ansible/playbooks/00_install_ldap_client.yml

- hosts: datacenter
  name: Install omv
  become: true
  gather_facts: no
  tasks:
    - name: Install ldap packages
      ansible.builtin.apt:
        name: 
          - libpam-ldapd
          - ldap-utils
          - libnss-ldapd
    # - name: Reconfigure ldap base
    #   ansible.builtin.lineinfile:
    #     path: /etc/ldap.conf
    #     regexp: "^base "
    #     line: "base dc=sectorq,dc=eu"

    # - name: Reconfigure ldap uri
    #   ansible.builtin.lineinfile:
    #     path: /etc/ldap.conf
    #     regexp: "^uri ldap.*"
    #     line: "uri ldaps://ldap-server.loc/"
    # - name: Reconfigure ldap version
    #   ansible.builtin.lineinfile:
    #     path: /etc/ldap.conf
    #     regexp: "^ldap_version.*"
    #     line: "ldap_version 3"

    # - name: Reconfigure ldap rootbinddn
    #   ansible.builtin.lineinfile:
    #     path: /etc/ldap.conf
    #     regexp: "^rootbinddn.*"
    #     line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
    - name: Reconfigure common-session
      ansible.builtin.lineinfile:
        path: /etc/pam.d/common-session
        regexp: "^session optional pam_mkhomedir.so.*"
        line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
    - name: Reconfigure common-session
      ansible.builtin.lineinfile:
        path: /etc/pam.d/common-session
        regexp: "^session.*pam_ldap.so.*"
        line: "session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000"      
    - name: Reconfigure common-password
      ansible.builtin.lineinfile:
        path: /etc/pam.d/common-password
        regexp: "^password.*success=1 user_unknown=ignore default=die.*"
        line: "password        [success=1 default=ignore]     pam_ldap.so minimum_uid=1000 try_first_pass"
    - name: Reconfigure nsswitch passwd
      ansible.builtin.lineinfile:
        path: /etc/nsswitch.conf
        regexp: "^passwd:.*"
        line: "passwd:         compat systemd ldap"
    - name: Reconfigure nsswitch group
      ansible.builtin.lineinfile:
        path: /etc/nsswitch.conf
        regexp: "^group:.*"
        line: "group:          compat systemd ldap"
    - name: Reconfigure nsswitch shadow
      ansible.builtin.lineinfile:
        path: /etc/nsswitch.conf
        regexp: "^shadow:.*"
        line: "shadow:         compat ldap"

    - name: Reconfigure nslcd uri
      ansible.builtin.lineinfile:
        path: /etc/nslcd.conf
        regexp: "^uri ldap.*"
        line: "uri ldap://192.168.77.106:389/"


    - name: Reconfigure ldap base
      ansible.builtin.lineinfile:
        path: /etc/nslcd.conf
        regexp: "^base "
        line: "base dc=sectorq,dc=eu"


    - name: Reconfigure nslcd binddn
      ansible.builtin.lineinfile:
        path: /etc/nslcd.conf
        regexp: "^#binddn"
        line: "binddn cn=admin,dc=sectorq,dc=eu"
        
    - name: Reconfigure nslcd bindpw
      ansible.builtin.lineinfile:
        path: /etc/nslcd.conf
        regexp: "^#bindpw"
        line: "bindpw {{ ldap_admin_password }}"
    # - name: Reconfigure ldap base
    #   ansible.builtin.lineinfile:
    #     path: /etc/nslcd.conf
    #     regexp: "^#ssl"
    #     line: "ssl start_tls"
    - name: Reconfigure nslcd tls_reqcert
      ansible.builtin.lineinfile:
        path: /etc/nslcd.conf
        regexp: "^#tls_reqcert"
        line: "tls_reqcert allow"
    - name: Restart nslcd service
      ansible.builtin.service:
        name: nslcd.service
        state: restarted

    - name: Creating a file with content
      copy:
        dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
        content: |
          #!/usr/bin/bash
          ldapsearch  -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'  
        mode: '0755'
    - name: Reconfigure sshd
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^#AuthorizedKeysCommand *"
        line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"

    - name: Reconfigure sshd
      ansible.builtin.lineinfile:
        path: /etc/ssh/sshd_config
        regexp: "^#AuthorizedKeysCommandUser *"
        line: "AuthorizedKeysCommandUser root"
    - name: Create a directory LDAP if it does not exist
      ansible.builtin.file:
        path: /etc/ldap/
        state: directory
        mode: '0755'
    - name: Creating a file with content
      copy:
        dest: "/etc/ldap/ldap.conf"
        content: |
          #
          # LDAP Defaults
          #

          # See ldap.conf(5) for details
          # This file should be world readable but not world writable.

          BASE    dc=sectorq,dc=eu
          URI     ldap://192.168.77.106:389

          #SIZELIMIT      12
          #TIMELIMIT      15
          #DEREF          never

          # TLS certificates (needed for GnuTLS)
          TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
    
    - name: Restart sshd service
      ansible.builtin.service:
        name: sshd.service
        state: restarted