volker.raschekandCopilot
c3f714a7c6
Recreating /etc/sudoers.d on every run deleted every drop-in file on the host, not only the ones managed by this role. That removes files shipped by packages or other tooling, such as 90-cloud-init-users on cloud instances, which can lock out the remaining login paths. The task also reported changed on every run and therefore made check mode and CI runs useless for detecting real drift. The directory is now only ensured with its owner, group and permissions. To keep entries removable, each item of sudo_users_sudoers accepts an optional state, which is passed to community.general.sudoers and defaults to present. BREAKING CHANGE: Entries dropped from sudo_users_sudoers are no longer deleted implicitly. Set state: absent on the entry to remove its drop-in file. Co-authored-by: Copilot <copilot@github.com>
105 lines
3.6 KiB
YAML
105 lines
3.6 KiB
YAML
---
|
|
|
|
- name: Include OS-specific variables
|
|
ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
|
|
vars:
|
|
params:
|
|
files:
|
|
- "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
|
|
- "{{ ansible_facts['distribution'] }}.yaml"
|
|
- "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
|
|
- "{{ ansible_facts['os_family'] }}.yaml"
|
|
- main.yaml
|
|
paths:
|
|
- vars
|
|
|
|
- name: Verify variables
|
|
ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
|
|
vars:
|
|
params:
|
|
files:
|
|
- "{{ ansible_facts['distribution'] }}_verify_vars.yaml"
|
|
- "{{ ansible_facts['os_family'] }}_verify_vars.yaml"
|
|
- verify_vars.yaml
|
|
paths:
|
|
- tasks
|
|
|
|
- name: Install sudo
|
|
ansible.builtin.package:
|
|
name: "{{ item }}"
|
|
state: present
|
|
with_items: "{{ sudo_users_package_names }}"
|
|
|
|
- name: Enable includedir directive
|
|
ansible.builtin.lineinfile:
|
|
dest: /etc/sudoers
|
|
state: present
|
|
regexp: "^(#)+(\\s)*includedir(\\s)*/etc/sudoers.d"
|
|
line: "#includedir /etc/sudoers.d"
|
|
validate: 'visudo --check --file %s'
|
|
mode: "0440"
|
|
owner: "root"
|
|
group: "root"
|
|
|
|
- name: Create drop-in directory of sudoers
|
|
ansible.builtin.file:
|
|
state: directory
|
|
path: "/etc/sudoers.d"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: "0750"
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix users"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.user) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
user: "{{ item.user }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user is defined and item.user | length > 0 and
|
|
item.group is not defined and
|
|
item.runas is not defined
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix users as specific unix user"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.user) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
user: "{{ item.user }}"
|
|
runas: "{{ item.runas }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user is defined and item.user | length > 0 and
|
|
item.group is not defined and
|
|
item.runas is defined and item.runas | length > 0
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix groups"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.group) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
group: "{{ item.group }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user is not defined and
|
|
item.group is defined and item.group | length > 0 and
|
|
item.runas is not defined
|
|
|
|
- name: "Create sudoers drop-in file to execute commands for specific unix groups as specifix unix user"
|
|
community.general.sudoers:
|
|
name: "{{ item.filename | default(item.group) }}"
|
|
state: "{{ item.state | default('present') }}"
|
|
group: "{{ item.group }}"
|
|
runas: "{{ item.runas }}"
|
|
nopassword: "{{ item.nopassword | default(false) }}"
|
|
commands: "{{ item.commands | default('ALL') }}"
|
|
with_items:
|
|
- "{{ sudo_users_sudoers }}"
|
|
when: item.user is not defined and
|
|
item.group is defined and item.group | length > 0 and
|
|
item.runas is defined and item.runas | length > 0
|