Initial commit
This commit is contained in:
64
roles/common/tasks/main.yml
Normal file
64
roles/common/tasks/main.yml
Normal file
@ -0,0 +1,64 @@
|
||||
---
|
||||
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
#
|
||||
# nfs-server
|
||||
# nfs-client
|
||||
- import_tasks: nfs.yml
|
||||
tags:
|
||||
- nfs
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
#
|
||||
# nis-install-server
|
||||
- import_tasks: nis-install-server.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
|
||||
# tags supported inside nfs.yml:
|
||||
#
|
||||
# nis-install-client
|
||||
- import_tasks: nis-install-client.yml
|
||||
when: "groups['nis_client']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
|
||||
# tags supported inside nis_user.yml:
|
||||
#
|
||||
# nis-user
|
||||
# system-user
|
||||
- import_tasks: nis_user.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-user
|
||||
|
||||
# tags supported inside samba_user.yml:
|
||||
#
|
||||
# samba-user
|
||||
- import_tasks: samba_user.yml
|
||||
when: "groups['samba_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-samba-user
|
||||
|
||||
- import_tasks: user-systemfiles.yml
|
||||
when: "groups['nis_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- user-systemfiles
|
||||
|
||||
# tags supported inside sudoers.yml:
|
||||
#
|
||||
# sudoers-remove
|
||||
# sudoers-file-configuration
|
||||
# sudoers-global-configuration
|
||||
- import_tasks: sudoers.yml
|
||||
when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- sudoers
|
||||
|
||||
#- import_tasks: mount_samba_shares.yml
|
||||
# when: "groups['client_pc']|string is search(inventory_hostname)"
|
||||
# tags:
|
||||
# - samba-shares
|
||||
|
||||
28
roles/common/tasks/mount_samba_shares.yml
Normal file
28
roles/common/tasks/mount_samba_shares.yml
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
|
||||
|
||||
- name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists
|
||||
file:
|
||||
path: "/mnt/{{ item.name }}"
|
||||
owner: "{{ item.name }}"
|
||||
group: "{{ item.name }}"
|
||||
mode: '0700'
|
||||
state: directory
|
||||
with_items: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
|
||||
- name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
|
||||
file:
|
||||
path: "/mnt/{{ item.1 }}/{{ item.0.name }}"
|
||||
owner: "{{ item.1 }}"
|
||||
group: "{{ item.1 }}"
|
||||
mode: '0770'
|
||||
state: directory
|
||||
with_subelements:
|
||||
- "{{ samba_shares }}"
|
||||
- user
|
||||
loop_control:
|
||||
label: '{{ item.1 }} share: {{ item.0.name }}'
|
||||
79
roles/common/tasks/nfs.yml
Normal file
79
roles/common/tasks/nfs.yml
Normal file
@ -0,0 +1,79 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# NFS Server
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Ensure NFS utilities (server) are installed.
|
||||
apt:
|
||||
name:
|
||||
- nfs-common
|
||||
- nfs-kernel-server
|
||||
state: present
|
||||
when:
|
||||
- ansible_os_family == "Debian"
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Ensure directories to export exist
|
||||
file:
|
||||
path: '{{ item.src.split(":")[1] }}'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
with_items: "{{ nfs_exports }}"
|
||||
loop_control:
|
||||
label: '{{ item.path }}'
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
- name: (nfs.yml) Copy exports file.
|
||||
template:
|
||||
src: etc/exports.j2
|
||||
dest: /etc/exports
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
notify: Reload nfs
|
||||
tags:
|
||||
- nfs-server
|
||||
|
||||
# ---
|
||||
# NFS clients
|
||||
# ---
|
||||
|
||||
- name: (nfs.yml) Ensure NFS utilities (clients) are installed.
|
||||
apt:
|
||||
pkg: nfs-common
|
||||
state: present
|
||||
when:
|
||||
- ansible_os_family == "Debian"
|
||||
- "groups['nfs_client']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nfs-client
|
||||
|
||||
- name: (nfs.yml) NFS Mount exports from nfs server
|
||||
mount:
|
||||
path: "{{ item.path }}"
|
||||
src: "{{ item.src }}"
|
||||
fstype: nfs
|
||||
opts: "{{ item.mount_opts }}"
|
||||
dump: "{{ item.dump | default(omit) }}"
|
||||
passno: "{{ item.passno | default(omit) }}"
|
||||
state: mounted
|
||||
loop: "{{ nfs_exports }}"
|
||||
loop_control:
|
||||
label: '{{ item.src }}'
|
||||
when:
|
||||
- "groups['nfs_client']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nfs-client
|
||||
|
||||
|
||||
|
||||
303
roles/common/tasks/nis-install-client.yml
Normal file
303
roles/common/tasks/nis-install-client.yml
Normal file
@ -0,0 +1,303 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Install nis
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Set (nis) default domain (/etc/defaultdomain)
|
||||
template:
|
||||
dest: /etc/defaultdomain
|
||||
src: etc/defaultdomain.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Create preconfigured /etc/yp.conf on nis clients
|
||||
template:
|
||||
dest: /etc/yp.conf
|
||||
src: etc/yp.conf.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Install nis common packages
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/default/nis
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Check if file '/etc/default/nis.ORIG' exists
|
||||
stat:
|
||||
path: /etc/default/nis.ORIG
|
||||
register: default_nis_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/default/nis
|
||||
command: cp -a /etc/default/nis /etc/default/nis.ORIG
|
||||
when:
|
||||
- default_nis_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISSERVER' (client)
|
||||
replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISSERVER=.*'
|
||||
replace: 'NISSERVER=false'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (client)
|
||||
replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISCLIENT=.*'
|
||||
replace: 'NISCLIENT=true'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/{passwd,group,shadow}
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Add '+::::::' to file /etc/passwd
|
||||
lineinfile:
|
||||
path: /etc/passwd
|
||||
line: '+::::::'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
when: "ansible_distribution_major_version|int < 18"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add '+:::' to file /etc/group
|
||||
lineinfile:
|
||||
path: /etc/group
|
||||
line: '+:::'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
when: "ansible_distribution_major_version|int < 18"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add '+::::::::' to file /etc/shadow
|
||||
lineinfile:
|
||||
path: /etc/shadow
|
||||
line: '+::::::::'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: shadow
|
||||
mode: '0640'
|
||||
when: "ansible_distribution_major_version|int < 18"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/hosts
|
||||
# ---
|
||||
|
||||
- name: (nis-install-client.yml) Check if file '/etc/hosts.ORIG' exists
|
||||
stat:
|
||||
path: /etc/hosts.ORIG
|
||||
register: etc_hosts_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Backup existing file /etc/hosts
|
||||
command: cp -a /etc/hosts /etc/hosts.ORIG
|
||||
when:
|
||||
- etc_hosts_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Add nis-server to file /etc/hosts
|
||||
lineinfile:
|
||||
path: /etc/hosts
|
||||
line: '{{ nis_server_address }} {{ nis_server_name }} {{ nis_server_name.split(".")[1] }}'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/nsswitch.conf
|
||||
# ---
|
||||
|
||||
- name: (nis.yml) Check if file '/etc/nsswitch.conf.ORIG' exists
|
||||
stat:
|
||||
path: /etc/nsswitch.conf.ORIG
|
||||
register: nsswitch_conf_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis.yml) Backup existing file /etc/nsswitch.conf
|
||||
command: cp -a /etc/nsswitch.conf /etc/nsswitch.conf.ORIG
|
||||
when:
|
||||
- nsswitch_conf_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set hosts)
|
||||
replace:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: '(hosts:\s+files)\s+([^nis].*)'
|
||||
replace: '\1 nis \2'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Adjust file /etc/nsswitch.conf (set passwd/group/shadow)
|
||||
replace:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: '^({{ item }}:\s+.*)'
|
||||
replace: '\1 nis'
|
||||
with_items:
|
||||
- passwd
|
||||
- group
|
||||
- shadow
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
|
||||
# ---
|
||||
|
||||
# - !! Using NIS client in Ubuntu 18.04 crashes both Gnome and Unity !!
|
||||
# - ===================================================================
|
||||
#
|
||||
# - Unter NIS in Ubuntu 18.04 stütrzt Gnome und Unity ab
|
||||
# -
|
||||
# - Abhilfe schafft:
|
||||
# -
|
||||
#
|
||||
# - Create a new directory in /etc/systemd/system/ named exactly after the
|
||||
# - service you want to extend including a '.d', here this would be:
|
||||
# - systemd-logind.service.d
|
||||
# -
|
||||
# - mkdir /etc/systemd/system/systemd-logind.service.d
|
||||
#
|
||||
# - Create a new file choose_an_appropriate_name.conf (e.g. nis_allow_network.conf)
|
||||
# - inside the newly created directory with the following content, which specifies
|
||||
# - the IP or IP range you want to be allowed:
|
||||
# -
|
||||
# - cat <<EOF > /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
|
||||
# - [Service]
|
||||
# - IPAddressAllow=192.168.0.0/16
|
||||
# - EOF
|
||||
# -
|
||||
# - systemctl daemon-reload
|
||||
# - systemctl restart systemd-logind.service
|
||||
|
||||
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/systemd-logind.service.d exists
|
||||
file:
|
||||
path: /etc/systemd/system/systemd-logind.service.d
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when: "ansible_distribution_major_version|int >= 18"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf exists
|
||||
copy:
|
||||
src: "{{ role_path + '/files/etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf' }}"
|
||||
dest: /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
when: "ansible_distribution_major_version|int >= 18"
|
||||
notify:
|
||||
- Restart systemd-logind.service
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# - Seit Ubuntu 16.04 startet nis vor dem portmapper (rpcbind). Das Starten
|
||||
# - schlägt deshalb fehl und nis steht nicht zur Verfügung.
|
||||
# -
|
||||
# - Abhilfe:
|
||||
# -
|
||||
# - Run "systemctl edit rpcbind.socket" and add the following:
|
||||
# -
|
||||
# - [Unit]
|
||||
# - DefaultDependencies=no
|
||||
# - Wants=rpcbind.target
|
||||
# - Before=rpcbind.target
|
||||
# -
|
||||
# - You can see your changes:
|
||||
# - cat /etc/systemd/system/rpcbind.socket.d/override.conf
|
||||
|
||||
- name: (nis-install-client.yml) Ensure directory /etc/systemd/system/rpcbind.socket.d exists
|
||||
file:
|
||||
path: /etc/systemd/system/rpcbind.socket.d
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when: "ansible_distribution_major_version|int >= 16"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-client.yml) Ensure file /files/etc/systemd/system/rpcbind.socket.d/override.conf exists
|
||||
copy:
|
||||
src: "{{ role_path + '/files/etc/systemd/system/rpcbind.socket.d/override.conf' }}"
|
||||
dest: /etc/systemd/system/rpcbind.socket.d/override.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
when: "ansible_distribution_major_version|int >= 16"
|
||||
notify:
|
||||
- Restart rpcbind
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
|
||||
# TODO:
|
||||
# /etc/systemd/system/systemd-logind.service.d/nis_allow_network.conf
|
||||
# /etc/systemd/system/rpcbind.socket.d/override.conf
|
||||
215
roles/common/tasks/nis-install-server.yml
Normal file
215
roles/common/tasks/nis-install-server.yml
Normal file
@ -0,0 +1,215 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# Install nis
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain)
|
||||
template:
|
||||
dest: /etc/defaultdomain
|
||||
src: etc/defaultdomain.j2
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0644
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Install nis common packages
|
||||
package:
|
||||
name: "{{ item }}"
|
||||
state: present
|
||||
with_items: "{{ nis_common_packages }}"
|
||||
register: nis_installed
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/default/nis
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists
|
||||
stat:
|
||||
path: /etc/default/nis.ORIG
|
||||
register: default_nis_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/default/nis
|
||||
command: cp -a /etc/default/nis /etc/default/nis.ORIG
|
||||
when:
|
||||
- default_nis_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER' (server)
|
||||
replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISSERVER=.*'
|
||||
replace: 'NISSERVER=master'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (server)
|
||||
replace:
|
||||
path: /etc/default/nis
|
||||
regexp: '^NISCLIENT=.*'
|
||||
replace: 'NISCLIENT=false'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/ypserv.securenets
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists
|
||||
stat:
|
||||
path: /etc/ypserv.securenets.ORIG
|
||||
register: ypserv_securenets_orig_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets
|
||||
command: cp -a /etc/ypserv.securenets /etc/ypserv.securenets.ORIG
|
||||
when:
|
||||
- ypserv_securenets_orig_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-client.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets
|
||||
replace:
|
||||
path: /etc/ypserv.securenets
|
||||
regexp: '^(0.0.0.0\s+.*)'
|
||||
replace: '#\1'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file /etc/ypserv.securenets
|
||||
lineinfile:
|
||||
path: /etc/ypserv.securenets
|
||||
line: '255.255.0.0 192.168.0.0'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-client
|
||||
|
||||
- name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file /etc/ypserv.securenets
|
||||
lineinfile:
|
||||
path: /etc/ypserv.securenets
|
||||
line: '255.0.0.0 10.0.0.0'
|
||||
insertafter: EOF
|
||||
state: present
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m'
|
||||
shell: printf '\n' | /usr/lib/yp/ypinit -m
|
||||
when: nis_installed.changed
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# ---
|
||||
# Base directory containing users' home directory
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually /data/home) exists
|
||||
file:
|
||||
path: '{{ nis_base_home}}'
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
state: directory
|
||||
when:
|
||||
- "groups['nfs_server']|string is search(inventory_hostname)"
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# ---
|
||||
# /etc/adduser.conf
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists'
|
||||
stat:
|
||||
path: /etc/adduser.conf.ORIG
|
||||
register: adduser_conf_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /etc/adduser.conf
|
||||
command: cp -a /etc/adduser.conf /etc/adduser.conf.ORIG
|
||||
when:
|
||||
- adduser_conf_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file '/etc/adduser.conf' - set 'DHOME'
|
||||
replace:
|
||||
path: /etc/adduser.conf
|
||||
regexp: '^#?DHOME=.*'
|
||||
replace: 'DHOME={{ nis_base_home }}'
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# ---
|
||||
# /var/yp/Makefile
|
||||
# ---
|
||||
|
||||
- name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists'
|
||||
stat:
|
||||
path: /var/yp/Makefile.ORIG
|
||||
register: adduser_conf_exists
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Backup existing file /var/yp/Makefile
|
||||
command: cp -a /var/yp/Makefile /var/yp/Makefile.ORIG
|
||||
when:
|
||||
- adduser_conf_exists.stat.exists == False
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
- name: (nis-install-server.yml) Adjust file '/var/yp/Makefile'
|
||||
replace:
|
||||
path: /var/yp/Makefile
|
||||
regexp: '^#?{{ item }}=.*'
|
||||
replace: '{{ item }}=true'
|
||||
with_items:
|
||||
- MERGE_PASSWD
|
||||
- MERGE_GROUP
|
||||
notify:
|
||||
- Renew nis databases
|
||||
tags:
|
||||
- nis-install
|
||||
- nis-install-server
|
||||
|
||||
|
||||
# TODO:
|
||||
# /var/yp/Makefile
|
||||
121
roles/common/tasks/nis_samba_user.yml
Normal file
121
roles/common/tasks/nis_samba_user.yml
Normal file
@ -0,0 +1,121 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (nis_samba_user.yml) Check if samba user exists for removable nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_deleted_user_present
|
||||
changed_when: "samba_deleted_user_present.rc == 0"
|
||||
failed_when: "samba_deleted_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (nis_samba_user.yml) Remove (old) users from samba
|
||||
shell: "smbpasswd -s -x {{ item.name }}"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: samba_deleted_user_present is changed
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (nis_samba_user.yml) Remove (old) users from system
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_samba_user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (nis_samba_user.yml) Ensure nis groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: item.group_id is defined
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
|
||||
- name: (nis_samba_user.yml) Ensure nis users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
#group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups|join(', ') }}"
|
||||
home: '{{ nis_base_home }}/{{ item.name }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
password: "{{ item.password | password_hash('sha512') }}"
|
||||
update_password: on_create
|
||||
append: yes
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
|
||||
- name: (nis_samba_user.yml) Check if samba user exists for nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_nis_user_present
|
||||
changed_when: "samba_nis_user_present.rc > 0"
|
||||
failed_when: "samba_nis_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
- name: (nis_samba_user.yml) Add nis user to samba (with nis users password)
|
||||
shell: "echo -e '{{ item.password }}\n{{ item.password }}\n' | smbpasswd -s -a {{ item.name }}"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- samba_nis_user_present is changed
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
95
roles/common/tasks/nis_user.yml
Normal file
95
roles/common/tasks/nis_user.yml
Normal file
@ -0,0 +1,95 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Remove (old) users from system
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Remove home directory from deleted users
|
||||
file:
|
||||
path: '{{ nis_base_home }}/{{ item.name }}'
|
||||
state: absent
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (nis_user.yml) Ensure nis groups exists
|
||||
group:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
gid: '{{ item.group_id | default(omit) }}'
|
||||
loop: "{{ nis_groups }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: item.group_id is defined
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
#- meta: end_host
|
||||
|
||||
- name: (nis_user.yml) Check if nis (system) user exists
|
||||
shell: "getent passwd {{ item.name }}"
|
||||
register: nis_user_exists
|
||||
changed_when: "nis_user_exists.rc == 2"
|
||||
failed_when: "nis_user_exists.rc > 2"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
ignore_errors: true
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Add nis (system) users
|
||||
shell: "/root/bin/admin-stuff/add_new_user.sh {{ item.name }} '{{ item.password }}'"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: nis_user_exists is changed
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
- name: (nis_user.yml) Ensure nis users exists
|
||||
user:
|
||||
name: '{{ item.name }}'
|
||||
state: present
|
||||
uid: '{{ item.user_id | default(omit) }}'
|
||||
#group: '{{ item.0.name | default(omit) }}'
|
||||
groups: "{{ item.groups|join(', ') }}"
|
||||
home: '{{ nis_base_home }}/{{ item.name }}'
|
||||
shell: '{{ item.shell|d("/bin/bash") }}'
|
||||
password: "{{ item.password | password_hash('sha512') }}"
|
||||
update_password: on_create
|
||||
append: yes
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- nis-user
|
||||
- system-user
|
||||
|
||||
|
||||
60
roles/common/tasks/samba_user.yml
Normal file
60
roles/common/tasks/samba_user.yml
Normal file
@ -0,0 +1,60 @@
|
||||
---
|
||||
|
||||
# ---
|
||||
# - Remove unwanted users
|
||||
# ---
|
||||
|
||||
- name: (samba_user.yml) Check if samba user exists for removable nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_deleted_user_present
|
||||
changed_when: "samba_deleted_user_present.rc == 0"
|
||||
failed_when: "samba_deleted_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
- name: (samba_user.yml) Remove (old) users from samba
|
||||
shell: "smbpasswd -s -x {{ item.name }}"
|
||||
with_items:
|
||||
- "{{ nis_deleted_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when: samba_deleted_user_present is changed
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
|
||||
# ---
|
||||
# - default user/groups
|
||||
# ---
|
||||
|
||||
- name: (samba_user.yml) Check if samba user exists for nis user
|
||||
shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
|
||||
register: samba_nis_user_present
|
||||
changed_when: "samba_nis_user_present.rc > 0"
|
||||
failed_when: "samba_nis_user_present.rc > 1"
|
||||
with_items:
|
||||
- "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
- name: (samba_user.yml) Add nis user to samba (with nis users password)
|
||||
shell: "echo -e '{{ item.password }}\n{{ item.password }}\n' | smbpasswd -s -a {{ item.name }}"
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- samba_nis_user_present is changed
|
||||
notify: Renew nis databases
|
||||
tags:
|
||||
- samba-user
|
||||
|
||||
32
roles/common/tasks/sudoers.yml
Normal file
32
roles/common/tasks/sudoers.yml
Normal file
@ -0,0 +1,32 @@
|
||||
---
|
||||
|
||||
- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
|
||||
template:
|
||||
src: etc/sudoers.d/50-user.j2
|
||||
dest: /etc/sudoers.d/50-user
|
||||
validate: visudo -cf %s
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
tags:
|
||||
- sudoers-file-configuration
|
||||
|
||||
- name: (sudoers.yml) update global sudoers configuration file
|
||||
template:
|
||||
src: etc/sudoers.j2
|
||||
dest: /etc/sudoers
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0440
|
||||
validate: visudo -cf %s
|
||||
tags:
|
||||
- sudoers-global-configuration
|
||||
|
||||
- name: (sudoers.yml) Ensure all sudo_users are in sudo group
|
||||
user:
|
||||
name: "{{ item }}"
|
||||
groups: sudo
|
||||
append: yes
|
||||
with_items: "{{ sudo_users }}"
|
||||
tags:
|
||||
- sudo-users
|
||||
39
roles/common/tasks/user-systemfiles.yml
Normal file
39
roles/common/tasks/user-systemfiles.yml
Normal file
@ -0,0 +1,39 @@
|
||||
---
|
||||
|
||||
- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
|
||||
stat:
|
||||
path: "~{{ item.name }}/.profile.ORIG"
|
||||
register: profile_user_orig_exists
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Backup existing users .profile file
|
||||
command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
|
||||
loop: "{{ profile_user_orig_exists.results }}"
|
||||
loop_control:
|
||||
label: '{{ item.item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
- item.stat.exists == False
|
||||
tags:
|
||||
- profile
|
||||
|
||||
- name: (user-systemfiles.yml) Create new users .profile file
|
||||
template:
|
||||
src: user_homedirs/dot.profile.j2
|
||||
dest: "~{{ item.name }}/.profile"
|
||||
owner: "{{ item.name }}"
|
||||
group: "{{ item.name }}"
|
||||
mode: 0644
|
||||
loop: "{{ nis_user }}"
|
||||
loop_control:
|
||||
label: '{{ item.name }}'
|
||||
when:
|
||||
- item.is_samba_user is defined and item.is_samba_user|bool
|
||||
tags:
|
||||
- profile
|
||||
Reference in New Issue
Block a user