Initial commit

roles/ansible_dependencies/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+
+- name: re-synchronize the package index files from their sources
+  raw: apt-get update
+  
+- name: Ensure aptitude is present
+  raw: test -e /usr/bin/aptitude || apt-get install aptitude -y
+
+- name: Ensure python2 is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python2 || (apt -y update && apt install -y python)
+
+- name: Ensure python-apt is present (This is necessary for ansible to work properly)
+  raw: test -e  /usr/bin/python2 && (apt -y update && apt install -y python-apt)
+
+- name: Ensure python3 is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3)
+
+- name: Ensure python-apt is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-apt)
+
+- name: apt upgrade
+  apt:
+    upgrade: dist
+    update_cache: true
+    dpkg_options: force-confdef,force-confold
+  tags:
+    - ansible-dependencies
+
+- name: apt install ansible dependencies
+  apt:
+    name: "{{ apt_ansible_dependencies }}"
+    state: latest
+  tags:
+    - ansible-dependencies
+

roles/ansible_user/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+
+- name: Ensure remote users for ansible exists
+  user:
+    name: '{{ item.name }}'
+    state: present
+    uid: '{{ item.user_id | default(omit) }}'
+    #group: '{{ item.name | default(omit) }}'
+    shell: '{{ item.shell|d("/bin/bash") }}'
+    password: "{{ item.password }}"
+    update_password: on_create
+  with_items: '{{ ansible_remote_user }}'
+  loop_control:
+    label: ' user "{{ item.name }}" exists'
+  tags:
+    - ansible-remote-user
+
+- name: Ensure ansible user is part of sudo group
+  user:
+    name: "{{ item.name }}"
+    groups: sudo
+    append: yes
+  with_items: "{{ ansible_remote_user }}"
+  loop_control:
+    label: ' user "{{ item.name }}" is part of sudo group'
+  tags:
+    - sudo-users
+
+- name: Ensure authorized_key files are present for ansible user
+  authorized_key:
+    user: "{{ item.name }}"
+    key: "{{ ssh_keys_admin|join('\n') }}"
+    state: present
+  with_items:
+    - '{{ ansible_remote_user }}'
+  loop_control:
+    label: ' authorized_key of user "{{ item.name }}" is present'
+  tags:
+    - authorized_key
+
+- name: Ensure authorized_key files are present for user root
+  authorized_key:
+    user: root
+    key: "{{ ssh_keys_admin|join('\n') }}"
+    state: present
+  tags:
+    - authorized_key
+

roles/common/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+
+- name: Renew nis databases
+  shell: make -C /var/yp
+  when: 
+    - "groups['nis_server']|string is search(inventory_hostname)"
+
+- name: Reload nfs
+  service:
+    name: nfs-kernel-server
+    state: reloaded
+    enabled: yes
+  when: 
+    - "groups['nfs_server']|string is search(inventory_hostname)"

roles/common/tasks/main.yml

@@ -0,0 +1,40 @@
+---
+
+
+# tags supported inside nfs.yml:
+#
+#    nfs-server
+#    nfs-client
+- import_tasks: nfs.yml
+  tags:
+    - nfs
+# tags supported inside nis_samba_user.yml:
+#
+#    samba-user
+#    nis-user
+#    system-user
+- import_tasks: nis_samba_user.yml
+  when: "groups['nis_server']|string is search(inventory_hostname)"
+  tags:
+    - nis-samba-user
+
+- import_tasks: user-systemfiles.yml
+  when: "groups['nis_server']|string is search(inventory_hostname)"
+  tags:
+    - user-systemfiles
+
+# tags supported inside sudoers.yml:
+#
+#   sudoers-remove
+#   sudoers-file-configuration
+#   sudoers-global-configuration
+- import_tasks: sudoers.yml
+  when: "groups['client_pc']|string is search(inventory_hostname)"
+  tags:
+    - sudoers
+
+- import_tasks: mount_samba_shares.yml
+  when: "groups['client_pc']|string is search(inventory_hostname)"
+  tags:
+    - samba-shares
+

roles/common/tasks/mount_samba_shares.yml

@@ -0,0 +1,28 @@
+---
+
+
+- name: (mount_samba_shares.yml) Ensure (user separated) base mount directories for samba shares exists
+  file:
+    path: "/mnt/{{ item.name }}"
+    owner: "{{ item.name }}"
+    group: "{{ item.name }}"
+    mode: '0700'
+    state: directory
+  with_items: "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when:
+    - item.is_samba_user is defined and item.is_samba_user|bool
+
+- name: (mount_samba_shares.yml) Ensure (user separated) mount directories for samba shares exists
+  file:
+    path: "/mnt/{{ item.1 }}/{{ item.0.name }}"
+    owner: "{{ item.1 }}"
+    group: "{{ item.1 }}"
+    mode: '0770'
+    state: directory
+  with_subelements: 
+    - "{{ samba_shares }}"
+    - user
+  loop_control:
+    label: '{{ item.1 }} share: {{ item.0.name }}'

roles/common/tasks/nfs.yml

@@ -0,0 +1,75 @@
+---
+
+# ---
+# NFS Server
+# ---
+
+- name: (nfs.yml) Ensure NFS utilities (server) are installed.
+  apt:
+    name:
+      - nfs-common
+      - nfs-kernel-server
+    state: present
+  when:
+    - ansible_os_family == "Debian"
+    - "groups['nfs_server']|string is search(inventory_hostname)"
+  tags:
+    - nfs-server
+
+- name: (nfs.yml) Ensure directories to export exist
+  file:
+    path: '{{ item.src.split(":")[1] }}'
+    owner: root
+    group: root
+    mode: '0755'
+    state: directory
+  with_items: "{{ nfs_exports }}"
+  when:
+    - "groups['nfs_server']|string is search(inventory_hostname)"
+  tags:
+    - nfs-server
+
+- name: (nfs.yml) Copy exports file.
+  template:
+    src: etc/exports.j2
+    dest: /etc/exports
+    owner: root
+    group: root
+    mode: 0644
+  when:
+    - "groups['nfs_server']|string is search(inventory_hostname)"
+  notify: Reload nfs
+  tags:
+    - nfs-server
+
+# ---
+# NFS clients
+# ---
+
+- name: (nfs.yml) Ensure NFS utilities (clients) are installed.
+  apt:
+    pkg: nfs-common
+    state: present
+  when: 
+    - ansible_os_family == "Debian"
+    - "groups['nfs_client']|string is search(inventory_hostname)"
+  tags:
+    - nfs-client
+
+- name: (nfs.yml) NFS Mount exports from nfs server
+  mount:
+    path: "{{ item.path }}"
+    src: "{{ item.src }}"
+    fstype: nfs
+    opts: "{{ item.mount_opts }}"
+    dump: "{{ item.dump | default(omit) }}"
+    passno: "{{ item.passno | default(omit) }}"
+    state: mounted
+  loop: "{{ nfs_exports }}"
+  when:
+    - "groups['nfs_client']|string is search(inventory_hostname)"
+  tags:
+    - nfs-client
+
+
+

roles/common/tasks/nis_samba_user.yml

@@ -0,0 +1,122 @@
+---
+
+# ---
+# - Remove unwanted users
+# ---
+
+- name: (nis_samba_user.yml) Check if samba user exists for removable nis user
+  shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
+  register: samba_deleted_user_present
+  changed_when: "samba_deleted_user_present.rc == 0"
+  failed_when: "samba_deleted_user_present.rc > 1"
+  with_items: 
+    - "{{ nis_deleted_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  tags:
+    - samba-user
+
+
+- name: (nis_samba_user.yml) Remove (old) users from samba
+  shell: "smbpasswd -s -x {{ item.name }}"
+  with_items: 
+    - "{{ nis_deleted_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when: samba_deleted_user_present is changed
+  tags:
+    - samba-user
+
+
+- name: (nis_samba_user.yml) Remove (old) users from system
+  user:
+    name: '{{ item.name }}'
+    state: absent
+  with_items: 
+    - "{{ nis_deleted_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  tags:
+    - nis-user
+    - system-user
+
+- name: (nis_samba_user.yml) Remove home directory from deleted users
+  file:
+    path: '{{ nis_base_home }}/{{ item.name }}'
+    state: absent
+  with_items: 
+    - "{{ nis_deleted_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  tags:
+    - nis-user
+    - system-user
+
+
+# ---
+# - default user/groups
+# ---
+
+- name: (nis_samba_user.yml) Ensure nis groups exists
+  group:
+    name: '{{ item.name }}'
+    state: present
+    gid: '{{ item.group_id | default(omit) }}'
+  loop: "{{ nis_groups }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when: item.group_id is defined
+  notify: Renew nis databases
+  tags:
+    - nis-user
+    - system-user
+    
+#- meta: end_host
+
+- name: (nis_samba_user.yml) Ensure nis users exists
+  user:
+    name: '{{ item.name }}'
+    state: present
+    uid: '{{ item.user_id | default(omit) }}'
+    #group: '{{ item.0.name | default(omit) }}'
+    groups: "{{ item.groups|join(', ') }}"
+    home: '{{ nis_base_home }}/{{ item.name }}'
+    shell: '{{ item.shell|d("/bin/bash") }}'
+    password: "{{ item.password | password_hash('sha512') }}"
+    update_password: on_create
+    append: yes
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  notify: Renew nis databases
+  tags:
+    - nis-user
+    - system-user
+
+
+- name: (nis_samba_user.yml) Check if samba user exists for nis user
+  shell: pdbedit -w -L | awk -F":" '{ print $1 }' | grep '{{ item.name }}'
+  register: samba_nis_user_present
+  changed_when: "samba_nis_user_present.rc > 0"
+  failed_when: "samba_nis_user_present.rc > 1"
+  with_items: 
+    - "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when:
+    - item.is_samba_user is defined and item.is_samba_user|bool
+  tags:
+    - samba-user
+
+- name: (nis_samba_user.yml) Add nis user to samba (with nis users password)
+  shell: "echo -e '{{ item.password }}\n{{ item.password }}\n' | smbpasswd -s -a {{ item.name }}"
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when: 
+    - item.is_samba_user is defined and item.is_samba_user|bool
+    - samba_nis_user_present is changed
+  notify: Renew nis databases
+  tags:
+    - samba-user
+

roles/common/tasks/sudoers.yml

@@ -0,0 +1,32 @@
+---
+
+- name: (sudoers.yml) update specific sudoers configuration files (/etc/sudoers.d/)
+  template:
+    src: etc/sudoers.d/50-user.j2
+    dest: /etc/sudoers.d/50-user
+    validate: visudo -cf %s
+    owner: root
+    group: root
+    mode: 0440
+  tags:
+    - sudoers-file-configuration
+
+- name: (sudoers.yml) update global sudoers configuration file
+  template:
+    src: etc/sudoers.j2
+    dest: /etc/sudoers
+    owner: root
+    group: root
+    mode: 0440
+    validate: visudo -cf %s
+  tags:
+    - sudoers-global-configuration
+
+- name: (sudoers.yml) Ensure all sudo_users are in sudo group
+  user:
+    name: "{{ item }}"
+    groups: sudo
+    append: yes
+  with_items: "{{ sudo_users }}"
+  tags:
+    - sudo-users

roles/common/tasks/user-systemfiles.yml

@@ -0,0 +1,39 @@
+---
+
+- name: (user-systemfiles.yml) Check if users file '.profile.ORIG' exists
+  stat:
+    path: "~{{ item.name }}/.profile.ORIG"
+  register: profile_user_orig_exists
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when: 
+    - item.is_samba_user is defined and item.is_samba_user|bool
+  tags:
+    - profile
+
+- name: (user-systemfiles.yml) Backup existing users .profile file
+  command: cp -a ~{{ item.item.name }}/.profile ~{{ item.item.name }}/.profile.ORIG
+  loop: "{{ profile_user_orig_exists.results }}"
+  loop_control:
+    label: '{{ item.item.name }}'
+  when:
+    - item.is_samba_user is defined and item.is_samba_user|bool
+    - item.stat.exists == False
+  tags:
+    - profile
+
+- name: (user-systemfiles.yml) Create new users .profile file
+  template:
+    src: user_homedirs/dot.profile.j2
+    dest: "~{{ item.name }}/.profile"
+    owner: "{{ item.name }}"
+    group: "{{ item.name }}"
+    mode: 0644
+  loop: "{{ nis_user }}"
+  loop_control:
+    label: '{{ item.name }}'
+  when:
+    - item.is_samba_user is defined and item.is_samba_user|bool
+  tags:
+    - profile

roles/common/templates/etc/exports.j2

@@ -0,0 +1,31 @@
+# {{ ansible_managed }}
+
+# /etc/exports: the access control list for filesystems which may be exported
+#   to NFS clients.  See exports(5).
+#
+# Example for NFSv2 and NFSv3:
+# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
+#
+# Example for NFSv4:
+# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
+# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
+#
+
+{% set count = namespace(nfs_exports=100) %}
+{% for export in nfs_exports %}
+
+{% set export_str= namespace(nfs_exports = export.src.split(":")[1]) %}
+
+{%    set count.nfs_exports = count.nfs_exports + 10 %}
+{%    for network in export.export_networks %}
+{%       if export.fs_encrypted is defined and export.fs_encrypted is sameas true %}
+{%          set export_str.nfs_exports = export_str.nfs_exports~" "~network~"("~export.export_opt~",fsid="~count.nfs_exports~")" %}
+#{{          export.src.split(":")[1] }} {{ network }}({{ export.export_opt }},fsid={{ count.nfs_exports }})
+{%       else %}
+{%          set export_str.nfs_exports = export_str.nfs_exports~" "~network~"("~export.export_opt~")" %}
+#{{          export.src.split(":")[1] }} {{ network }}({{ export.export_opt }})
+{%       endif %}
+{%    endfor %}
+
+{{ export_str.nfs_exports }}
+{% endfor %}

roles/common/templates/etc/sudoers.d/50-user.j2

@@ -0,0 +1,34 @@
+# {{ ansible_managed }}
+
+{% for item in sudoers_file_defaults | default([]) %}
+Defaults {{ item }}
+{% endfor %}
+
+# Host alias specification
+{% for item in sudoers_file_host_aliases | default([]) %}
+Host_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# User alias specification
+{% for item in sudoers_file_user_aliases | default([]) %}
+User_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# Cmnd alias specification
+{% for item in sudoers_file_cmnd_aliases | default([]) %}
+Cmnd_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# Runas alias specification
+{% for item in sudoers_file_runas_aliases | default([]) %}
+Runas_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# User privilege specification
+
+{# rules for nis users #}
+{% for item in nis_user | default([]) %}
+{{ item.name }}    ALL=(root)NOPASSWD: MOUNT
+{% endfor %}
+
+# Group privilege specification

roles/common/templates/etc/sudoers.j2

@@ -0,0 +1,56 @@
+# {{ ansible_managed }}
+
+# This file MUST be edited with the 'visudo' command as root.
+#
+# Please consider adding local content in /etc/sudoers.d/ instead of
+# directly modifying this file.
+#
+# See the man page for details on how to write a sudoers file.
+#
+{% for item in sudoers_defaults %}
+{% if item != '' %}
+Defaults {{ item }}
+{% endif %}
+{% endfor %}
+
+# Host alias specification
+{% for item in sudoers_host_aliases | default([]) %}
+Host_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# User alias specification
+{% for item in sudoers_user_aliases | default([]) %}
+User_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# Cmnd alias specification
+{% for item in sudoers_cmnd_aliases | default([]) %}
+Cmnd_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# Runas alias specification
+{% for item in sudoers_runas_aliases | default([]) %}
+Runas_Alias {{ item.name }} = {{ item.entry }}
+{% endfor %}
+
+# User privilege specification
+{% for item in sudoers_user_privileges | default([]) %}
+{{ item.name }} {{ item.entry }}
+{% endfor %}
+
+# Members of the admin group may gain root privileges
+%admin ALL=(ALL) ALL
+
+# Allow members of group sudo to execute any command
+%sudo ALL=(ALL:ALL) ALL
+
+# Group privilege specification
+
+{% for item in sudoers_group_privileges | default([]) %}
+{{ item.name }} {{ item.entry }}
+{% endfor %}
+
+# See sudoers(5) for more information on "#include" directives:
+
+#includedir /etc/sudoers.d
+

roles/common/templates/user_homedirs/dot.profile.j2

@@ -0,0 +1,126 @@
+# {{ ansible_managed }}
+
+# ~/.profile: executed by the command interpreter for login shells.
+# This file is not read by bash(1), if ~/.bash_profile or ~/.bash_login
+# exists.
+# see /usr/share/doc/bash/examples/startup-files for examples.
+# the files are located in the bash-doc package.
+
+# the default umask is set in /etc/profile; for setting the umask
+# for ssh logins, install and configure the libpam-umask package.
+#umask 022
+
+# if running bash
+if [ -n "$BASH_VERSION" ]; then
+    # include .bashrc if it exists
+    if [ -f "$HOME/.bashrc" ]; then
+   . "$HOME/.bashrc"
+    fi
+fi
+
+# set PATH so it includes user's private bin if it exists
+if [ -d "$HOME/bin" ] ; then
+    PATH="$HOME/bin:$PATH"
+fi
+
+# this is for the midnight-commander
+# to become the last directory the midnight commander was in
+# as the current directory when leaving the midnight commander
+#
+#. /usr/lib/mc/bin/mc.sh
+#
+if [ -f "/usr/share/mc/bin/mc.sh" ] ; then
+   source /usr/share/mc/bin/mc.sh
+fi
+
+export LANG="de_DE.utf8"
+
+# ---
+# Mmount samba shares
+# ---
+
+# Don't try to mount samba shares if login at samba server
+# 
+[[ "$(hostname --long)" = "{{ samba_server }}" ]] && return
+
+SERVER="{{ samba_server }}"
+USER="{{ item.name }}"
+PASSWORD='{{ item.password }}'
+VERSION="1.0"
+
+# Use NTLMv2 password hashing and force packet signing
+#
+#    SEC="ntlmv2i"
+#
+# Use NTLMv2 password hashing encapsulated in Raw NTLMSSP message, and force packet signing
+#
+#    SEC="ntlmsspi"
+#
+SEC="ntlmsspi"
+
+# - uid/guid of the user at fielserver
+# -
+_UID="$(id -u)"
+_GID="$(id -g)"
+
+
+# Logfile to see what happened..
+#
+_logfile=/tmp/profile_${USER}.log
+
+
+echo "" > $_logfile
+echo "$(date +"%Y-%m-%d-%H%M")" >> $_logfile
+
+# Network present
+#
+_network=false
+
+if [  "X$_addr" = "X" ] ; then
+   echo "no inet address assigned yet.." >> $_logfile
+   declare -i count=1
+   while  ! $_network && [[ $count -lt 5 ]] ; do
+      echo "sleeping 2 seconds.." >> $_logfile
+      sleep 2
+      _addr="$(hostname --ip-address)"
+      if [ "X$_addr" != "X" ] ; then
+         _network=true
+         echo "inet address present: $_addr" >> $_logfile
+      fi
+      ((count++))
+   done
+fi
+
+for dir in $(ls /mnt/$USER) ; do
+   MOUNT_POINT=/mnt/$USER/$dir
+   SHARE=$dir
+
+   [ ! -d $MOUNT_POINT ] && continue
+
+   if ! mount | grep $MOUNT_POINT > /dev/null ; then
+      echo "Going to mount share '${SHARE}' .." >> $_logfile
+      if [ -x /usr/bin/smb4k_mount ]; then
+         ## - Ubuntu <= 12.04
+         if [[ "$VERSION" = "1.0" ]]; then
+            sudo /usr/bin/smb4k_mount -o user=$USER,password=$PASSWORD,iocharset=utf8,vers=1.0 \
+               -n -t cifs //$SERVER/$SHARE $MOUNT_POINT >> $_logfile 2>&1
+         else
+            sudo /usr/bin/smb4k_mount -o user=$USER,password=$PASSWORD,iocharset=utf8,uid=$_UID,gid=$_GID,vers=$VERSION \
+               -n -t cifs //$SERVER/$SHARE $MOUNT_POINT >> $_logfile 2>&1
+         fi
+      else
+         ## - Ubuntu Version >= 14.04
+         if [[ "$VERSION" = "1.0" ]]; then
+            sudo /bin/mount -o user=$USER,password=$PASSWORD,iocharset=utf8,cifsacl,vers=$VERSION \
+               -n -t cifs //$SERVER/$SHARE $MOUNT_POINT >> $_logfile 2>&1
+         else
+            sudo /bin/mount -o user=$USER,password=$PASSWORD,iocharset=utf8,cifsacl,uid=$USER,sec=${SEC},vers=$VERSION \
+               -n -t cifs //$SERVER/$SHARE $MOUNT_POINT >> $_logfile 2>&1
+         fi
+      fi
+   else
+      echo "mount point $MOUNT_POINT already exists. nothing left to do.." >> $_logfile
+   fi
+
+done
+