes
when: force_ibay_shared|bool or chk_shared|failed # when: force_ibay_shared|bool or chk_shared|failed
#
#- name: Saving new version of smb.conf
# shell: /sbin/e-smith/signal-event nethserver-samba-save
# become: yes
# when: check_tempcust|changed
- name: Saving new version of smb.conf #- name: Forcing regeneration of smb.conf
shell: /sbin/e-smith/signal-event nethserver-samba-save # shell: /sbin/e-smith/signal-event nethserver-samba-update
become: yes # become: yes
when: check_tempcust|changed # when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
- name: Forcing regeneration of smb.conf
shell: /sbin/e-smith/signal-event nethserver-samba-update
become: yes
when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
# Fixing issue #3 - Configure sudo access for admin on server for operator # Fixing issue #3 - Configure sudo access for admin on server for operator
# access # access
@ -143,7 +136,7 @@
- name: Configuring sudo access for admin account - name: Configuring sudo access for admin account
lineinfile: lineinfile:
dest: /etc/sudoers.d/admin dest: /etc/sudoers.d/admin
line: 'admin ALL=(ALL:ALL) NOPASSWD: ALL' line: 'admin@{{ ansible_local.domain.domainfull }} ALL=(ALL) NOPASSWD: ALL'
create: yes create: yes
owner: root owner: root
group: root group: root

View File

@ -10,8 +10,8 @@
- include: centos_pkgs.yml - include: centos_pkgs.yml
tags: centos tags: centos
- include: libreschool-repo.yml #- include: libreschool-repo.yml
tags: libreschool # tags: libreschool
- include: ansible.yml - include: ansible.yml
tags: tags:

View File

@ -4,4 +4,4 @@
roles: roles:
- setup - setup
- nethcfg - nethcfg
- client-install #- client-install