ansible/ansible_collection_users
1
0
Fork 0
mirror of https://github.com/roles-ansible/ansible_collection_users.git synced 2024-08-16 10:29:50 +02:00
Code Releases Activity

update docs and adding password option for user ansible

Browse source
This commit is contained in:
L3D 2024-02-16 18:00:07 +01:00
parent bc0205df49
commit 3456ee756e
Signed by: l3d
GPG key ID: CD08445BFF4313D1
13 changed files with 90 additions and 75 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -2,3 +2,5 @@
Ansible Collection to mamage Users, Groups and SSH Keys Ansible Collection to mamage Users, Groups and SSH Keys
Work in progress! Work in progress!
Requirements: See requirements.yml

8
requirements.yml Normal file
View file

@ -0,0 +1,8 @@
---
collections:
- name: "community.general"
version: ">=8.3.0"
- name: "ansible.posix"
version: ">=1.5.4"
- name: "community.crypto"
version: ">=2.17.1"

52
roles/admin/README.md
View file

@ -16,19 +16,20 @@ There are two variables to define users. The ``l3d_users__default_users`` is men
+ The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``. + The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``.
The Option of these directory-variables are the following. The Option of these directory-variables are the following.
| option | values | description | | option | values | required | description |
| ------ | ------ | --- | | ------ | ------ | --- | --- |
| name | string | The user you want to create | | ``name`` | *string* | ``required`` | The user you want to create |
| state | ``present`` | Create or delete user | | ``state`` | ``present`` | - | Create or delete user |
| shell | ``/bin/bash`` | The Shell of the User | | ``shell`` | ``/bin/bash`` | - | The Shell of the User |
| create_home | ``true`` | create a user home *(needed to store ssh keys)* | | ``create_home`` | ``true`` | - | create a user home *(needed to store ssh keys)* |
| admin | ``false`` | enable it to give the user superpowers | | ``admin | ``false`` | - | enable it to give the user superpowers |
| admin_commands | string or list | Commands that are allows to be run as admin, eg. 'ALL' or specific script | | ``admin_commands`` | *string or list* | - | Commands that are allows to be run as admin, eg. 'ALL' or specific script |
| admin_nopassword | false | Need no Password for sudo | | ``admin_nopassword`` | ``false`` | - | Need no Password for sudo |
| pubkeys | string or lookup | see examples | | ``admin_ansible_login`` | ``true`` | - |if ``admin: true`` and ``l3d_users__create_ansible: true`` your ssh keys will be added to ansible user |
| exklusive_pubkeys | ``true`` | delete all undefined ssh keys | | ``pubkeys`` | string or lookup | - | see examples |
| password | password hash | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) | | ``exklusive_pubkeys`` | ``true`` | - | delete all undefined ssh keys |
| remove | ``false`` | completly remove user if state is absent | | ``password`` | password hash | - | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) |
| ``remove`` | ``false`` | - | completly remove user if ``state: absent`` |
### Other ### Other
@ -36,35 +37,34 @@ The Option of these directory-variables are the following.
| --- | --- | --- | | --- | --- | --- |
| ``l3d_users__create_ansible`` | ``true`` | Create an Ansible User | | ``l3d_users__create_ansible`` | ``true`` | Create an Ansible User |
| ``l3d_users__ansible_user_state`` | ``present`` | Ansible user state | | ``l3d_users__ansible_user_state`` | ``present`` | Ansible user state |
| ``l3d_users__ansible_user_command`` | ``ALL`` | Commans with superpower for ansible user |
| ``l3d_users__ansible_user_nopassword`` | ``true`` | Allow superpowers without password for ansible user |
| ``submodules_versioncheck`` | ``false`` | Optionaly enable simple versionscheck of this role | | ``submodules_versioncheck`` | ``false`` | Optionaly enable simple versionscheck of this role |
Example Playbook Example Playbook
----------------- -----------------
```yaml ```yaml
- name: Create System with User and Passwords - name: Create superpowers for admins
hosts: example.com hosts: example.com
roles: roles:
- {role: l3d.users.user, tags: 'user'} - {role: l3d.users.admin, tags: 'admin'}
vars: vars:
l3d_users__local_users: l3d_users__local_users:
- name: 'alice' - name: 'alice'
state: 'present' state: 'present'
shell: '/bin/bash'
create_home: true
admin: true admin: true
admin_commands: 'ALL' admin_commands: 'ALL'
pubkeys: | admin_nopassword: false
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvvXN33GwkTF4ZOwPgF21Un4R2z9hWUuQt1qIfzQyhC pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}"
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAG65EdcM+JLv0gnzT9LcqVU47Pkw0SqiIg7XipXENi8
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJz7zEvUVgJJJsIgfG3izsqYcM22IaKz4jGVUbNRL2PX
exklusive_pubkeys: true
- name: 'bob' - name: 'bob'
state: 'present' state: 'present'
admin: false admin: false
pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}" - name: 'backup'
state: 'present'
admin: true
admin_commands: '/opt/backupscript.sh'
admin_nopassword: true
admin_ansible_login: false
l3d_users__create_ansible: true l3d_users__create_ansible: true
l3d_users__set_ansible_ssh_keys: true
l3d_users__ansible_ssh_keys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}"
submodules_versioncheck: true submodules_versioncheck: true
``` ```

7
roles/admin/defaults/main.yml
View file

@ -1,6 +1,6 @@
--- ---
# create users # create users
l3d_users__default_users: {} l3d_users__default_users: []
# - name: 'alice' # - name: 'alice'
# state: 'present' # state: 'present'
# shell: '/bin/bash' # shell: '/bin/bash'
@ -14,6 +14,7 @@ l3d_users__default_users: {}
# admin: true # admin: true
# admin_commands: 'ALL' # admin_commands: 'ALL'
# admin_nopassword: false # admin_nopassword: false
# admin_ansible_login: true
# - name: 'bob' # - name: 'bob'
# state: 'present' # state: 'present'
# shell: '/bin/zsh' # shell: '/bin/zsh'
@ -21,7 +22,7 @@ l3d_users__default_users: {}
# pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}" # pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}"
# exklusive_pubkeys: false # exklusive_pubkeys: false
l3d_users__local_users: {} l3d_users__local_users: []
# - name: 'charlie' # - name: 'charlie'
# state: 'present' # state: 'present'
# admin: false # admin: false
@ -29,6 +30,8 @@ l3d_users__local_users: {}
l3d_users__create_ansible: true l3d_users__create_ansible: true
l3d_users__ansible_user_state: 'present' l3d_users__ansible_user_state: 'present'
l3d_users__ansible_user_command: 'ALL'
l3d_users__ansible_user_nopassword: true
# run simple versionscheck # run simple versionscheck
submodules_versioncheck: false submodules_versioncheck: false

4
roles/admin/tasks/user_ansible.yml
View file

@ -3,8 +3,8 @@
become: true become: true
community.general.sudoers: community.general.sudoers:
name: 'ansible_superpowers' name: 'ansible_superpowers'
commands: 'ALL' commands: "{{ l3d_users__ansible_user_command }}"
nopassword: true nopassword: "{{ l3d_users__ansible_user_nopassword | bool }}"
user: 'ansible' user: 'ansible'
state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}" state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}"
validation: 'required' validation: 'required'

2
roles/admin/vars/main.yml
View file

@ -1,3 +1,3 @@
--- ---
playbook_version_number: 4 playbook_version_number: 5
playbook_version_path: 'l3d.users.admin.version' playbook_version_path: 'l3d.users.admin.version'

35
roles/sshd/README.md
View file

@ -3,8 +3,6 @@
Ansible role l3d.users.sshd to Manage SSHD Configuration of the system and which Accounts are allowed to login. Ansible role l3d.users.sshd to Manage SSHD Configuration of the system and which Accounts are allowed to login.
# WORK IN PROGRESS
There are two variables to define users. The ``l3d_users__default_users`` is ment to put to your group_vars to define a default for your system. The ``l3d_users__local_users`` could be put in your host_vars to define host-specific user and admin roles. There are two variables to define users. The ``l3d_users__default_users`` is ment to put to your group_vars to define a default for your system. The ``l3d_users__local_users`` could be put in your host_vars to define host-specific user and admin roles.
Variables: Variables:
@ -16,19 +14,20 @@ There are two variables to define users. The ``l3d_users__default_users`` is men
+ The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``. + The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``.
The Option of these directory-variables are the following. The Option of these directory-variables are the following.
| option | values | description | | option | values | required | description |
| ------ | ------ | --- | | ------ | ------ | --- | --- |
| name | string | The user you want to create | | ``name`` | *string* | ``required`` | The user you want to create |
| state | ``present`` | Create or delete user | | ``state`` | ``present`` | - | Create or delete user |
| shell | ``/bin/bash`` | The Shell of the User | | ``shell`` | ``/bin/bash`` | - | The Shell of the User |
| create_home | ``true`` | create a user home *(needed to store ssh keys)* | | ``create_home`` | ``true`` | - | create a user home *(needed to store ssh keys)* |
| admin | ``false`` | enable it to give the user superpowers | | ``admin | ``false`` | - | enable it to give the user superpowers |
| admin_commands | string or list | Commands that are allows to be run as admin, eg. 'ALL' or specific script | | ``admin_commands`` | *string or list* | - | Commands that are allows to be run as admin, eg. 'ALL' or specific script |
| admin_nopassword | false | Need no Password for sudo | | ``admin_nopassword`` | ``false`` | - | Need no Password for sudo |
| pubkeys | string or lookup | see examples | | ``admin_ansible_login`` | ``true`` | - |if ``admin: true`` and ``l3d_users__create_ansible: true`` your ssh keys will be added to ansible user |
| exklusive_pubkeys | ``true`` | delete all undefined ssh keys | | ``pubkeys`` | string or lookup | - | see examples |
| password | password hash | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) | | ``exklusive_pubkeys`` | ``true`` | - | delete all undefined ssh keys |
| remove | ``false`` | completly remove user if state is absent | | ``password`` | password hash | - | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) |
| ``remove`` | ``false`` | - | completly remove user if ``state: absent`` |
There is a third directory-variable called ``l3d_users__ssh_login: []`` which only support ``name`` and ``state`` for users, that sould be able to login on that system. There is a third directory-variable called ``l3d_users__ssh_login: []`` which only support ``name`` and ``state`` for users, that sould be able to login on that system.
@ -36,7 +35,6 @@ There is a third directory-variable called ``l3d_users__ssh_login: []`` which on
| name | default value | description | | name | default value | description |
| --- | --- | --- | | --- | --- | --- |
| ``submodules_versioncheck`` | ``false`` | Optionaly enable simple versionscheck of this role |
| ``l3d_users__limit_login`` | ``true`` | Only allow SSH login for specified users | | ``l3d_users__limit_login`` | ``true`` | Only allow SSH login for specified users |
| ``l3d_users__sshd_port`` | ``22`` | Port for SSH | | ``l3d_users__sshd_port`` | ``22`` | Port for SSH |
| ``l3d_users__sshd_password_authentication`` | ``false`` | Allow login with Password | | ``l3d_users__sshd_password_authentication`` | ``false`` | Allow login with Password |
@ -54,10 +52,7 @@ There is a third directory-variable called ``l3d_users__ssh_login: []`` which on
| ``l3d_users__sshd_manage_macs`` | ``true`` | Manage Used MACs | | ``l3d_users__sshd_manage_macs`` | ``true`` | Manage Used MACs |
| ``l3d_users__sshd_macs`` | ``['hmac-sha2-512-etm@openssh.com', 'hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512']`` | Used MACs | | ``l3d_users__sshd_macs`` | ``['hmac-sha2-512-etm@openssh.com', 'hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512']`` | Used MACs |
| ``l3d_users__sshd_xforwarding`` |``true`` | Enable X-Forwarding | | ``l3d_users__sshd_xforwarding`` |``true`` | Enable X-Forwarding |
| ``submodules_versioncheck`` | ``false`` | Optionaly enable simple versionscheck of this role |
# run simple versionscheck
submodules_versioncheck: false
Example Playbook Example Playbook
----------------- -----------------

1
roles/sshd/defaults/main.yml
View file

@ -14,6 +14,7 @@ l3d_users__default_users: []
# admin: true # admin: true
# admin_commands: 'ALL' # admin_commands: 'ALL'
# admin_nopassword: false # admin_nopassword: false
# admin_ansible_login: true
# - name: 'bob' # - name: 'bob'
# state: 'present' # state: 'present'
# shell: '/bin/zsh' # shell: '/bin/zsh'

2
roles/sshd/vars/main.yml
View file

@ -1,5 +1,5 @@
--- ---
playbook_version_number: 2 playbook_version_number: 3
playbook_version_path: 'l3d.users.sshd.version' playbook_version_path: 'l3d.users.sshd.version'
l3d_users_sshd__service_var_path: l3d_users_sshd__service_var_path:

40
roles/user/README.md
View file

@ -15,29 +15,31 @@ There are two variables to define users. The ``l3d_users__default_users`` is men
+ The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``. + The dictionary-variable for your host_vars to set your host-specific users and admins is: ``l3d_users__local_users``.
The Option of these directory-variables are the following. The Option of these directory-variables are the following.
| option | values | description | | option | values | required | description |
| ------ | ------ | --- | | ------ | ------ | --- | --- |
| name | string | The user you want to create | | ``name`` | *string* | ``required`` | The user you want to create |
| state | ``present`` | Create or delete user | | ``state`` | ``present`` | - | Create or delete user |
| shell | ``/bin/bash`` | The Shell of the User | | ``shell`` | ``/bin/bash`` | - | The Shell of the User |
| create_home | ``true`` | create a user home *(needed to store ssh keys)* | | ``create_home`` | ``true`` | - | create a user home *(needed to store ssh keys)* |
| admin | ``false`` | enable it to give the user superpowers | | ``admin | ``false`` | - | enable it to give the user superpowers |
| admin_commands | string or list | Commands that are allows to be run as admin, eg. 'ALL' or specific script | | ``admin_commands`` | *string or list* | - | Commands that are allows to be run as admin, eg. 'ALL' or specific script |
| admin_nopassword | false | Need no Password for sudo | | ``admin_nopassword`` | ``false`` | - | Need no Password for sudo |
| pubkeys | string or lookup | see examples | | ``admin_ansible_login`` | ``true`` | - | if ``admin: true`` and ``l3d_users__create_ansible: true`` your ssh keys will be added to ansible user |
| exklusive_pubkeys | ``true`` | delete all undefined ssh keys | | ``pubkeys`` | string or lookup | - | see examples |
| password | password hash | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) | | ``exklusive_pubkeys`` | ``true`` | - | delete all undefined ssh keys |
| remove | ``false`` | completly remove user if state is absent | | ``password`` | password hash | - | See [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) |
| ``remove`` | ``false`` | - | completly remove user if ``state: absent`` |
### Other ### Other Variables
| name | default value | description | | name | default value | description |
| --- | --- | --- | | --- | --- | --- |
| l3d_users__create_ansible | ``true`` | Create User ansible | | ``l3d_users__create_ansible`` | ``true`` | Create User ansible |
| l3d_users__ansible_user_state | ``present`` | Create or delete user ansible | | ``l3d_users__ansible_user_state`` | ``present`` | Create or delete user ansible |
| l3d_users__set_ansible_ssh_keys | ``false`` | Set SSH Keys for User ansible | | ``l3d_users__set_ansible_ssh_keys`` | ``false`` | Set SSH Keys for User ansible |
| l3d_users__ansible_ssh_keys | | SSH public Keys. One per line or as lookup | | ``l3d_users__ansible_ssh_keys`` | | SSH public Keys. One per line or as lookup |
| submodules_versioncheck | ``false`` | Optionaly enable simple versionscheck of this role | | ``l3d_users__ansible_user_password`` | | Set optional Password for Ansible User, see [official FAQ](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module) |
| ``submodules_versioncheck`` | ``false`` | Optionaly enable simple versionscheck of this role |
Example Playbook Example Playbook
----------------- -----------------

7
roles/user/defaults/main.yml
View file

@ -1,6 +1,6 @@
--- ---
# create users # create users
l3d_users__default_users: {} l3d_users__default_users: []
# - name: 'alice' # - name: 'alice'
# state: 'present' # state: 'present'
# shell: '/bin/bash' # shell: '/bin/bash'
@ -14,6 +14,7 @@ l3d_users__default_users: {}
# admin: true # admin: true
# admin_commands: 'ALL' # admin_commands: 'ALL'
# admin_nopassword: false # admin_nopassword: false
# admin_ansible_login: true
# - name: 'bob' # - name: 'bob'
# state: 'present' # state: 'present'
# shell: '/bin/zsh' # shell: '/bin/zsh'
@ -21,7 +22,7 @@ l3d_users__default_users: {}
# pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}" # pubkeys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}"
# exklusive_pubkeys: false # exklusive_pubkeys: false
l3d_users__local_users: {} l3d_users__local_users: []
# - name: 'charlie' # - name: 'charlie'
# state: 'present' # state: 'present'
# admin: false # admin: false
@ -32,5 +33,7 @@ l3d_users__create_ansible: true
l3d_users__ansible_user_state: 'present' l3d_users__ansible_user_state: 'present'
l3d_users__set_ansible_ssh_keys: false l3d_users__set_ansible_ssh_keys: false
l3d_users__ansible_ssh_keys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}" l3d_users__ansible_ssh_keys: "{{ lookup('url', 'https://github.com/do1jlr.keys', split_lines=False) }}"
l3d_users__ansible_user_password: ''
# run simple versionscheck # run simple versionscheck
submodules_versioncheck: false submodules_versioncheck: false

3
roles/user/tasks/user_ansible.yml
View file

@ -13,6 +13,7 @@
shell: '/bin/bash' shell: '/bin/bash'
group: 'ansible' group: 'ansible'
state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}" state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}"
password: "{{ l3d_users__ansible_user_password }}"
create_home: true create_home: true
- name: Set dedicated SSH keys for User ansible and drop all other keys - name: Set dedicated SSH keys for User ansible and drop all other keys
@ -31,6 +32,6 @@
state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}" state: "{{ l3d_users__ansible_user_state | ternary('present', 'absent') }}"
key: "{{ item.pubkeys | default() }}" key: "{{ item.pubkeys | default() }}"
loop: "{{ _l3d_users__merged_users }}" loop: "{{ _l3d_users__merged_users }}"
when: item.admin | default(false) | bool when: item.admin | default(false) | bool and item.admin_ansible_login | default(true) | bool
loop_control: loop_control:
label: "user: ['{{ item.name }}']" label: "user: ['{{ item.name }}']"

2
roles/user/vars/main.yml
View file

@ -1,3 +1,3 @@
--- ---
playbook_version_number: 6 playbook_version_number: 7
playbook_version_path: 'l3d.users.user.version' playbook_version_path: 'l3d.users.user.version'