70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
---
|
|
# Create the administrative user, install its SSH key, enforce password
|
|
# policy, and lock the root account.
|
|
|
|
- name: Create the administrative user
|
|
ansible.builtin.user:
|
|
name: "{{ admin_user }}"
|
|
groups: wheel
|
|
append: true
|
|
create_home: true
|
|
home: "/home/{{ admin_user }}"
|
|
shell: /bin/bash
|
|
comment: "Minecraft server administrator"
|
|
password: "{{ admin_user_password_hash | default('!') }}"
|
|
password_expire_max: "{{ auth_password_max_days }}"
|
|
password_expire_min: "{{ auth_password_min_days }}"
|
|
state: present
|
|
|
|
- name: Install the admin user's SSH public key
|
|
ansible.builtin.authorized_key:
|
|
user: "{{ admin_user }}"
|
|
state: present
|
|
key: "{{ admin_user_ssh_key }}"
|
|
when: admin_user_ssh_key | length > 0
|
|
|
|
- name: Allow the admin user passwordless sudo
|
|
ansible.builtin.copy:
|
|
content: "{{ admin_user }} ALL=(ALL) NOPASSWD: ALL\n"
|
|
dest: "/etc/sudoers.d/{{ admin_user }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0440"
|
|
validate: /usr/sbin/visudo -cf %s
|
|
|
|
- name: Enforce password complexity settings
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/security/pwquality.conf
|
|
regexp: '^#?\s*{{ item.key }}\s*='
|
|
line: "{{ item.key }} = {{ item.value }}"
|
|
loop:
|
|
- { key: minlen, value: "{{ auth_minlen }}" }
|
|
- { key: dcredit, value: "{{ auth_dcredit }}" }
|
|
- { key: ucredit, value: "{{ auth_ucredit }}" }
|
|
- { key: lcredit, value: "{{ auth_lcredit }}" }
|
|
- { key: ocredit, value: "{{ auth_ocredit }}" }
|
|
|
|
- name: Enforce global password aging defaults
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/login.defs
|
|
regexp: '^PASS_MAX_DAYS\s+'
|
|
line: "PASS_MAX_DAYS {{ auth_password_max_days }}"
|
|
|
|
- name: Enforce minimum days between password changes
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/login.defs
|
|
regexp: '^PASS_MIN_DAYS\s+'
|
|
line: "PASS_MIN_DAYS {{ auth_password_min_days }}"
|
|
|
|
- name: Enforce password change warning
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/login.defs
|
|
regexp: '^PASS_WARN_AGE\s+'
|
|
line: "PASS_WARN_AGE {{ auth_password_warn_age }}"
|
|
|
|
- name: Lock the root account's password
|
|
ansible.builtin.user:
|
|
name: root
|
|
password: '!'
|
|
state: present
|
|
when: auth_lock_root_password | bool |