diff --git a/domain.yml b/domain.yml index e003af9..8b44c52 100644 --- a/domain.yml +++ b/domain.yml @@ -3,12 +3,14 @@ ntpserver: pdc.topolin.ia server: pdc serverip: 172.16.253.1 +nsdc_ipaddress: 172.16.253.2 servernetmask: 255.255.255.0 servernet: 172.16.253.0 servergw: 172.16.253.1 serverfqdn: pdc.topolin.ia domainshort: TOPOLIN domainfull: topolin.ia +sssdrealm: ad.topolin.ia dhcprange_start: 172.16.253.10 dhcprange_end: 172.16.253.50 extdnsserver1: 208.67.222.222 diff --git a/roles/nethcfg/handlers/main.yml b/roles/nethcfg/handlers/main.yml new file mode 100644 index 0000000..c9a38a6 --- /dev/null +++ b/roles/nethcfg/handlers/main.yml @@ -0,0 +1,7 @@ +--- + +- name: restart httpd-admin + service: + name: httpd-admin + state: restarted + become: yes diff --git a/roles/nethcfg/tasks/ad.yml b/roles/nethcfg/tasks/ad.yml new file mode 100644 index 0000000..73671a6 --- /dev/null +++ b/roles/nethcfg/tasks/ad.yml @@ -0,0 +1,37 @@ +--- +# Installing and configuring AD role + +- name: Verify if br0 exists already + shell: /sbin/e-smith/db networks printprop br0 role + register: br0_status + ignore_errors: yes + +- name: Creating brigde interface to host the dc + shell: /sbin/e-smith/db networks set br0 bridge gateway '' ipaddr {{ ansible_local.domain.serverip }} netmask {{ ansible_local.domain.servernetmask }} role green + when: '"role=green" not in br0_status.stdout' + +- name: Removing unneded properties from lan0 + shell: /sbin/e-smith/db networks delprop lan0 ipaddr netmask bootproto + when: '"role=green" not in br0_status.stdout' + +- name: Assigning bridge member role for lan0 + shell: /sbin/e-smith/db networks setprop lan0 bridge br0 role bridged + when: '"role=green" not in br0_status.stdout' + +- name: Activating bridge + shell: /sbin/e-smith/signal-event interface-update + when: '"role=green" not in br0_status.stdout' + +- name: Configuring sssd provider + shell: /sbin/e-smith/db configuration setprop sssd Realm {{ ansible_local.domain.sssdrealm | upper }} Workgroup {{ ansible_local.domain.domainshort }} + +- name: Configuring nsdc + shell: /sbin/e-smith/db configuration set nsdc service IpAddress {{ ansible_local.domain.nsdc_ipaddress }} ProvisionType newdomain bridge br0 status enabled + +- name: Installing needed packages + yum: + name: "@nethserver-dc" + state: present + +- name: Saving new dc status + shell: /sbin/e-smith/signal-event nethserver-dc-update diff --git a/roles/nethcfg/tasks/base.yml b/roles/nethcfg/tasks/base.yml index 0d031dd..c6a4534 100644 --- a/roles/nethcfg/tasks/base.yml +++ b/roles/nethcfg/tasks/base.yml @@ -9,27 +9,25 @@ state: present tags: nethgui -# Trusted networks: LAN +# Hostname stuff +- name: Changing effectively hostname + shell: /usr/bin/hostnamectl set-hostname {{ ansible_local.domain.serverfqdn }} --static + register: hostnamechg + when: "'{{ ansible_hostnameĀ }}' != '{{ ansible_local.domain.server }}'" -- name: Check for LAN to be added as Trusted Network - shell: /sbin/e-smith/db networks printprop {{ ansible_local.domain.servernet }} Description - register: check_trusted - changed_when: '"Description=Local LAN" not in check_trusted.stdout' - ignore_errors: yes - tags: trustednet +- name: Configuring hostname + shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }} + when: hostnamechg|changed -- name: Configuring trusted networks - shell: /sbin/e-smith/db networks set {{ ansible_local.domain.servernet }} network Description "Local LAN" Mask {{ ansible_local.domain.servernetmask }} - when: check_trusted|changed - tags: trustednet +- name: Configuring domain name + shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }} + when: hostnamechg|changed -- name: Activating trusted network - shell: /sbin/e-smith/signal-event trusted-networks-modify - when: check_trusted|changed - tags: trustednet - -# Preconfiguring DNS anyways +- name: Activating hostname/domainname changes + shell: /sbin/e-smith/signal-event hostname-modify + when: hostnamechg|changed +# DNS configuration - name: Checking DNS configuration shell: /sbin/e-smith/db configuration printprop dns NameServers register: chk_dns @@ -45,29 +43,7 @@ shell: "/sbin/e-smith/signal-event nethserver-base-update" when: chk_dns|changed -# Hostname and domainname - -- name: Configuring hostname - shell: /sbin/e-smith/db configuration set SystemName {{ ansible_local.domain.server }} - register: chg_hostname - when: "'{{ ansible_hostnameĀ }}' != '{{ ansible_local.domain.server }}'" - tags: hostname - -- name: Configuring domain name - shell: /sbin/e-smith/db configuration set DomainName {{ ansible_local.domain.domainfull }} - register: chg_domainname - when: "'{{ ansible_domain }}' != '{{ ansible_local.domain.domainfullĀ }}'" - tags: domainname - -- name: Activating hostname/domainname changes - shell: /sbin/e-smith/signal-event hostname-modify - when: chg_hostname|changed or chg_domainname|changed - tags: - - hostname - - domainname - # Base certificate - - name: Checking CA configuration shell: /sbin/e-smith/db configuration printprop pki CommonName ignore_errors: true @@ -84,3 +60,7 @@ shell: /sbin/e-smith/signal-event certificate-update when: chk_crt|changed or force_regen_ca|bool tags: regen-ca + +- name: Disabling first time wizard + shell: /sbin/e-smith/db configuration setprop httpd-admin ForcedLoginModule "" + notify: restart httpd-admin diff --git a/roles/nethcfg/tasks/dhcp.yml b/roles/nethcfg/tasks/dhcp.yml new file mode 100644 index 0000000..33614c5 --- /dev/null +++ b/roles/nethcfg/tasks/dhcp.yml @@ -0,0 +1,21 @@ +--- +# DHCP +- name: Checking DHCP configuration + shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart + ignore_errors: true + register: chk_dhcp + +- name: Configuring DHCP + shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} DhcpDNS {{ ansible_local.domain.serverip }} DhcpDomain {{ ansible_local.domain.domainfull }} DhcpGatewayIP {{ ansible_local.domain.servergw }} DhcpLeaseTime 86400 DhcpNTP {{ ansible_local.domain.serverip }} status enabled + when: chk_dhcp|failed + +- name: Activating DHCP + shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save + when: chk_dhcp|failed + +# Avahi + +- name: Installing avahi-daemon + yum: + name: nethserver-avahi + state: present diff --git a/roles/nethcfg/tasks/dhcpdns.yml b/roles/nethcfg/tasks/dhcpdns.yml deleted file mode 100644 index a63a31b..0000000 --- a/roles/nethcfg/tasks/dhcpdns.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Installing and configuring DHCP and DNS - -- name: Installing DHCP and DNS related NethServer packages. - yum: - name: nethserver-dnsmasq - state: present - -# DHCP - -- name: Checking DHCP configuration - shell: /sbin/e-smith/db dhcp getprop {{ intnic }} DhcpRangeStart - ignore_errors: true - register: chk_dhcp - -- name: Configuring DHCP - shell: /sbin/e-smith/db dhcp set {{ intnic }} range DhcpRangeStart {{ ansible_local.domain.dhcprange_start }} DhcpRangeEnd {{ ansible_local.domain.dhcprange_end }} status enabled - when: chk_dhcp|failed - -- name: Activating DHCP - shell: /sbin/e-smith/signal-event nethserver-dnsmasq-save - when: chk_dhcp|failed - -# DNS -# Already preconfigured before (roles/nethcfg/tasks/base.yml) -# reforcing the resolver addresses to the ones configured - -- name: Checking DNS configuration - shell: /sbin/e-smith/db configuration printprop dns NameServers - register: chk_dns - changed_when: "'NameServers={{ ansible_local.domain.extdnsserver1 }}' not in chk_dns.stdout" - tags: force-resolvers - -- name: Configuring DNS resolution - shell: /sbin/e-smith/db configuration setprop dns NameServers {{ ansible_local.domain.extdnsserver1 }},{{ ansible_local.domain.extdnsserver2 }} - when: chk_dns|changed - tags: force-resolvers - -- name: Activating correct DNS resolution - shell: "/sbin/e-smith/signal-event nethserver-{{ item }}-update" - with_items: - - base - - dnsmasq - when: chk_dns|changed - tags: force-resolvers - -# Avahi - -- name: Installing avahi-daemon - yum: - name: nethserver-avahi - state: present diff --git a/roles/nethcfg/tasks/main.yml b/roles/nethcfg/tasks/main.yml index e038d4e..69ad755 100644 --- a/roles/nethcfg/tasks/main.yml +++ b/roles/nethcfg/tasks/main.yml @@ -18,17 +18,16 @@ tags: - ntp -# Directory and organization -- include: directory.yml +- include: organization.yml become: yes tags: - - directory + - organization # DHCP and DNS -- include: dhcpdns.yml +- include: dhcp.yml become: yes tags: - - dhcpdns + - dhcp # Other small services - include: otherservices.yml @@ -43,6 +42,19 @@ - proxy - webfilter +# Active directory container +- include: ad.yml + become: yes + tags: + - activedirectory + - ad + +# Correcting passwordpolicy +- include: passwordpolicy.yml + become: yes + tags: + - passwordpolicy + # SAMBA and ibays - include: samba.yml become: yes diff --git a/roles/nethcfg/tasks/ntp.yml b/roles/nethcfg/tasks/ntp.yml index 2012e35..22802cf 100644 --- a/roles/nethcfg/tasks/ntp.yml +++ b/roles/nethcfg/tasks/ntp.yml @@ -1,24 +1,33 @@ --- # Network time protocol -- name: Installing NTP related packages. - yum: - name: nethserver-ntp - state: present +# Timezone +- name: Configuring timezone + shell: /sbin/e-smith/db configuration set TimeZone "Europe/Rome" + register: chg_timezone + +# Configuring same timezone also on php +- name: Configuring timezone in PHP + shell: /sbin/e-smith/db configuration setprop php DateTimezone "Europe/Rome" + register: chg_timezone_php + +- name: Activate timezone in PHP + shell: /sbin/e-smith/signal-event nethserver-php-update + when: chg_timezone_php|changed - name: Checking for NTP Configuration - shell: /sbin/e-smith/db configuration printprop ntpd NTPServer + shell: /sbin/e-smith/db configuration printprop chronyd NTPServer become: yes register: chk_ntp changed_when: "'NTPServer=ntp1.inrim.it' not in chk_ntp.stdout" ignore_errors: true - name: Configuring NTP - shell: /sbin/e-smith/db configuration setprop ntpd NTPServer ntp1.inrim.it status enabled + shell: /sbin/e-smith/db configuration setprop chronyd NTPServer ntp1.inrim.it status enabled become: yes when: chk_ntp|changed - name: Activating NTP - shell: /sbin/e-smith/signal-event nethserver-ntp-update + shell: /sbin/e-smith/signal-event nethserver-ntp-save become: yes when: chk_ntp|changed diff --git a/roles/nethcfg/tasks/directory.yml b/roles/nethcfg/tasks/organization.yml similarity index 51% rename from roles/nethcfg/tasks/directory.yml rename to roles/nethcfg/tasks/organization.yml index 910cde0..4396e7a 100644 --- a/roles/nethcfg/tasks/directory.yml +++ b/roles/nethcfg/tasks/organization.yml @@ -1,38 +1,12 @@ --- # Organization -- name: Installing required packages - yum: - pkg: nethserver-directory - state: present - - name: Check organization configuration shell: /sbin/e-smith/db configuration printprop OrganizationContact City register: check_org changed_when: "'City={{ ansible_local.domain.org_city }}' not in check_org.stdout" ignore_errors: yes -# Password policy - -- name: Check for password policy - shell: /sbin/e-smith/db configuration printprop passwordstrength Users - register: chk_passstr - changed_when: "'Users=none' not in chk_passstr.stdout" - ignore_errors: true - tags: password-policy - -- name: Configuring password policy - shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 - when: chk_passstr|changed - tags: password-policy - -- name: Activating password policy - shell: /sbin/e-smith/signal-event password-policy-update - when: chk_passstr|changed - tags: password-policy - -# Organization configuration - - name: Configuring organization shell: /sbin/e-smith/db configuration setprop OrganizationContact City "{{ ansible_local.domain.org_city }}" Company "{{ ansible_local.domain.org_company }}" CountryCode {{ ansible_local.domain.org_countrycode }} Department "{{ ansible_local.domain.org_department }}" PhoneNumber "{{ ansible_local.domain.org_phone }}" Street "{{ ansible_local.domain.org_street }}" when: check_org|changed diff --git a/roles/nethcfg/tasks/otherservices.yml b/roles/nethcfg/tasks/otherservices.yml index 72e736c..3cf53a0 100644 --- a/roles/nethcfg/tasks/otherservices.yml +++ b/roles/nethcfg/tasks/otherservices.yml @@ -3,13 +3,10 @@ - name: Installing other small services yum: - name: "{{ item }}" + name: + - nethserver-cups + - nethserver-collectd + - nethserver-firewall-base-ui + - nethserver-backup-config + - nethserver-backup-data state: present - with_items: - - nethserver-cups - - nethserver-collectd - - nethserver-collectd-web - - nethserver-firewall-base - - nethserver-firewall-base-ui - - nethserver-backup-config - - nethserver-backup-data diff --git a/roles/nethcfg/tasks/passwordpolicy.yml b/roles/nethcfg/tasks/passwordpolicy.yml new file mode 100644 index 0000000..ba773cb --- /dev/null +++ b/roles/nethcfg/tasks/passwordpolicy.yml @@ -0,0 +1,20 @@ +--- +# Password policy + +- name: Check for password policy + shell: /sbin/e-smith/db configuration printprop passwordstrength Users + register: chk_passstr + changed_when: "'Users=none' not in chk_passstr.stdout" + ignore_errors: true + tags: password-policy + +- name: Configuring password policy + shell: /sbin/e-smith/db configuration setprop passwordstrength PassExpires no Users none Admin strong MaxPassAge 180 MinPassAge 0 PassExpires no PassWarning 7 + when: chk_passstr|changed + tags: password-policy + +- name: Activating password policy + shell: /sbin/e-smith/signal-event password-policy-update + when: chk_passstr|changed + tags: password-policy + diff --git a/roles/nethcfg/tasks/proxy.yml b/roles/nethcfg/tasks/proxy.yml index e90fd22..890748b 100644 --- a/roles/nethcfg/tasks/proxy.yml +++ b/roles/nethcfg/tasks/proxy.yml @@ -1,14 +1,12 @@ --- # Proxy and webfiltering configurations - - name: Installing proxy-related packages yum: - name: "{{ item }}" + name: + - nethserver-squid + - nethserver-squidclamav + - nethserver-squidguard state: present - with_items: - - nethserver-squid - - nethserver-squidclamav - - nethserver-squidguard # Squid @@ -23,45 +21,53 @@ when: chk_squid|changed - name: Activating Squid configuration - shell: /sbin/e-smith/signal-event nethserver-squid-update + shell: /sbin/e-smith/signal-event nethserver-squid-save when: chk_squid|changed -# Squid-clamav - -- name: Checking squidclamav configuration - shell: /sbin/e-smith/db configuration printprop squidclamav status - ignore_errors: true - register: chk_squidclamav - changed_when: "'status=enabled' not in chk_squidclamav.stdout" - -- name: Configuring squidclamav - shell: /sbin/e-smith/db configuration setprop squidclamav status enabled - when: chk_squidclamav|changed - -- name: Activating squidclamav - shell: /sbin/e-smith/signal-event nethserver-squidclamav-update - when: chk_squidclamav|changed - # SquidGuard - - name: Verifying squidguard configuration shell: /sbin/e-smith/db configuration printprop squidguard status register: check_squidguard ignore_errors: true changed_when: '"status=enabled" not in check_squidguard.stdout' +- name: Checking ufdb configuration + shell: /sbin/e-smith/db configuration printprop ufdb status + ignore_errors: true + register: chk_ufdb + changed_when: "'status=enabled' not in check_squidguard.stdout" + +- name: Configuring ufdb + shell: /sbin/e-smith/db configuration setprop ufdb status enabled + when: check_squidguard|changed + - name: Configuring squidguard - shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla status enabled + shell: /sbin/e-smith/db configuration setprop squidguard Expressions enabled Lists shalla when: check_squidguard|changed - name: Activating squidguard configuration shell: "/sbin/e-smith/signal-event nethserver-squidguard-{{ item }}" with_items: - save - - update - downloadlists when: check_squidguard|changed +# Squid-clamav + +- name: Checking squidclamav configuration + shell: /sbin/e-smith/db configuration printprop clamd@squidclamav status + ignore_errors: true + register: chk_squidclamav + changed_when: "'status=enabled' not in chk_squidclamav.stdout" + +- name: Configuring squidclamav + shell: /sbin/e-smith/db configuration setprop clamd@squidclamav status enabled + when: chk_squidclamav|changed + +- name: Activating squidclamav + shell: /sbin/e-smith/signal-event nethserver-squidclamav-update + when: chk_squidclamav|changed + # Content filtering settings - name: Verifying content filtering @@ -70,10 +76,10 @@ changed_when: "'sex' not in check_cf.stdout" - name: Configuring content filtering - shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez + shell: /sbin/e-smith/db contentfilter setprop default Categories aggressive,alcohol,weapons,games-online,gamble,dating,webradio,webtv,sex,porn,spyware,violence,anonvpn,warez BlackList enabled BlockAll disabled BlockBuiltinRules disabled BlockFileTypes disabled BlockIpAccess enabled register: cf_cat when: check_cf|changed - name: Activating content filtering as a whole - shell: /sbin/e-smith/signal-event nethserver-squidguard-update + shell: /sbin/e-smith/signal-event nethserver-squidguard-save when: check_cf|changed diff --git a/roles/setup/tasks/ansible.yml b/roles/setup/tasks/ansible.yml index a8abcc4..394fc49 100644 --- a/roles/setup/tasks/ansible.yml +++ b/roles/setup/tasks/ansible.yml @@ -10,32 +10,16 @@ become: yes tags: ansible -- name: Checking for python-argparse - shell: rpm -q python-argparse - become: yes - register: check_argparse - ignore_errors: yes - changed_when: "check_argparse.rc == 1" - tags: ansible - -- name: Installazione python-argparse - yum: - name: python-argparse - state: present - become: yes - when: check_argparse|changed - tags: ansible - - #- name: Download della gestione client con ansible - # git: - # repo: "https://github.com/bglug-it/ps-clientmgmt.git" - # dest: /home/amgmt/clientmgmt - # tags: - # - git - # - ansible - # - #- name: Attivo sotto modulo ansdyninv - # shell: cd /home/amgmt/clientmgmt/ansdyninv; git submodule init && git submodule update - # tags: - # - git - # - ansible +#- name: Download della gestione client con ansible +# git: +# repo: "https://github.com/bglug-it/ps-clientmgmt.git" +# dest: /home/amgmt/clientmgmt +# tags: +# - git +# - ansible +# +#- name: Attivo sotto modulo ansdyninv +# shell: cd /home/amgmt/clientmgmt/ansdyninv; git submodule init && git submodule update +# tags: +# - git +# - ansible diff --git a/roles/setup/tasks/centos_pkgs.yml b/roles/setup/tasks/centos_pkgs.yml index 37028e4..a4db7b7 100644 --- a/roles/setup/tasks/centos_pkgs.yml +++ b/roles/setup/tasks/centos_pkgs.yml @@ -1,39 +1,5 @@ --- -- name: Verifica abilitazione repo Extra - shell: yum repolist - register: check_epel - failed_when: "'Extra Packages for Enterprise Linux 6' not in check_epel.stdout" - ignore_errors: yes - -- name: Installo epel-release - yum: name=epel-release state=present - become: yes - when: check_epel|failed - register: epel_installed - ignore_errors: yes - -- name: Installo epel-release da URL - yum: - name: "http://dl.fedoraproject.org/pub/epel/6/{{ ansible_architecture }}/epel-release-6-8.noarch.rpm" - state: present - become: yes - when: epel_installed|failed - register: rpm_epel_installed - -- name: Abilito il repo EPEL - shell: yum-config-manager --enable epel - become: yes - when: epel_installed|changed or epel_installed|success or rpm_epel_installed|changed - changed_when: "'[epel]' in epel_enabled.stdout and epel_enabled.rc == 0" - register: epel_enabled - -- name: Pulizia e ricaricam. repo - shell: yum clean all && yum repolist - become: yes - when: epel_enabled|changed - tags: repo - - name: Aggiorno il sistema yum: name=* state=latest become: yes diff --git a/roles/setup/tasks/libreschool-repo.yml b/roles/setup/tasks/libreschool-repo.yml new file mode 100644 index 0000000..c33878b --- /dev/null +++ b/roles/setup/tasks/libreschool-repo.yml @@ -0,0 +1,7 @@ +--- +# We should install here the LibreSchool repos. + +- name: Install LibreSchool package repo + yum: + url: "https://repo.libreschool.org/nethserver/7/base/x86_64/Packages/libreschool-release-1.0-1.noarch.rpm" + state: present diff --git a/roles/setup/tasks/main.yml b/roles/setup/tasks/main.yml index 166e76e..c6e6fc4 100644 --- a/roles/setup/tasks/main.yml +++ b/roles/setup/tasks/main.yml @@ -8,14 +8,12 @@ tags: lock-nethrelease - include: centos_pkgs.yml - when: ansible_distribution == "CentOS" and ansible_os_family == "RedHat" tags: centos -- include: pvtrepo.yml - tags: bglug +- include: libreschool-repo.yml + tags: libreschool - include: ansible.yml - when: ansible_distribution == "CentOS" tags: - git - ansible diff --git a/roles/setup/tasks/pvtrepo.yml b/roles/setup/tasks/pvtrepo.yml deleted file mode 100644 index 8b3308a..0000000 --- a/roles/setup/tasks/pvtrepo.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -- name: Installazione istruzioni per repo.bglug.it - copy: - src: bglug.repo - dest: /etc/yum.repos.d/bglug.repo - become: yes - -- name: Ricalcolo repository disponibili - shell: yum repolist - become: yes