blob: d78b4de384b79d6b94702016c886e00f7b0f7ec1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
- hosts: vms
become: true
tasks:
- name: Install required packages
ansible.builtin.apt:
pkg:
- krb5-user
- sssd-krb5
- sssd-tools
- libsss-sudo
- ldap-utils
- libldap-common
- name: Install sudo-ldap
apt: name=sudo-ldap state=present
environment:
SUDO_FORCE_REMOVE: "yes"
- name: Configuring krb5.conf
when: inventory_hostname != "ldap.pantheon.lab.mpgn.dev"
template:
src: templates/etc/krb5.j2
dest: /etc/krb5.conf
owner: root
group: root
mode: 0644
- name: Configuring ldap.conf
template:
src: templates/etc/ldap/ldap.conf.j2
dest: /etc/ldap/ldap.conf
owner: root
group: root
mode: 0644
- name: Check that the keytab exists
stat:
path: /etc/krb5.keytab
register: keytab_exists
- name: Generate kerberos keytab
when: not keytab_exists.stat.exists
shell: |
kadmin -p "{{ kerberos_user }}" -w "{{ kerberos_password }}" addprinc -x containerdn=ou=machines,dc=lab,dc=mpgn,dc=dev -randkey host/{{ inventory_hostname }}@LAB.MPGN.DEV
kadmin -p "{{ kerberos_user }}" -w "{{ kerberos_password }}" ktadd -k /etc/krb5.keytab host/{{ inventory_hostname }}@LAB.MPGN.DEV
chown root:root /etc/krb5.keytab
chmod 0600 /etc/krb5.keytab
- name: Configuring sssd.conf
template:
src: templates/etc/sssd/sssd.conf.j2
dest: /etc/sssd/sssd.conf
owner: root
group: root
mode: 0600
- name: Remove motd
ansible.builtin.file:
path: /etc/motd
state: absent
- name: Edit /etc/nsswitch.conf to enable sss sudo
lineinfile:
path: /etc/nsswitch.conf
regexp: 'sudoers: files ldap'
line: 'sudoers: files sss'
backrefs: yes
- name: Configuring /etc/ssh/sshd_config
template:
src: templates/etc/ssh/sshd_config.j2
dest: /etc/ssh/sshd_config
owner: root
group: root
mode: 0644
- name: Configuring /etc/ssh/ssh_config.d/kerberos.conf
template:
src: templates/etc/ssh/ssh_config.d/kerberos.conf.j2
dest: /etc/ssh/ssh_config.d/kerberos.conf
owner: root
group: root
mode: 0644
- name: Restart the ssh service
ansible.builtin.service:
name: "sshd"
state: restarted
enabled: true
- name: Start and enable sssd
ansible.builtin.service:
name: "sssd"
state: restarted
enabled: true
- name: Enable homedir
shell: pam-auth-update --enable mkhomedir
|
