diff options
| -rw-r--r-- | group_vars/all.yml.example | 4 | ||||
| -rw-r--r-- | molecule/default/converge.yml | 3 | ||||
| -rw-r--r-- | roles/user/README.md | 27 | ||||
| -rw-r--r-- | roles/user/defaults/main.yml | 7 | ||||
| -rw-r--r-- | roles/user/handlers/main.yml | 7 | ||||
| -rw-r--r-- | roles/user/meta/argument_specs.yml | 18 | ||||
| -rw-r--r-- | roles/user/meta/main.yml | 19 | ||||
| -rw-r--r-- | roles/user/tasks/install-archlinux.yml | 7 | ||||
| -rw-r--r-- | roles/user/tasks/install-debian.yml | 7 | ||||
| -rw-r--r-- | roles/user/tasks/main.yml | 64 | ||||
| -rw-r--r-- | site.yml | 1 |
11 files changed, 164 insertions, 0 deletions
diff --git a/group_vars/all.yml.example b/group_vars/all.yml.example index e0529a63..359bf2ed 100644 --- a/group_vars/all.yml.example +++ b/group_vars/all.yml.example @@ -1,3 +1,7 @@ --- +username: "test_user" +user_public_keys: + - "ssh-ed25519 AAAA...fMo" + - "ssh-rsa AAAA...4I3" network_wifi_ssid: "TEST_WIFI_SSID" network_wifi_pass: "TEST_WIFI_PASS" diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index d0c2418d..1399e996 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -5,5 +5,8 @@ ansible_become_method: su network_wifi_ssid: "TEST_WIFI_SSID" network_wifi_pass: "TEST_WIFI_PASS" + username: test_user + user_groups: ["wheel", "test_group"] roles: - role: network + - role: user diff --git a/roles/user/README.md b/roles/user/README.md new file mode 100644 index 00000000..ba795d1a --- /dev/null +++ b/roles/user/README.md @@ -0,0 +1,27 @@ +# Ansible Role: User + +This role creates the user and configures the `sudo` group for the user + +## Role Variables + +- `username` **Required** name of the user to be created. +- `user_password` created user default password (default: `changeme`). +- `user_public_keys` the list of ssh public keys to be added to user authorized_keys +- `user_groups` extra groups to be created and user added to them (default: []) + +## Internals + +- ensure `sudo` installed. +- configure `sudoers` file to grant `%sudo ALL=(ALL:ALL) ALL` for `sudo` group. +- create user and add to the `username`, `sudo`, extra `user_groups` groups. +- require user password change on first use of `sudo` command. +- configure the user authorized keys to allow public key authentication (if configured). + +### Caveats + +If no public key authentication is configured by this role, +the user won't be able to login (since the hardened ssh role disable root and password authentication). + +For this reason, if you want to enable the insecure password authentication, +please update the ssh role `"Configure authentication policy"` manually to +allow for password/root authentication, These features are disabled by default. diff --git a/roles/user/defaults/main.yml b/roles/user/defaults/main.yml new file mode 100644 index 00000000..55fa2869 --- /dev/null +++ b/roles/user/defaults/main.yml @@ -0,0 +1,7 @@ +--- +# Default user password: changeme +# Password will be required to change after first usage +user_password: + '$6$jF4YTa1r2tKMH4b3$9KdWeEXJ0RfaS0EfTE6CPFmJFxPABXa455U0Wc47iGxqvsgchkcuRAha/hus//mG7mxWdfEFkLkCKeBsdyLcX/' + +user_groups: [] diff --git a/roles/user/handlers/main.yml b/roles/user/handlers/main.yml new file mode 100644 index 00000000..2d9b6c32 --- /dev/null +++ b/roles/user/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "Require password change" + become: true + ansible.builtin.command: + cmd: chage -d 0 "{{ username }}" + changed_when: true + when: user.changed diff --git a/roles/user/meta/argument_specs.yml b/roles/user/meta/argument_specs.yml new file mode 100644 index 00000000..5f4b1fd4 --- /dev/null +++ b/roles/user/meta/argument_specs.yml @@ -0,0 +1,18 @@ +--- +argument_specs: + main: + options: + username: + type: "str" + required: true + description: "The username of the created account." + user_public_keys: + type: "list" + required: true + description: "The list SSH public key to be added to user authorized_keys." + elements: "str" + user_groups: + type: "list" + description: "The list of groups the user should be added to." + elements: "str" + default: [] diff --git a/roles/user/meta/main.yml b/roles/user/meta/main.yml new file mode 100644 index 00000000..7130e132 --- /dev/null +++ b/roles/user/meta/main.yml @@ -0,0 +1,19 @@ +--- +dependencies: [] +galaxy_info: + role_name: user + author: a14m + description: "Configure user and sudo" + company: "kartoffeln.work GmbH." + license: "license MIT" + min_ansible_version: "2.18" + platforms: + - name: ArchLinux + versions: + - all + - name: Ubuntu + versions: + - noble + - name: Debian + versions: + - bookworm diff --git a/roles/user/tasks/install-archlinux.yml b/roles/user/tasks/install-archlinux.yml new file mode 100644 index 00000000..84a7f0c2 --- /dev/null +++ b/roles/user/tasks/install-archlinux.yml @@ -0,0 +1,7 @@ +--- +- name: "Ensure sudo installed" + become: true + community.general.pacman: + name: "sudo" + state: "present" + tags: [required_for_boot] diff --git a/roles/user/tasks/install-debian.yml b/roles/user/tasks/install-debian.yml new file mode 100644 index 00000000..6d59e934 --- /dev/null +++ b/roles/user/tasks/install-debian.yml @@ -0,0 +1,7 @@ +--- +- name: "Ensure sudo installed" + become: true + ansible.builtin.apt: + name: "sudo" + state: "present" + tags: [required_for_boot] diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml new file mode 100644 index 00000000..4bc5fe4f --- /dev/null +++ b/roles/user/tasks/main.yml @@ -0,0 +1,64 @@ +--- +- name: "Install OS-specific packages" + ansible.builtin.include_tasks: "install-{{ ansible_os_family | lower }}.yml" + tags: [required_for_boot] + +- name: "Set sudo group fact" + ansible.builtin.set_fact: + sudo_group: "sudo" + tags: [required_for_boot] + +- name: "Set user groups fact" + ansible.builtin.set_fact: + user_groups: "{{ ([username, sudo_group] + user_groups) | unique }}" + +- name: "Configure permissions for group: {{ sudo_group }}" + become: true + community.general.sudoers: + name: "enable-sudo-group" + group: "{{ sudo_group }}" + commands: "ALL" + nopassword: false + sudoers_path: "/etc/sudoers.d" + state: present + tags: [required_for_boot] + +- name: "Ensure user groups are created" + become: true + ansible.builtin.group: + name: "{{ item }}" + state: "present" + with_items: "{{ user_groups }}" + tags: [required_for_boot] + +- name: "Create user: {{ username }}" + become: true + ansible.builtin.user: + name: "{{ username }}" + append: false + create_home: true + generate_ssh_key: false + groups: "{{ user_groups }}" + password: "{{ user_password }}" + state: "present" + update_password: "on_create" + register: user + notify: "Require password change" + tags: [required_for_boot] + +- name: "Create user ssh directory" + ansible.builtin.file: + path: "/home/{{ username }}/.ssh/" + mode: "0700" + owner: "{{ username }}" + state: "directory" + tags: [required_for_boot] + +- name: "Add user ssh authorized_keys" + ansible.builtin.copy: + dest: "/home/{{ username }}/.ssh/authorized_keys" + mode: "0600" + owner: "{{ username }}" + content: | + {{ user_public_keys | join('\n') }} + tags: [required_for_boot] @@ -6,3 +6,4 @@ - chroot roles: - role: "network" + - role: "user" |