Initial Lab Setup

2026-07-06 16:45:51 +02:00
commit 05184d778d
52 changed files with 2526 additions and 0 deletions
@@ -0,0 +1,60 @@
+---
+- name: Ensure the administrative user exists
+  ansible.builtin.user:
+    name: volker
+    shell: /bin/bash
+    groups: sudo
+    append: yes
+  become: yes  # Added this to prevent permission denied errors
+  tags: [security, always]
+
+- name: Allow root SSH login
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?PermitRootLogin'
+    line: 'PermitRootLogin yes'
+  become: yes
+  notify: Restart SSH
+  tags: [security, ssh]
+
+- name: Apply global user security policy
+  ansible.builtin.user:
+    name: "{{ item.name }}"
+    password: "{{ vault_root_password | password_hash('sha512') }}"
+    shell: /bin/bash
+    groups: "{{ item.groups | default(omit) }}"
+  become: yes  # <--- Added this for safety
+  loop:
+    - { name: 'root' }
+    - { name: 'volker', groups: 'sudo' }
+
+#- name: Sync passwords for administrative users
+#  ansible.builtin.user:
+#    name: "{{ item }}"
+#    password: "{{ root_password_hash }}"
+#  become: yes
+#  loop:
+#    - root
+#    - volker
+#  tags: [security]
+
+- name: Ensure SSH keys are synchronized for both users
+  ansible.posix.authorized_key:
+    user: "{{ item }}"
+    state: present
+    key: "{{ lookup('file', 'authorized_keys_volker') }}"
+  become: yes
+  loop:
+    - root
+    - volker
+  tags: [security, ssh]
+
+- name: Passwordless sudo for volker
+  ansible.builtin.copy:
+    content: "volker ALL=(ALL) NOPASSWD:ALL"
+    dest: /etc/sudoers.d/volker
+    owner: root
+    group: root
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+  become: yes