Initial Lab Setup

roles/security/files/authorized_keys_volker

@@ -0,0 +1,5 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqKm6tSG73CudRxZkUnR/hcwKQnvSfkQM/Gq1gR6wswu4kcthHZ+YCxzRFIJmTR1+C0UXy8yRVtwprz31plFbHvU3Om913MGaN1oadunYOkKD8OmAtCtht9H+5wC5HtjwuhNf/MH1K727ecNUSH10DYovzXkOD6byJukfkvbU6CVKxWAI6W9PXTLOPRyUoy3TX0GEBascayneqHBFfPGpICnR76X9Ydi2avfgmNiGtTMzKkn1mNqm3a4eHCfde8XUBtqlxdMnO/pMlgMh14XoBSD5T+U3OqIUvMOiU3ZKlcq4W46wtPX1Im6iqfgFutwT1YqQ8UNY06urO41nH6d5rVfSA1BS7Fonho2xK5lQ3aqapn2+o9goXTIQ1avoOHyWS0j+W8m5BEL8Prvr+eqjTCivh5g4rKVe2SebKzZU89oZSEkV9Mj69qhS1g3LnyJds+oskl04CdRXrn5KSyxXP9X4m0EYYfbzWMAPRZ6SsltAOw9w4hwZtwIKSl2+bMQAqQmRojDof4FgK+DCQfdcThhrmknGtGiL1v3tJuCmmiikoKis5qOVBmVJOhJaSOTKSIhx3oTVVfCgzlEnGE0M7gUk1+Qh30p4TahsbyfcWg5v3+0vdIVgAWIdW0Kp0s9R0mU4qKeIuZ9ejHCmaGcQe2ZolQZc5UrTwMBb1PaqPQQ== key von macbook fuer rogueone
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFhNTFIBVTfsFDiO5oKdTWxOkk9jrpnqYma6DFNkCROq strider-mackbook-2023-ed
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+5jrJHgRNSsZICWTRFppyVyyn1SfnboEa4/bwCd9yad34e0f3CRu5EGlVzKUZAar7D1EWxjeFEeJF1hmaY0iJGbnmzf2BT8FHIhiJqa/EyiKlrVY+rHsvkzP26XOe8xlZdh5MAEsKt4/6jnvWN8H+pctvQzOfynh8+9HdgU/df7M7YKrFd9sSToFx0dZfI+3eF0OfLrjYp2fKGVK/SiiyUBJE96h39IK13grMxlwQ2vv3p4zSu6ADINJipa1sedu8earq0t4dsxvy/0F7wwbfkMgek0Q0eN/gT31pM/m1NXpc7Qk1E2M8YcaFIUAbYchqoZT8wsn4/MxjbY835226RCIOPrEL+CmKzF904S3zUqIU2BJ42IGGBtCtM9eoRS3BMkYFLKY4vEH0bDTu9KSwBdLdc/1JYQZi5NPZSW0rH1OeKntJACmUczCK2NXAJraGm374eT/JRJkSQxFLolKZRo6duhAdkPcvGZeGTMSgcLguZ7ayZuz3Q730JqMtVV0jKpXbRjAM5kBqflc31580xgrG6J6gG/cTh9XvC4VF/vP8yP44HGODNtJeiTVBdowltsFA+xUPspJa8fFysCcSL0dmKjr+wlfMZgjiuEAJ3Ejm9m7VsVjeeWdlfRXVDUIrInsEYz+9lADrZvSom9cZGksuP581m3h4ncnLyFU9uw== key von macbook fuer goldeneye
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDX9hQGGErj6YUhq5KN934JLZdD4R8lqFlNOSbcY4vWFZp7F/l9zntGaozbzY9X+0WH2qLubrcdWXpWXf3mJPw/gjd+1DAHn/1BkWjgOccmiaM5CQc1SXLs5wZIzhgXuzg+OwGry7XXtAOGdjjAB+c0cDC6bz5o53Y2hiprG5+Y7AuAa7rJxs6AT+EM/gzWsuwofzdEbnnEeQn874gBXOb3IS4GNZL5NNcb1lqocnkmhsQnTXJIGbqkBtzWmWwcS5/GGWhaqFz+Ugv2VUcstgrz7JvtGA5WPr3hCiB+y4QRBiKHrYy/zjWn+ESGk7cYjnhiHdIlRJXeVLkWJlHIr4hN1ajuetx4wS6pg2molZxEwZfTzhDxMHWocVNUHm1UZMAxxQ3VpEq6nvrUM7ppVQicl1R+zgHEeHa9fRUSLq/fBaIg5y4VZCXK7p61O6ms6pK0QoNFcGaSZ9bqYoY0ouPxfNPTMAw5yLu1pFmFC/9+MEB1d/66mdG5x8UdLma2qGRChcVKr1gLqzIEtx69x/0hFKUne9KssInxy+BC55tjpkmbb3euAeuzRIKYtUHz/9XbEUEpjvofnXawtz2FEEddtI/eCtBc65nPP21f/or1ngT6I7gC+Ha9brvK/AmlM3OOx6tvUg1StRwQj9qFdT5FpFbN+cuWnf2/LWf8A5ik7w== key von macbook fuer LXC-Container
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIATdXmHXS8dGIsVa5zmAtjkWRMka/CNcIEeiFX8vru1 sentinel-automation

roles/security/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+- name: Ensure the administrative user exists
+  ansible.builtin.user:
+    name: volker
+    shell: /bin/bash
+    groups: sudo
+    append: yes
+  become: yes  # Added this to prevent permission denied errors
+  tags: [security, always]
+
+- name: Allow root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?PermitRootLogin'
+    line: 'PermitRootLogin yes'
+  become: yes
+  notify: Restart SSH
+  tags: [security, ssh]
+
+- name: Apply global user security policy
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    password: "{{ vault_root_password | password_hash('sha512') }}"
+    shell: /bin/bash
+    groups: "{{ item.groups | default(omit) }}"
+  become: yes  # <--- Added this for safety
+  loop:
+    - { name: 'root' }
+    - { name: 'volker', groups: 'sudo' }
+
+#- name: Sync passwords for administrative users
+#  ansible.builtin.user:
+#    name: "{{ item }}"
+#    password: "{{ root_password_hash }}"
+#  become: yes
+#  loop:
+#    - root
+#    - volker
+#  tags: [security]
+
+- name: Ensure SSH keys are synchronized for both users
+  ansible.posix.authorized_key:
+    user: "{{ item }}"
+    state: present
+    key: "{{ lookup('file', 'authorized_keys_volker') }}"
+  become: yes
+  loop:
+    - root
+    - volker
+  tags: [security, ssh]
+
+- name: Passwordless sudo for volker
+  ansible.builtin.copy:
+    content: "volker ALL=(ALL) NOPASSWD:ALL"
+    dest: /etc/sudoers.d/volker
+    owner: root
+    group: root
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+  become: yes