ansible/roles/base/tasks/main.yaml

   1 ---
   2 - name: only allow pubkey auth for root
   3   lineinfile:
   4      dest: /etc/ssh/sshd_config
   5      regexp: "^PermitRootLogin"
   6      line: "PermitRootLogin without-password"
   7   notify: restart ssh
   8
   9 - name: limit allowed users (1/2)
  10   lineinfile:
  11      dest: /etc/ssh/sshd_config
  12      regexp: "^AllowUsers"
  13      line: "AllowUsers {{ ' '.join([ 'root' ] | union(sshd_allowusers_group | default([])) | union(sshd_allowusers_host | default([]))) }}"
  14   when: sshd_allowusers_set | default(true)
  15   notify: restart ssh
  16
  17 - name: limit allowed users (2/2)
  18   lineinfile:
  19      dest: /etc/ssh/sshd_config
  20      regexp: "^AllowUsers"
  21      state: absent
  22   when: not sshd_allowusers_set | default(true)
  23   notify: restart ssh
  24
  25 - name: Set authorized keys for root user
  26   authorized_key:
  27     user: root
  28     key: "{{ lookup('pipe','cat ssh/noc/*.pub') }}"
  29     exclusive: yes
  30
  31 - name: disable apt suggests and recommends
  32   copy: src=02no-recommends dest=/etc/apt/apt.conf.d/ mode=0644
  33
  34 - name: install basic packages
  35   apt: name={{ item }} state=present
  36   with_items:
  37     - less
  38     - psmisc
  39     - sudo
  40     - htop
  41     - dstat
  42     - mtr-tiny
  43     - tcpdump
  44     - debian-goodies
  45     - lsof
  46     - haveged
  47     - net-tools
  48     - ntp
  49     - screen
  50     - aptitude
  51     - unp
  52     - ca-certificates
  53     - file
  54     - zsh
  55     - python-apt
  56
  57 - name: install systemd specific packages
  58   apt: name={{ item }} state=present
  59   with_items:
  60     - dbus
  61     - libpam-systemd
  62   when: ansible_service_mgr == "systemd"
  63
  64 - name: install zshrc
  65   copy: src={{ item.src }} dest={{ item.dest }} mode=0640
  66   with_items:
  67     - { "src": "zshrc", "dest": "/etc/zsh/zshrc" }
  68     - { "src": "zshrc.skel", "dest": "/etc/skel/.zshrc" }
  69
  70 - name: set root default shell to zsh
  71   user: name=root shell=/bin/zsh
  72
  73 - name: set default shell for adduser
  74   lineinfile: dest=/etc/adduser.conf regexp={{ item.regexp }} line={{ item.line }}
  75   with_items:
  76     - { regexp: "^DSHELL", line: "DSHELL=/bin/zsh" }