feat: move user creation in dedicated role
All checks were successful
continuous-integration/drone/push Build is passing

This commit is contained in:
vincent 2023-01-15 11:28:17 +01:00
parent 885a1388d9
commit 5899fca204
3 changed files with 0 additions and 107 deletions

View File

@ -3,46 +3,7 @@
ansible.builtin.package: ansible.builtin.package:
name: '{{ system_ssh_package }}' name: '{{ system_ssh_package }}'
state: present state: present
- name: Ensure .ssh exist for user
become: true
ansible.builtin.file:
state: directory
path: '/home/{{ item }}/.ssh'
owner: '{{ item }}'
mode: 0700
with_items:
- ansible
- name: Copy ssh config for user
become: true
ansible.builtin.template:
dest: '/home/{{ item }}/.ssh/config'
src: 'ssh/config.j2'
force: true
remote_src: false
mode: '600'
selevel: s0
owner: '{{ item }}'
with_items:
- ansible
- name: Ensure root ssh directory exist
become: true
ansible.builtin.file:
state: directory
path: '/root/.ssh'
owner: 'root'
mode: 0700
- name: Copy ssh config for root
become: true
ansible.builtin.copy:
dest: /root/.ssh/
src: 'ssh/config'
force: true
remote_src: false
mode: '600'
selevel: s0
owner: 'root'
- name: Ensure key directory exist - name: Ensure key directory exist
become: true become: true
@ -62,13 +23,6 @@
owner: '{{ item.user }}' owner: '{{ item.user }}'
with_items: '{{ privatekeytodeploy }}' with_items: '{{ privatekeytodeploy }}'
- name: Deploy SSH-Keys to remote host
ansible.posix.authorized_key:
user: '{{ item.user }}'
key: '{{ item.sshkey }}'
exclusive: false
with_items: '{{ keystodeploy }}'
become: true
- name: Les connexions par mot de passe sont désactivées - name: Les connexions par mot de passe sont désactivées
become: true become: true

View File

@ -1,13 +1,4 @@
--- ---
- name: Create system user
become: true
ansible.builtin.user:
name: '{{ item.name }}'
system: true
home: "{{ item.home | default('/') }}"
shell: "{{ item.shell | default('/usr/bin/nologin') }}"
with_items: '{{ system_user }}'
- name: Create system group - name: Create system group
ansible.builtin.group: ansible.builtin.group:
name: '{{ item.name }}' name: '{{ item.name }}'

View File

@ -1,52 +0,0 @@
# $OpenBSD: ssh_config,v 1.34 2019/02/04 02:39:42 dtucker Exp $
# This is the ssh client system-wide configuration file. See
# ssh_config(5) for more information. This file provides defaults for
# users, and the values can be changed in per-user configuration files
# or on the command line.
# Configuration data is parsed as follows:
# 1. command line options
# 2. user-specific file
# 3. system-wide file
# Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the
# configuration file, and defaults at the end.
# Site-wide defaults for some commonly used options. For a comprehensive
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
Host *
AddKeysToAgent yes
ForwardAgent yes
# ForwardX11 no
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
# StrictHostKeyChecking ask
# IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa
# IdentityFile ~/.ssh/id_ecdsa
# IdentityFile ~/.ssh/id_ed25519
# Port 22
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com
# EscapeChar ~
# Tunnel no
# TunnelDevice any:any
# PermitLocalCommand no
# VisualHostKey no
# ProxyCommand ssh -q -W %h:%p gateway.example.com
# RekeyLimit 1G 1h
{% for host in system_ssh_custom_host %}
Host {{ host.host }}
Hostname {{ host.host }}
User {{ host.user }}
IdentityFile {{ host.keyfile }}
{% endfor %}