61 lines
1.5 KiB
YAML
61 lines
1.5 KiB
YAML
|
---
|
||
|
|
- name: Ensure the administrative user exists
|
||
|
|
ansible.builtin.user:
|
||
|
|
name: volker
|
||
|
|
shell: /bin/bash
|
||
|
|
groups: sudo
|
||
|
|
append: yes
|
||
|
|
become: yes # Added this to prevent permission denied errors
|
||
|
|
tags: [security, always]
|
||
|
|
|
||
|
|
- name: Allow root SSH login
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /etc/ssh/sshd_config
|
||
|
|
regexp: '^#?PermitRootLogin'
|
||
|
|
line: 'PermitRootLogin yes'
|
||
|
|
become: yes
|
||
|
|
notify: Restart SSH
|
||
|
|
tags: [security, ssh]
|
||
|
|
|
||
|
|
- name: Apply global user security policy
|
||
|
|
ansible.builtin.user:
|
||
|
|
name: "{{ item.name }}"
|
||
|
|
password: "{{ vault_root_password | password_hash('sha512') }}"
|
||
|
|
shell: /bin/bash
|
||
|
|
groups: "{{ item.groups | default(omit) }}"
|
||
|
|
become: yes # <--- Added this for safety
|
||
|
|
loop:
|
||
|
|
- { name: 'root' }
|
||
|
|
- { name: 'volker', groups: 'sudo' }
|
||
|
|
|
||
|
|
#- name: Sync passwords for administrative users
|
||
|
|
# ansible.builtin.user:
|
||
|
|
# name: "{{ item }}"
|
||
|
|
# password: "{{ root_password_hash }}"
|
||
|
|
# become: yes
|
||
|
|
# loop:
|
||
|
|
# - root
|
||
|
|
# - volker
|
||
|
|
# tags: [security]
|
||
|
|
|
||
|
|
- name: Ensure SSH keys are synchronized for both users
|
||
|
|
ansible.posix.authorized_key:
|
||
|
|
user: "{{ item }}"
|
||
|
|
state: present
|
||
|
|
key: "{{ lookup('file', 'authorized_keys_volker') }}"
|
||
|
|
become: yes
|
||
|
|
loop:
|
||
|
|
- root
|
||
|
|
- volker
|
||
|
|
tags: [security, ssh]
|
||
|
|
|
||
|
|
- name: Passwordless sudo for volker
|
||
|
|
ansible.builtin.copy:
|
||
|
|
content: "volker ALL=(ALL) NOPASSWD:ALL"
|
||
|
|
dest: /etc/sudoers.d/volker
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: '0440'
|
||
|
|
validate: /usr/sbin/visudo -cf %s
|
||
|
|
become: yes
|