- group 'sftpusers' (GID 200 or next free), sshd drop-in
/etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h,
ForceCommand internal-sftp), PasswordAuthentication via
'sftp_password_authentication'
- new sftp users (UID 201 or next free) with root owned chroot home,
upload dir and root owned authorized_keys (always created)
- existing users (e.g. www-data, suexec users) can be added to the group;
chroot requirements of their home are checked, not changed
- passwords: update_password defaults to 'always', password of users with
shell access is never changed
- controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd'
- add empty sftpd section to all host_vars *-common.yml
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Previously an unreadable file (e.g. /etc/ipt-firewall is 0750 after the
role ran) silently produced almost empty host_vars. The script now exits
with an error and writes nothing. --from-dir reads the conf files from a
local directory, e.g. fetched with ansible using the vaulted become
password.
Add host_vars for cl-test.oopen.de (fw_manage_config: true).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Created `wiki-common.yml` for wiki.cadus.org with DNS settings and git repository configurations.
- Added `www-common.yml` for www.oopen.de including SFTP group creation and root user password.
- Introduced `zapata-alt-common.yml` for zapata-alt.opp.netz with network interface configurations, Samba user reorganize 'host_vars'
chrisandClaude Opus 5.5