4 {{ [ 'root' ] | union(user_groups.noc)
5 | union(sshd_allowusers_group | default([]))
6 | union(sshd_allowusers_host | default([])) }}
8 - name: only allow pubkey auth for root
10 dest: /etc/ssh/sshd_config
11 regexp: "^PermitRootLogin"
12 line: "PermitRootLogin without-password"
15 - name: limit allowed users (1/2)
16 when: sshd_allowgroup is not defined
18 dest: /etc/ssh/sshd_config
19 regexp: "^#?AllowUsers"
20 line: "AllowUsers {{ ' '.join(sshd_allowusers) }}"
24 - name: "limit allowed users (2/2): Make sure AllowUsers is not in sshd_config"
26 dest: /etc/ssh/sshd_config
31 - name: "limit allowed users (2/2): Set AllowGroups in sshd_config"
33 dest: /etc/ssh/sshd_config
34 regexp: "^#?AllowGroups"
35 line: AllowGroups {{ sshd_allowgroup }}
38 - name: "limit allowed users (2/2): Add allowed users to ssh group"
41 groups: "{{ sshd_allowgroup }}"
43 with_items: "{{ sshd_allowusers }}"
45 when: sshd_allowgroup is defined
47 - name: Set authorized keys for root user
50 key: "{{ ssh_users_root | user_ssh_keys(users) | join('\n') }}"
53 - name: disable apt suggests and recommends
56 dest: /etc/apt/apt.conf.d/
59 - name: install basic packages
86 - when: base_managed_ntpd
88 - name: check that ISC ntpd is not installed
94 - name: install openntpd
98 - name: configure openntpd
100 dest: /etc/openntpd/ntpd.conf
102 # Use the ffgraz.net NTP server
103 servers ntp.ffgraz.net weight 3
105 # Use some servers announced from the NTP Pool
106 servers 0.debian.pool.ntp.org
107 servers 1.debian.pool.ntp.org
109 notify: restart openntpd
112 - name: make sure grml-(etc|scripts)-core is not installed
121 - name: install systemd specific packages
128 - name: set systemd-related environment variables
130 src: xdg_runtime_dir.sh
131 dest: /etc/profile.d/xdg_runtime_dir.sh
134 when: ansible_service_mgr == "systemd"
137 - name: workaround console-setup race condition (1/2)
139 path: /etc/systemd/system/console-setup.service.d/
142 - name: workaround console-setup race condition (2/2)
144 content: "[Unit]\nAfter=systemd-tmpfiles-setup.service\n"
145 dest: /etc/systemd/system/console-setup.service.d/override.conf
147 # no need to relaod systemd here, it is only there to fix a boot-time race-condition
149 when: ansible_distribution == "Ubuntu"
151 - name: set root default shell to zsh
156 - name: set default shell for adduser
160 dest: /etc/adduser.conf
161 regexp: "^#?{{ item.key }}="
162 line: "{{ item.key }}={{ item.value }}"
164 - name: Deploy default configuration for tools
166 /etc/htoprc: "{{ global_files_dir }}/common/htoprc"
168 /etc/zsh/zprofile: zprofile
169 /etc/zsh/zshrc: zshrc
170 /etc/skel/.zshrc: zshrc.skel
173 label: "{{ item.key }}"
176 src: "{{ item.value }}"
177 dest: "{{ item.key }}"