Changeset 14325 for main/waeup-ansible

Timestamp:

8 Dec 2016, 03:10:08 (8 years ago)

Author:

uli

Message:

Make bootstrap.yml really work.

This version of bootstrap.yml was played on a real, freshly
initialized Hetzner server. And worked.

It does not create a sudo-less deploy user any more, but different
admin users with password.

The main task of the play is still: securing and restarting SSH before
creating some non-root access.

File:

• main/waeup-ansible/bootstrap.yml (modified) (1 diff)

main/waeup-ansible/bootstrap.yml

@@ -3 +3 @@
 # servers for work with ansible.
 #
-# What it does:
-#   secures sshd (according to bettercrypto.org)
-#   adds accounts uli/henrik/deploy
-#   disables root access
+# It should be played as first thing after getting your hands over new
+# hardware
 #
-# This playbook should be executed as first thing
-# after getting your hands over new hardware
-#
-# It will normally be run with ``ask-pass``
+# The documentation for this playbook is in `README.rst`.  Please read
+# it! Do not run this playbook without having read the README.
 #
 - hosts: yet-untouched
+  become: yes
   vars:
-    deploy_user: 'deploy'
-    deploy_public_key: "{{ lookup('file', 'files/id-deploy.pub') }}"
+    # Enable root access via SSH? Set to false not before user
+    # accounts are active.
+    permit_ssh_root: true
+    # create hashed passwords like this:
+    #      $ diceware -d '-' -n 6 --no-caps | tee mypw | mkpasswd -s --method=sha-512 >> mypw
+    admin_users:
+      uli:
+        hashed_pw: "$6$W3DjhWuk/dDzw2F$ozaXblaUYnEX6NiS9jg.NYFelyPIV8ySxDJGNwbPpTd.oAnmA.754pntuGT1XP.cAcpkCI5b9zWSgOQ09f5HG1"
+
+  roles:
+  - openssh
+
+  handlers:
+  - name: "Restart sshd"
+    service:
+      name="ssh"
+      enabled=yes
+      state=restarted
 
   tasks:
-    - name: "bootstrap | update authorized key of 'deploy'"
-      authorized_key:
-        user="{{ deploy_user }}"
-        key="{{ deploy_public_key }}"
+  - name: Create admin users
+    user:
+      name: "{{ item.key }}"
+      shell: /bin/bash
+      groups: sudo
+      password: "{{ item.value.hashed_pw }}"
+      update_password: on_create
+      state: present
+    with_dict: "{{ admin_users }}"
 
-    - name: "bootstrap | grant sudoers perms to 'deploy'"
-      lineinfile:
-        dest=/etc/sudoers
-        insertafter="^root"
-        line="{{ deploy_user }}  ALL=(ALL) NOPASSWD{{ ':' }} ALL"
-        state=present
-
-  roles:
-    - openssh
-    - core
+  - name: Disable SSH root access
+    # make sure this is not run before you can log in otherwise!
+    lineinfile:
+      dest=/etc/ssh/sshd_config
+      backrefs=yes
+      line='PermitRootLogin no'
+      regexp='^PermitRootLogin yes'
+      state=present
+    notify: "restart sshd"
+    when: not permit_ssh_root