Basic server

This role manage user and sudoers file on linux servers.

Requirements

None.

Role Variables

Default variables are defined in defaults/ and vars/ directory :

• Users configuration :

Variable	Default value	Description
users_groups	[]	List of groups to create
user_default_shell	/bin/bash	Default user shell
users	[]	List of users to create
users.state	present	Ensure user are absent or present on system
users.login	mandatory	User login name
users.comment		User comment / mail
users.group	users.login	User default group. Default is same as login name
users.groups		User additionnal groups
users.opt_groups		User optional groups only append to user group list if exists
users.shell		User shell
users.sshkeys	[]	List of user SSH Keys to deploy
users.sshkeys_revoke	[]	List of user SSH Keys to revoke

• Users groups configuration :

Variable	Default value	Description
users_groups	[]	List of groups to create
users_groups.state	present	Ensure group are absent or present on system
users_groups.name	mandatory	Group name

• Sudoers configuration :

Variable	Default value	Description
sudoers	{}	Dict of sudo configuration to deploy on the server
sudoers.key		Name of sudoers configuration file in /etc/sudoers.d/ directory
sudoers.state	present	Ensure sudoers are absent or present on system
sudoers.lines	[]	Array of sudo configuration to deploy on the server

Sample playbooks

Create users and groups

- hosts: all
  vars:
    lookup_ldapkey_url: "ldaps://directory.vitry.intranet/ou=users,dc=lab,dc=lan?sshPublicKey?sub?(&(!(pwdAccountLockedTime=000001010000Z))(uid=%s))"\
    lookup_ldapkey_binddn: "cn=admin,dc=lab,dc=lan"
    lookup_ldapkey_bindpw: "password"
  roles:
    - role: basic-user
      users_groups:
        - name: exploit
      users:
        - name: jekas
          groups: exploit
          sshkeys:
            - "{{ lookup('ldapkey', 'jekas') }}"

Create Groups

users_groups:
  - name: exploit
    state: present # default

Create Users

You can ask the script to create a list of users for your applications

users:
  - name: centreon
    sshkey:
      - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDg6eXbe6l6PLmjOpm9/4CRAMsg78JYKcxijw7YdMWcF1GD5n0mwjiY1ebd/yWWXaL3HM5vlc3NEsowO6dWU/1EqilQbfsxlSnTckUrHW1VlaJOGGeK5W3CewiJ/For663vks9Wxgnv3QqaWG74Yt6WxO9b16Le2S0hqpW7py3WsHSz06UhXsYbXYnv+5+INxYvESYBiqp37byymIVUY+9PQ6rMYorMZDGs+VJYhJCPuCJ7lqpbGBXVB74CWdqkHKzMSPYzmyBDaZtKY7hGaxUF7FRcqVqeEA2nfprcRufLf5xiOzo3tOwQiLtFWUcjSF0Emm6uKAW2igSavCH3b4AV centreon@centreon.boass.lan

authorized_keys is not mandatory, if present, you should give it a list of SSH keys that should be enabled for the user

Create Sudoers

You can ask the script to create a list of sudoers file in /etc/sudoers.d/ to define user privileges escalation :

sudoers:
  default:
    state: absent
  exploit:
    state: present
    lines:
      - "%exploit ALL=(ALL) NOPASSWD: ALL"
  centreon:
    state: present
    lines:
      - "centreon ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins-ssh/check_bind_stats"
      - "centreon ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins-ssh/check_mysql_health"

SSH Key LDAP lookups

This role adds a new lookup plugin called ldapkey, you can use it to lookup SSH keys by login from the Lab LDAP. In order to use this feature, you need to install python-ldap on the machine running Ansible Anywhere in your playbook, you can use :

{{ lookup('ldapkey', 'login') }}

Or you can use it in tasks

- authorized_key: user=charlie key="{{ item }}"
  with_ldapkey:
    - mabes
    - rogon

Configuration (optional)

By default, it will fetch keys from directory.vitry.intranet. If this server isn't accessible to you, of if you want to change some parameters, you can define the URL yourself :

    vars:
        lookup_ldapkey_url: ldaps://ldap.prod.vitry.intranet/

The lookup_ldapkey_url takes a RFC4516 LDAP URL.

You may also override the search filter, base DN, scope, or return attribute

vars:
    lookup_ldapkey_url: "ldaps://directory.vitry.intranet/ou=users,dc=lab,dc=lan?sshPublicKey?sub?(&(!(pwdAccountLockedTime=000001010000Z))(uid=%s))"\
    lookup_ldapkey_binddn: "cn=admin,dc=lab,dc=lan"
    lookup_ldapkey_bindpw: "password"

%s in the search filter will be replaced by the lookup key