93 lines
2.5 KiB
YAML
93 lines
2.5 KiB
YAML
# code: language=ansible
|
|
|
|
- name: Ensure sudo is installed
|
|
community.general.pacman:
|
|
name:
|
|
- sudo
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create the sudo group
|
|
ansible.builtin.group:
|
|
local: false
|
|
name: sudo
|
|
state: present
|
|
system: true
|
|
|
|
- name: Get target users current groups
|
|
ansible.builtin.getent:
|
|
database: group
|
|
split: ':'
|
|
register: sudoers_user_groups_result
|
|
|
|
- name: Set empty sudoers_user_target_groups
|
|
ansible.builtin.set_fact:
|
|
sudoers_user_target_groups: []
|
|
|
|
- name: Loop group list and select groups containing sudoer user
|
|
when:
|
|
- sudoers_user in sudoers_user_groups_result.ansible_facts.getent_group[item]
|
|
ansible.builtin.set_fact:
|
|
sudoers_user_target_groups: "{{ sudoers_user_target_groups + [item] }}"
|
|
loop: "{{ sudoers_user_groups_result.ansible_facts.getent_group.keys() | list }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
|
|
- name: Filter sudoers_user_target_groups for wheel and users groups, and ensure it contains sudo group
|
|
ansible.builtin.set_fact:
|
|
sudoers_user_target_groups: "{{ ((sudoers_user_target_groups | difference(['wheel', 'users'])) + ['sudo']) | unique }}"
|
|
|
|
- name: Add user to sudo group and remove from wheel/users
|
|
ansible.builtin.user:
|
|
append: false
|
|
comment: "{{ sudoers_user_comment }}"
|
|
groups: "{{ sudoers_user_target_groups }}"
|
|
local: false
|
|
name: "{{ sudoers_user }}"
|
|
state: present
|
|
|
|
- name: Add main root sudoers entry
|
|
community.general.sudoers:
|
|
commands:
|
|
- ALL
|
|
defaults:
|
|
- '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
|
|
group: sudo
|
|
host: "{{ inventory_hostname_short }}"
|
|
name: sudo_root
|
|
nopassword: false
|
|
runas: root
|
|
state: present
|
|
sudoers_path: "/etc/sudoers.d"
|
|
validation: required
|
|
|
|
- name: Add become unpriviligeed users sudoers entries
|
|
community.general.sudoers:
|
|
commands:
|
|
- ALL
|
|
defaults:
|
|
- '!fqdn' # Ensures using shortname only when assessing hostname in sudo rule
|
|
group: sudo
|
|
host: "{{ inventory_hostname_short }}"
|
|
name: sudo_{{ item }}
|
|
nopassword: true
|
|
runas: "{{ item }}"
|
|
state: present
|
|
sudoers_path: "/etc/sudoers.d"
|
|
validation: required
|
|
loop: "{{ unprivileged_users }}"
|
|
|
|
- name: Remove default sudoers file
|
|
ansible.builtin.file:
|
|
path: /etc/sudoers.d/90-cloud-init-users
|
|
state: absent
|
|
|
|
- name: Disable root login
|
|
ansible.builtin.user:
|
|
expires: 0
|
|
name: root
|
|
password: '!'
|
|
password_lock: true
|
|
shell: /usr/bin/nologin
|
|
state: present
|