100 lines
2.9 KiB
YAML
100 lines
2.9 KiB
YAML
---
|
|
- name: Ensure SSH Directory exists
|
|
ansible.builtin.file:
|
|
path: "/home/{{ user }}/.ssh"
|
|
state: directory
|
|
group: "{{ user }}"
|
|
owner: "{{ user }}"
|
|
mode: "0700"
|
|
|
|
- name: Ensure authorized_keys file exists
|
|
ansible.builtin.copy:
|
|
content: ""
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
force: false
|
|
group: "{{ user }}"
|
|
owner: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
- name: Check Terminus public key
|
|
ansible.builtin.shell: "grep -c \"{{ terminus_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: terminuskey_test
|
|
changed_when: false
|
|
|
|
- name: Add Terminus public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ terminus_key }}"
|
|
when: terminuskey_test.stdout == "0"
|
|
|
|
- name: Check clair public key
|
|
ansible.builtin.shell: "grep -c \"{{ clair_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: clairkey_test
|
|
changed_when: false
|
|
|
|
- name: Add clair public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ clair_key }}"
|
|
when: clairkey_test.stdout == "0"
|
|
|
|
- name: Check Anjin public key
|
|
ansible.builtin.shell: "grep -c \"{{ anjin_key }}\" /home/{{ user }}/.ssh/authorized_keys || true"
|
|
register: anjin_key_test
|
|
changed_when: false
|
|
|
|
- name: Add Anjin public key
|
|
ansible.builtin.lineinfile:
|
|
dest: "/home/{{ user }}/.ssh/authorized_keys"
|
|
line: "{{ anjin_key }}"
|
|
when: anjin_key_test.stdout == "0"
|
|
|
|
- name: Update the sshd config file to disable password logins
|
|
ansible.builtin.replace:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "(\\s+)#PasswordAuthentication yes(\\s+.*)?$"
|
|
replace: "\\1PasswordAuthentication no\\2"
|
|
backup: true
|
|
|
|
- name: Check if .ssh config file exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/config"
|
|
register: config_status
|
|
|
|
- name: No need to upload the .ssh config
|
|
when: config_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to upload the .ssh config as it already exists.
|
|
|
|
- name: Upload the .ssh config file
|
|
when: not config_status.stat.exists
|
|
ansible.builtin.template:
|
|
src: "files/config"
|
|
dest: "/home/{{ user }}/.ssh/config"
|
|
group: "{{ user }}"
|
|
owner: "{{ user }}"
|
|
mode: "0644"
|
|
|
|
- name: Check if ed25519 key exists
|
|
ansible.builtin.stat:
|
|
path: "/home/{{ user }}/.ssh/id_ed25519"
|
|
register: key_status
|
|
|
|
- name: No need to generate new ed25519 key
|
|
when: key_status.stat.exists
|
|
ansible.builtin.debug:
|
|
msg: No need to generate new ed25519 key as it already exists.
|
|
|
|
- name: Generate new id_ed25519 key
|
|
when: not key_status.stat.exists
|
|
become: true
|
|
become_user: "{{ user }}"
|
|
ansible.builtin.shell: ssh-keygen -t ed25519 -q -f "/home/{{ user }}/.ssh/id_ed25519" -C "{{ user }}@{{ hostname }} $(date '+%Y.%m.%d')" -N ""
|
|
changed_when: true
|
|
|
|
- name: Adding user to group lp (line printers)
|
|
ansible.builtin.user:
|
|
name: "{{ user }}"
|
|
groups: lp
|
|
append: true
|