forked from LibreSchool/server-config
WIP. Reviewed nethcfg role and disabled libreschool repository. Disabled other role for security.
This commit is contained in:
parent
a84be475bc
commit
93a68f626d
@ -1,32 +1,13 @@
|
||||
---
|
||||
# Domain groups
|
||||
|
||||
# Domain Users
|
||||
|
||||
- name: domusers - Checking for group
|
||||
shell: /sbin/e-smith/db accounts show domusers
|
||||
register: check_domusers
|
||||
ignore_errors: true
|
||||
|
||||
- name: domusers - Creating new group
|
||||
shell: /sbin/e-smith/db accounts set domusers group Description "Domain Users" Members admin Removable no
|
||||
when: check_domusers|failed
|
||||
|
||||
- name: domusers - Activating group
|
||||
shell: /sbin/e-smith/signal-event group-create domusers
|
||||
when: check_domusers|failed
|
||||
|
||||
# Domain Operators
|
||||
|
||||
- name: domopers - Checking for group
|
||||
shell: /sbin/e-smith/db accounts show domopers
|
||||
shell: /bin/getent group domopers
|
||||
register: check_domopers
|
||||
ignore_errors: true
|
||||
|
||||
- name: domopers - Creating new group
|
||||
shell: /sbin/e-smith/db accounts set domopers group Description "Domain Operators" Removable no
|
||||
when: check_domopers|failed
|
||||
|
||||
- name: domopers - Activating group
|
||||
shell: /sbin/e-smith/signal-event group-create domopers
|
||||
when: check_domopers|failed
|
||||
@ -34,14 +15,10 @@
|
||||
# Docenti
|
||||
|
||||
- name: docenti - Checking for group
|
||||
shell: /sbin/e-smith/db accounts show docenti
|
||||
shell: /bin/getent group docenti
|
||||
register: check_docenti
|
||||
ignore_errors: true
|
||||
|
||||
- name: docenti - Creating new group
|
||||
shell: /sbin/e-smith/db accounts set docenti group Description "Docenti" Removable no
|
||||
when: check_docenti|failed
|
||||
|
||||
- name: docenti - Activating group
|
||||
shell: /sbin/e-smith/signal-event group-create docenti
|
||||
when: check_docenti|failed
|
||||
|
@ -9,7 +9,7 @@
|
||||
tags: password-policy
|
||||
|
||||
- name: Configuring password policy
|
||||
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7
|
||||
shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none MaxPassAge 180 MinPassAge 0 PassWarning 7
|
||||
when: chk_passstr|changed
|
||||
tags: password-policy
|
||||
|
||||
@ -17,4 +17,3 @@
|
||||
shell: /sbin/e-smith/signal-event password-policy-update
|
||||
when: chk_passstr|changed
|
||||
tags: password-policy
|
||||
|
||||
|
@ -4,21 +4,13 @@
|
||||
|
||||
- name: Installing SAMBA and ibays packages
|
||||
yum:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items:
|
||||
- nethserver-ibays
|
||||
- nethserver-samba
|
||||
name:
|
||||
- "@nethserver-file-server"
|
||||
- nethserver-samba-audit
|
||||
state: present
|
||||
|
||||
# SAMBA
|
||||
|
||||
- name: "Verifying modifications on templates-custom."
|
||||
shell: grep -q 'server signing = mandatory' /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||
register: check_tempcust
|
||||
changed_when: check_tempcust.rc != 0
|
||||
ignore_errors: true
|
||||
|
||||
- name: "Create directory structure for templates-custom"
|
||||
file:
|
||||
path: "/etc/e-smith/templates-custom/etc/samba/smb.conf"
|
||||
@ -39,82 +31,83 @@
|
||||
when: check_tempcust|changed
|
||||
|
||||
- name: "Enabling unix extensions on SAMBA"
|
||||
replace:
|
||||
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||
regexp: '^unix extensions = no$'
|
||||
replace: 'unix extensions = yes'
|
||||
when: check_tempcust|changed
|
||||
|
||||
- name: Adding server signing as mandatory
|
||||
lineinfile:
|
||||
dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||
line: "server signing = mandatory"
|
||||
insertafter: "^workgroup = "
|
||||
line: 'unix extensions = yes'
|
||||
state: present
|
||||
insertafter: EOF
|
||||
when: check_tempcust|changed
|
||||
|
||||
- name: Checking SMB configuration
|
||||
shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
|
||||
register: chk_smb
|
||||
changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
|
||||
ignore_errors: true
|
||||
#- name: Adding server signing as mandatory
|
||||
# lineinfile:
|
||||
# dest: /etc/e-smith/templates-custom/etc/samba/smb.conf/10global
|
||||
# line: "server signing = mandatory"
|
||||
# insertafter: "^workgroup = "
|
||||
# state: present
|
||||
# when: check_tempcust|changed
|
||||
|
||||
- name: Configuring SMB
|
||||
shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
|
||||
when: chk_smb|changed
|
||||
#- name: Checking SMB configuration
|
||||
# shell: /sbin/e-smith/db configuration printprop smb RoamingProfiles
|
||||
# register: chk_smb
|
||||
# changed_when: "'RoamingProfiles=yes' not in chk_smb.stdout"
|
||||
# ignore_errors: true
|
||||
|
||||
- name: Activating SMB
|
||||
shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||
when: chk_smb|changed
|
||||
#- name: Configuring SMB
|
||||
# shell: /sbin/e-smith/db configuration setprop smb RoamingProfiles yes ServerRole PDC Workgroup "{{ ansible_local.domain.domainshort }}" status enabled
|
||||
# when: chk_smb|changed
|
||||
#
|
||||
#- name: Activating SMB
|
||||
# shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||
# when: chk_smb|changed
|
||||
|
||||
# ibays
|
||||
|
||||
- name: Enabling SMB services restart when managing ibays
|
||||
file:
|
||||
src: reload
|
||||
dest: "{{ item }}/smb"
|
||||
state: link
|
||||
force: yes
|
||||
with_items:
|
||||
- /etc/e-smith/events/ibay-delete/services2adjust
|
||||
- /etc/e-smith/events/ibay-create/services2adjust
|
||||
- /etc/e-smith/events/ibay-modify/services2adjust
|
||||
#- name: Enabling SMB services restart when managing ibays
|
||||
# file:
|
||||
# src: reload
|
||||
# dest: "{{ item }}/smb"
|
||||
# state: link
|
||||
# force: yes
|
||||
# with_items:
|
||||
# - /etc/e-smith/events/ibay-delete/services2adjust
|
||||
# - /etc/e-smith/events/ibay-create/services2adjust
|
||||
# - /etc/e-smith/events/ibay-modify/services2adjust
|
||||
|
||||
- name: Checking for shared ibay
|
||||
shell: /sbin/e-smith/db accounts show shared
|
||||
ignore_errors: true
|
||||
register: chk_shared
|
||||
|
||||
- name: Copying default templates for shared template type
|
||||
shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
|
||||
when: force_ibay_shared|bool or chk_shared|failed
|
||||
|
||||
- name: Configuring ibay-shared template structure (directory mask)
|
||||
lineinfile:
|
||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
line: 'directory mask = 0775'
|
||||
insertafter: '^create mask'
|
||||
state: present
|
||||
when: force_ibay_shared|bool or chk_shared|failed
|
||||
|
||||
- name: Configuring force create mode
|
||||
lineinfile:
|
||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
line: 'force create mode = 0664'
|
||||
insertafter: '^directory mask'
|
||||
state: present
|
||||
when: force_ibay_shared|bool or chk_shared|failed
|
||||
|
||||
- name: Configuring force directory mode
|
||||
lineinfile:
|
||||
dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
line: 'force directory mode = 0775'
|
||||
insertafter: '^force create mode'
|
||||
state: present
|
||||
when: force_ibay_shared|bool or chk_shared|failed
|
||||
#- name: Copying default templates for shared template type
|
||||
# shell: cp -r /etc/e-smith/templates/etc/samba/smb.conf/ibay-default /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared
|
||||
# when: force_ibay_shared|bool or chk_shared|failed
|
||||
#
|
||||
#- name: Configuring ibay-shared template structure (directory mask)
|
||||
# lineinfile:
|
||||
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
# line: 'directory mask = 0775'
|
||||
# insertafter: '^create mask'
|
||||
# state: present
|
||||
# when: force_ibay_shared|bool or chk_shared|failed
|
||||
#
|
||||
#- name: Configuring force create mode
|
||||
# lineinfile:
|
||||
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
# line: 'force create mode = 0664'
|
||||
# insertafter: '^directory mask'
|
||||
# state: present
|
||||
# when: force_ibay_shared|bool or chk_shared|failed
|
||||
#
|
||||
#- name: Configuring force directory mode
|
||||
# lineinfile:
|
||||
# dest: /etc/e-smith/templates/etc/samba/smb.conf/ibay-shared/20profile_default
|
||||
# line: 'force directory mode = 0775'
|
||||
# insertafter: '^force create mode'
|
||||
# state: present
|
||||
# when: force_ibay_shared|bool or chk_shared|failed
|
||||
|
||||
- name: Configuring shared ibay
|
||||
shell: /sbin/e-smith/db accounts set shared ibay AclRead domusers,domadmins AclWrite domusers,domadmins Description "Cartella condivisa" GroupAccess rw HttpStatus disabled OtherAccess r OwningGroup locals SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbStatus enabled
|
||||
shell: /sbin/e-smith/db accounts set shared ibay AclRead "domain users@{{ ansible_local.domain.domainfull }}" AclWrite "domain users@{{ ansible_local.domain.domainfull }}" Description "Cartella condivisa" GroupAccess rw OtherAccess "" OwningGroup "domain admins@{{ ansible_local.domain.domainfull }}" SmbAuditStatus enabled SmbGuestAccessType none SmbRecycleBinStatus enabled SmbRecycleBinVersionsStatus enabled SmbShareBrowseable enabled
|
||||
when: chk_shared|failed
|
||||
|
||||
- name: Activating shared ibay
|
||||
@ -122,20 +115,20 @@
|
||||
become: yes
|
||||
when: chk_shared|failed
|
||||
|
||||
- name: Changing ibay profile for shared
|
||||
shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
|
||||
become: yes
|
||||
when: force_ibay_shared|bool or chk_shared|failed
|
||||
#- name: Changing ibay profile for shared
|
||||
# shell: /sbin/e-smith/db accounts setprop shared SmbProfileType shared
|
||||
# become: yes
|
||||
# when: force_ibay_shared|bool or chk_shared|failed
|
||||
#
|
||||
#- name: Saving new version of smb.conf
|
||||
# shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||
# become: yes
|
||||
# when: check_tempcust|changed
|
||||
|
||||
- name: Saving new version of smb.conf
|
||||
shell: /sbin/e-smith/signal-event nethserver-samba-save
|
||||
become: yes
|
||||
when: check_tempcust|changed
|
||||
|
||||
- name: Forcing regeneration of smb.conf
|
||||
shell: /sbin/e-smith/signal-event nethserver-samba-update
|
||||
become: yes
|
||||
when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
|
||||
#- name: Forcing regeneration of smb.conf
|
||||
# shell: /sbin/e-smith/signal-event nethserver-samba-update
|
||||
# become: yes
|
||||
# when: force_ibay_shared|bool or chk_shared|failed or check_tempcust|changed
|
||||
|
||||
# Fixing issue #3 - Configure sudo access for admin on server for operator
|
||||
# access
|
||||
@ -143,7 +136,7 @@
|
||||
- name: Configuring sudo access for admin account
|
||||
lineinfile:
|
||||
dest: /etc/sudoers.d/admin
|
||||
line: 'admin ALL=(ALL:ALL) NOPASSWD: ALL'
|
||||
line: 'admin@{{ ansible_local.domain.domainfull }} ALL=(ALL) NOPASSWD: ALL'
|
||||
create: yes
|
||||
owner: root
|
||||
group: root
|
||||
|
@ -10,8 +10,8 @@
|
||||
- include: centos_pkgs.yml
|
||||
tags: centos
|
||||
|
||||
- include: libreschool-repo.yml
|
||||
tags: libreschool
|
||||
#- include: libreschool-repo.yml
|
||||
# tags: libreschool
|
||||
|
||||
- include: ansible.yml
|
||||
tags:
|
||||
|
Loading…
x
Reference in New Issue
Block a user