CSC Ansible Playbooks
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ansible-playbooks/roles/auth/tasks/main.yml

62 lines
2.1 KiB

---
- name: install libpam-csc
apt: name=libpam-csc state=latest
- name: install required aptitude packages
apt: name={{ item }} state=latest
with_items:
- krb5-user
- ldap-utils
- sssd
- sssd-tools
- kstart
- name: install ubuntu sss pam and nss
apt: name={{ item }} state=latest
when: ansible_distribution == 'Ubuntu'
with_items:
- libnss-sss
- libpam-sss
- name: copy over auth and ssh configs
copy: src={{ item.src }} dest={{ item.dest }}
with_items:
- { src: 'krb5.conf', dest: '/etc/krb5.conf' }
- { src: 'ldap.conf', dest: '/etc/ldap/ldap.conf' }
- { src: 'sssd.conf', dest: '/etc/sssd/sssd.conf' }
- { src: 'sshd_config', dest: '/etc/ssh/sshd_config' }
- { src: 'ssh_config', dest: '/etc/ssh/ssh_config' }
- { src: 'GlobalSign_Intermediate_Root_SHA256_G2.pem', dest: '/etc/ssl/certs/GlobalSign_Intermediate_Root_SHA256_G2.pem' }
- { src: 'k5login', dest: '/root/.k5login' }
- { src: 'ssh_known_hosts', dest: '/etc/ssh/ssh_known_hosts' }
- name: make sssd.conf accessable only by root
file: path=/etc/sssd/sssd.conf owner=root group=root mode=0600
- name: configure PAM for syscom machine
when: syscom
blockinfile:
dest: /etc/pam.d/common-account
block: |
# make sure user is up to date, except system accounts and syscom
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
account required pam_deny.so
- name: configure PAM for regular machine
when: not syscom
blockinfile:
dest: /etc/pam.d/common-account
block: |
# make sure user is up to date, except system accounts and syscom
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
account required pam_csc.so
- name: restart services
service: name={{ item }} state=restarted
with_items:
- sssd
- ssh