ansible/roles/base/tasks/main.yml

   1 ---
   2 - set_fact:
   3     sshd_allowusers: >-
   4       {{ [ 'root' ] | union(user_groups.noc)
   5                     | union(sshd_allowusers_group | default([]))
   6                     | union(sshd_allowusers_host  | default([])) }}
   7
   8 - name: only allow pubkey auth for root
   9   lineinfile:
  10     dest: /etc/ssh/sshd_config
  11     regexp: "^PermitRootLogin"
  12     line: "PermitRootLogin without-password"
  13   notify: restart ssh
  14
  15 - name: limit allowed users (1/2)
  16   when: sshd_allowgroup is not defined
  17   lineinfile:
  18     dest: /etc/ssh/sshd_config
  19     regexp: "^#?AllowUsers"
  20     line: "AllowUsers {{ ' '.join(sshd_allowusers) }}"
  21   notify: restart ssh
  22
  23 - block:
  24     - name: "limit allowed users (2/2): Make sure AllowUsers is not in sshd_config"
  25       lineinfile:
  26         dest: /etc/ssh/sshd_config
  27         regexp: "^AllowUsers"
  28         state: absent
  29       notify: restart ssh
  30
  31     - name: "limit allowed users (2/2): Set AllowGroups in sshd_config"
  32       lineinfile:
  33         dest: /etc/ssh/sshd_config
  34         regexp: "^#?AllowGroups"
  35         line: AllowGroups {{ sshd_allowgroup }}
  36       notify: restart ssh
  37
  38     - name: "limit allowed users (2/2): Add allowed users to ssh group"
  39       user:
  40         name: "{{ item }}"
  41         groups: "{{ sshd_allowgroup }}"
  42         append: True
  43       with_items: "{{ sshd_allowusers }}"
  44
  45   when: sshd_allowgroup is defined
  46
  47 - name: Set authorized keys for root user
  48   authorized_key:
  49     user: root
  50     key: "{{ noc_ssh_keys | join('\n') }}"
  51     exclusive: yes
  52
  53 - name: disable apt suggests and recommends
  54   copy:
  55     src: 02no-recommends
  56     dest: /etc/apt/apt.conf.d/
  57     mode: 0644
  58
  59 - name: install basic packages
  60   apt:
  61     name:
  62       - less
  63       - psmisc
  64       - sudo
  65       - htop
  66       - dstat
  67       - mtr-tiny
  68       - tcpdump
  69       - debian-goodies
  70       - lsof
  71       - haveged
  72       - net-tools
  73       - screen
  74       - aptitude
  75       - unp
  76       - ca-certificates
  77       - file
  78       - nano
  79       - zsh
  80       - python-apt
  81     state: present
  82
  83 - when: base_managed_ntpd
  84   block:
  85     - name: check that ISC ntpd is not installed
  86       apt:
  87         name: ntp
  88         state: absent
  89         purge: yes
  90
  91     - name: install openntpd
  92       apt:
  93         name: openntpd
  94
  95     - name: configure openntpd
  96       copy:
  97         dest: /etc/openntpd/ntpd.conf
  98         content: |
  99           # Use the ffgraz.net NTP server
 100           servers ntp.ffgraz.net weight 3
 101
 102           # Use some servers announced from the NTP Pool
 103           servers 0.debian.pool.ntp.org
 104           servers 1.debian.pool.ntp.org
 105
 106       notify: restart openntpd
 107
 108
 109 - name: make sure grml-(etc|scripts)-core is not installed
 110   apt:
 111     name:
 112       - grml-etc-core
 113       - grml-scripts-core
 114     state: absent
 115     purge: yes
 116
 117 - block:
 118     - name: install systemd specific packages
 119       apt:
 120         name:
 121           - dbus
 122           - libpam-systemd
 123         state: present
 124
 125     - name: set systemd-related environment variables
 126       copy:
 127         src: xdg_runtime_dir.sh
 128         dest: /etc/profile.d/xdg_runtime_dir.sh
 129         mode: 0644
 130
 131   when: ansible_service_mgr == "systemd"
 132
 133 - block:
 134     - name: workaround console-setup race condition (1/2)
 135       file:
 136         path: /etc/systemd/system/console-setup.service.d/
 137         state: directory
 138
 139     - name: workaround console-setup race condition (2/2)
 140       copy:
 141         content: "[Unit]\nAfter=systemd-tmpfiles-setup.service\n"
 142         dest: /etc/systemd/system/console-setup.service.d/override.conf
 143         mode: 0644
 144       # no need to relaod systemd here, it is only there to fix a boot-time race-condition
 145
 146   when: ansible_distribution == "Ubuntu"
 147
 148 - name: install zshrc
 149   with_items:
 150     - src: "zprofile"
 151       dest: "/etc/zsh/zprofile"
 152     - src: "zshrc"
 153       dest: "/etc/zsh/zshrc"
 154     - src: "zshrc.skel"
 155       dest: "/etc/skel/.zshrc"
 156   copy:
 157     src: "{{ item.src }}"
 158     dest: "{{ item.dest }}"
 159     mode: 0644
 160
 161 - name: set root default shell to zsh
 162   user:
 163     name: root
 164     shell: /bin/zsh
 165
 166 - name: set default shell for adduser
 167   with_dict:
 168     DSHELL: /bin/zsh
 169   lineinfile:
 170     dest: /etc/adduser.conf
 171     regexp: "^#?{{ item.key }}="
 172     line: "{{ item.key }}={{ item.value }}"