63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
---
|
|
|
|
- name: install libpam-csc
|
|
apt: name=libpam-csc state=latest
|
|
|
|
- name: install required aptitude packages
|
|
apt: name={{ item }} state=latest
|
|
with_items:
|
|
- krb5-user
|
|
- ldap-utils
|
|
- sssd
|
|
- sssd-tools
|
|
- kstart
|
|
- sudo
|
|
|
|
- name: install ubuntu sss pam and nss
|
|
apt: name={{ item }} state=latest
|
|
when: ansible_distribution == 'Ubuntu'
|
|
with_items:
|
|
- libnss-sss
|
|
- libpam-sss
|
|
|
|
- name: copy over auth and ssh configs
|
|
copy: src={{ item.src }} dest={{ item.dest }}
|
|
with_items:
|
|
- { src: 'krb5.conf', dest: '/etc/krb5.conf' }
|
|
- { src: 'ldap.conf', dest: '/etc/ldap/ldap.conf' }
|
|
- { src: 'sssd.conf', dest: '/etc/sssd/sssd.conf' }
|
|
- { src: 'sshd_config', dest: '/etc/ssh/sshd_config' }
|
|
- { src: 'ssh_config', dest: '/etc/ssh/ssh_config' }
|
|
- { src: 'GlobalSign_Intermediate_Root_SHA256_G2.pem', dest: '/etc/ssl/certs/GlobalSign_Intermediate_Root_SHA256_G2.pem' }
|
|
- { src: 'k5login', dest: '/root/.k5login' }
|
|
- { src: 'ssh_known_hosts', dest: '/etc/ssh/ssh_known_hosts' }
|
|
|
|
- name: make sssd.conf accessable only by root
|
|
file: path=/etc/sssd/sssd.conf owner=root group=root mode=0600
|
|
|
|
- name: configure PAM for syscom machine
|
|
when: "'syscom' in group_names"
|
|
blockinfile:
|
|
dest: /etc/pam.d/common-account
|
|
block: |
|
|
# make sure user is up to date, except system accounts and syscom
|
|
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
|
|
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
|
|
account required pam_deny.so
|
|
|
|
- name: configure PAM for regular machine
|
|
when: "'syscom' not in group_names"
|
|
blockinfile:
|
|
dest: /etc/pam.d/common-account
|
|
block: |
|
|
# make sure user is up to date, except system accounts and syscom
|
|
account [success=2 default=ignore] pam_succeed_if.so quiet uid < 10000
|
|
account [success=1 default=ignore] pam_succeed_if.so quiet user ingroup syscom
|
|
account required pam_csc.so
|
|
|
|
- name: restart services
|
|
service: name={{ item }} state=restarted
|
|
with_items:
|
|
- sssd
|
|
- ssh
|