mirror of
https://gitlab.sectorq.eu/jaydee/ansible.git
synced 2025-01-23 12:38:11 +00:00
conf added
This commit is contained in:
ladislav.dusa
parent
afc7817a81
commit
43dc4a8009
42
roles/autofs_client/tasks/main.yml
Executable file
42
roles/autofs_client/tasks/main.yml
Executable file
@ -0,0 +1,42 @@
|
||||
- block:
|
||||
- name: include vault
|
||||
ansible.builtin.include_vars:
|
||||
file: jaydee.yml
|
||||
- name: Install autofs
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- autofs
|
||||
- cifs-utils
|
||||
state: present
|
||||
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/etc/auto.auth"
|
||||
content: |
|
||||
username={{ samba_user }}
|
||||
password={{ samba_password }}
|
||||
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/etc/auto.nas"
|
||||
content: |
|
||||
nas-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Data
|
||||
nas-docker-data -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/docker_data
|
||||
nas-photo -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Photo
|
||||
nas-public -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Public
|
||||
nas-install -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/install
|
||||
nas-media -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/Media
|
||||
nas-downloads -fstype=cifs,credentials=/etc/auto.auth,dir_mode=0755,file_mode=0755,uid=jd,rw ://nas.home.lan/downloads
|
||||
|
||||
- name: Reconfigure zabbix agent Server
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/auto.master
|
||||
regexp: "^/media/nas.*"
|
||||
insertafter: '^/media/nas'
|
||||
line: "/media/nas /etc/auto.nas --timeout 360 --ghost"
|
||||
|
||||
- name: Restart docker service
|
||||
ansible.builtin.service:
|
||||
name: autofs
|
||||
state: restarted
|
||||
become: true
|
||||
8
roles/fail2ban/files/action.d/banan.conf
Normal file
8
roles/fail2ban/files/action.d/banan.conf
Normal file
@ -0,0 +1,8 @@
|
||||
[Definition]
|
||||
|
||||
#actionban = ssh -i /config/fail2ban/id_rsa2 admin@192.168.77.1 'firewall ban ip <ip> "<name>"'
|
||||
#actionban = touch /ban/<ip>
|
||||
actionban = docker exec blockips-unifi php /add_block_firewall.php <ip> >> /tmp/lala
|
||||
|
||||
#actionunban = touch /unban/<ip>
|
||||
actionunban = docker exec blockips-unifi php /del_block_firewall.php <ip> >> /tmp/lala
|
||||
4
roles/fail2ban/files/filter.d/bad-auth.conf
Normal file
4
roles/fail2ban/files/filter.d/bad-auth.conf
Normal file
@ -0,0 +1,4 @@
|
||||
# Fail2Ban configuration file
|
||||
[Definition]
|
||||
failregex = .* client login failed: .+ client:\ <HOST>
|
||||
ignoreregex =
|
||||
5
roles/fail2ban/files/filter.d/nextcloud.conf
Normal file
5
roles/fail2ban/files/filter.d/nextcloud.conf
Normal file
@ -0,0 +1,5 @@
|
||||
[Definition]
|
||||
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
|
||||
failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
|
||||
^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
|
||||
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
|
||||
138
roles/fail2ban/files/filter.d/sshd.conf
Normal file
138
roles/fail2ban/files/filter.d/sshd.conf
Normal file
@ -0,0 +1,138 @@
|
||||
# Fail2Ban filter for openssh
|
||||
#
|
||||
# If you want to protect OpenSSH from being bruteforced by password
|
||||
# authentication then get public key authentication working before disabling
|
||||
# PasswordAuthentication in sshd_config.
|
||||
#
|
||||
#
|
||||
# "Connection from <HOST> port \d+" requires LogLevel VERBOSE in sshd_config
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Read common prefixes. If any customizations available -- read them from
|
||||
# common.local
|
||||
before = common.conf
|
||||
|
||||
[DEFAULT]
|
||||
|
||||
_daemon = sshd
|
||||
|
||||
# optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
|
||||
__pref = (?:(?:error|fatal): (?:PAM: )?)?
|
||||
# optional suffix (logged from several ssh versions) like " [preauth]"
|
||||
#__suff = (?: port \d+)?(?: \[preauth\])?\s*
|
||||
__suff = (?: (?:port \d+|on \S+|\[preauth\])){0,3}\s*
|
||||
__on_port_opt = (?: (?:port \d+|on \S+)){0,2}
|
||||
# close by authenticating user:
|
||||
__authng_user = (?: (?:invalid|authenticating) user <F-USER>\S+|.*?</F-USER>)?
|
||||
|
||||
# for all possible (also future) forms of "no matching (cipher|mac|MAC|compression method|key exchange method|host key type) found",
|
||||
# see ssherr.c for all possible SSH_ERR_..._ALG_MATCH errors.
|
||||
__alg_match = (?:(?:\w+ (?!found\b)){0,2}\w+)
|
||||
|
||||
# PAM authentication mechanism, can be overridden, e. g. `filter = sshd[__pam_auth='pam_ldap']`:
|
||||
__pam_auth = pam_[a-z]+
|
||||
|
||||
[Definition]
|
||||
|
||||
prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID>%(__pref)s<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
cmnfailre = ^[aA]uthentication (?:failure|error|failed) for <F-USER>.*</F-USER> from <HOST>( via \S+)?%(__suff)s$
|
||||
^User not known to the underlying authentication module for <F-USER>.*</F-USER> from <HOST>%(__suff)s$
|
||||
<cmnfailre-failed-pub-<publickey>>
|
||||
^Failed <cmnfailed> for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
|
||||
^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>
|
||||
^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not listed in AllowUsers%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because listed in DenyUsers%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because not in any group%(__suff)s$
|
||||
^refused connect from \S+ \(<HOST>\)
|
||||
^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because a group is listed in DenyGroups%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> from <HOST> not allowed because none of user's groups are listed in AllowGroups%(__suff)s$
|
||||
^<F-NOFAIL>%(__pam_auth)s\(sshd:auth\):\s+authentication failure;</F-NOFAIL>(?:\s+(?:(?:logname|e?uid|tty)=\S*)){0,4}\s+ruser=<F-ALT_USER>\S*</F-ALT_USER>\s+rhost=<HOST>(?:\s+user=<F-USER>\S*</F-USER>)?%(__suff)s$
|
||||
^maximum authentication attempts exceeded for <F-USER>.*</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?%(__suff)s$
|
||||
^User <F-USER>\S+|.*?</F-USER> not allowed because account is locked%(__suff)s
|
||||
^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+</F-USER> <HOST>%(__on_port_opt)s:\s*Change of username or service not allowed:\s*.*\[preauth\]\s*$
|
||||
^Disconnecting: Too many authentication failures(?: for <F-USER>\S+|.*?</F-USER>)?%(__suff)s$
|
||||
^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>%(__on_port_opt)s:\s*11:
|
||||
<mdre-<mode>-other>
|
||||
^<F-MLFFORGET><F-MLFGAINED>Accepted \w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\S+</F-USER> from <HOST>(?:\s|$)
|
||||
|
||||
cmnfailed-any = \S+
|
||||
cmnfailed-ignore = \b(?!publickey)\S+
|
||||
cmnfailed-invalid = <cmnfailed-ignore>
|
||||
cmnfailed-nofail = (?:<F-NOFAIL>publickey</F-NOFAIL>|\S+)
|
||||
cmnfailed = <cmnfailed-<publickey>>
|
||||
|
||||
mdre-normal =
|
||||
# used to differentiate "connection closed" with and without `[preauth]` (fail/nofail cases in ddos mode)
|
||||
mdre-normal-other = ^<F-NOFAIL><F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__suff)s|\s*)$
|
||||
|
||||
mdre-ddos = ^Did not receive identification string from <HOST>
|
||||
^kex_exchange_identification: (?:read: )?(?:[Cc]lient sent invalid protocol identifier|[Cc]onnection (?:closed by remote host|reset by peer))
|
||||
^Bad protocol version identification '.*' from <HOST>
|
||||
^<F-NOFAIL>SSH: Server;Ltype:</F-NOFAIL> (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:
|
||||
^Read from socket failed: Connection <F-MLFFORGET>reset</F-MLFFORGET> by peer
|
||||
^banner exchange: Connection from <HOST><__on_port_opt>: invalid format
|
||||
# same as mdre-normal-other, but as failure (without <F-NOFAIL> with [preauth] and with <F-NOFAIL> on no preauth phase as helper to identify address):
|
||||
mdre-ddos-other = ^<F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET> (?:by|from)%(__authng_user)s <HOST>%(__on_port_opt)s\s+\[preauth\]\s*$
|
||||
^<F-NOFAIL><F-MLFFORGET>(Connection (?:closed|reset)|Disconnected)</F-MLFFORGET></F-NOFAIL> (?:by|from)%(__authng_user)s <HOST>(?:%(__on_port_opt)s|\s*)$
|
||||
|
||||
mdre-extra = ^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>%(__on_port_opt)s:\s*14: No(?: supported)? authentication methods available
|
||||
^Unable to negotiate with <HOST>%(__on_port_opt)s: no matching <__alg_match> found.
|
||||
^Unable to negotiate a <__alg_match>
|
||||
^no matching <__alg_match> found:
|
||||
# part of mdre-ddos-other, but user name is supplied (invalid/authenticating) on [preauth] phase only:
|
||||
mdre-extra-other = ^<F-MLFFORGET>Disconnected</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\S+|.*?</F-USER> <HOST>%(__on_port_opt)s \[preauth\]\s*$
|
||||
|
||||
mdre-aggressive = %(mdre-ddos)s
|
||||
%(mdre-extra)s
|
||||
# mdre-extra-other is fully included within mdre-ddos-other:
|
||||
mdre-aggressive-other = %(mdre-ddos-other)s
|
||||
|
||||
# Parameter "publickey": nofail (default), invalid, any, ignore
|
||||
publickey = nofail
|
||||
# consider failed publickey for invalid users only:
|
||||
cmnfailre-failed-pub-invalid = ^Failed publickey for invalid user <F-USER>(?P<cond_user>\S+)|(?:(?! from ).)*?</F-USER> from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
|
||||
# consider failed publickey for valid users too (don't need RE, see cmnfailed):
|
||||
cmnfailre-failed-pub-any =
|
||||
# same as invalid, but consider failed publickey for valid users too, just as no failure (helper to get IP and user-name only, see cmnfailed):
|
||||
cmnfailre-failed-pub-nofail = <cmnfailre-failed-pub-invalid>
|
||||
# don't consider failed publickey as failures (don't need RE, see cmnfailed):
|
||||
cmnfailre-failed-pub-ignore =
|
||||
|
||||
cfooterre = ^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>
|
||||
|
||||
failregex = %(cmnfailre)s
|
||||
<mdre-<mode>>
|
||||
%(cfooterre)s
|
||||
|
||||
# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
|
||||
# Usage example (for jail.local):
|
||||
# [sshd]
|
||||
# mode = extra
|
||||
# # or another jail (rewrite filter parameters of jail):
|
||||
# [sshd-aggressive]
|
||||
# filter = sshd[mode=aggressive]
|
||||
#
|
||||
mode = normal
|
||||
|
||||
#filter = sshd[mode=aggressive]
|
||||
|
||||
ignoreregex =
|
||||
|
||||
maxlines = 1
|
||||
|
||||
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
|
||||
|
||||
# DEV Notes:
|
||||
#
|
||||
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
|
||||
# it is coming before use of <HOST> which is not hard-anchored at the end as well,
|
||||
# and later catch-all's could contain user-provided input, which need to be greedily
|
||||
# matched away first.
|
||||
#
|
||||
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black and Sergey Brester aka sebres
|
||||
# Rewritten using prefregex (and introduced "mode" parameter) by Serg G. Brester.
|
||||
14
roles/fail2ban/files/jail.d/bad-auth.conf
Normal file
14
roles/fail2ban/files/jail.d/bad-auth.conf
Normal file
@ -0,0 +1,14 @@
|
||||
[bad-auth]
|
||||
enabled = true
|
||||
backend = systemd
|
||||
filter = bad-auth
|
||||
journalmatch='CONTAINER_TAG=mailu-front'
|
||||
bantime = 36000000
|
||||
findtime = 36000
|
||||
maxretry = 2
|
||||
sender = fail2ban@sectorq.eu
|
||||
destemail = jaydee@sectorq.eu
|
||||
ignoreip = 192.168.77.0/24 87.197.162.37
|
||||
#action = %(action_mwl)s
|
||||
action = banan
|
||||
%(action_mwl)s
|
||||
15
roles/fail2ban/files/jail.d/nextcloud.conf
Normal file
15
roles/fail2ban/files/jail.d/nextcloud.conf
Normal file
@ -0,0 +1,15 @@
|
||||
[nextcloud]
|
||||
backend = auto
|
||||
enabled = true
|
||||
port = 80,443
|
||||
protocol = tcp
|
||||
filter = nextcloud
|
||||
bantime = 36000000
|
||||
findtime = 36000
|
||||
maxretry = 2
|
||||
ignoreip = 192.168.77.0/24 87.197.162.37
|
||||
sender = fail2ban@sectorq.eu
|
||||
destemail = jaydee@sectorq.eu
|
||||
logpath = /share/docker_data/nextcloud/app/data/nextcloud.log
|
||||
action = banan
|
||||
%(action_mwl)s
|
||||
17
roles/fail2ban/files/jail.d/sshd.conf
Normal file
17
roles/fail2ban/files/jail.d/sshd.conf
Normal file
@ -0,0 +1,17 @@
|
||||
[sshd]
|
||||
|
||||
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
|
||||
# normal (default), ddos, extra or aggressive (combines all).
|
||||
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
|
||||
#mode = normal
|
||||
enabled = true
|
||||
port = ssh
|
||||
bantime = 36000000
|
||||
findtime = 36000
|
||||
maxretry = 2
|
||||
sender = fail2ban@sectorq.eu
|
||||
destemail = jaydee@sectorq.eu
|
||||
ignoreip = 192.168.77.0/24 87.197.162.37
|
||||
backend = systemd
|
||||
action = %(action_mwl)s
|
||||
banan
|
||||
149
roles/fail2ban/tasks/main.yml
Executable file
149
roles/fail2ban/tasks/main.yml
Executable file
@ -0,0 +1,149 @@
|
||||
- block:
|
||||
- name: Install ldap packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- libpam-ldapd
|
||||
- ldap-utils
|
||||
- libnss-ldapd
|
||||
# - name: Reconfigure ldap base
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^base "
|
||||
# line: "base dc=sectorq,dc=eu"
|
||||
|
||||
# - name: Reconfigure ldap uri
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^uri ldap.*"
|
||||
# line: "uri ldaps://ldap-server.loc/"
|
||||
# - name: Reconfigure ldap version
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^ldap_version.*"
|
||||
# line: "ldap_version 3"
|
||||
|
||||
# - name: Reconfigure ldap rootbinddn
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^rootbinddn.*"
|
||||
# line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
|
||||
- name: Reconfigure common-session
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-session
|
||||
regexp: "^session optional pam_mkhomedir.so.*"
|
||||
line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
|
||||
- name: Reconfigure common-session
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-session
|
||||
regexp: "^session.*pam_ldap.so.*"
|
||||
line: "session [success=ok default=ignore] pam_ldap.so minimum_uid=1000"
|
||||
- name: Reconfigure common-password
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-password
|
||||
regexp: "^password.*success=1 user_unknown=ignore default=die.*"
|
||||
line: "password [success=1 default=ignore] pam_ldap.so minimum_uid=1000 try_first_pass"
|
||||
- name: Reconfigure nsswitch passwd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^passwd:.*"
|
||||
line: "passwd: compat systemd ldap"
|
||||
- name: Reconfigure nsswitch group
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^group:.*"
|
||||
line: "group: compat systemd ldap"
|
||||
- name: Reconfigure nsswitch shadow
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^shadow:.*"
|
||||
line: "shadow: compat ldap"
|
||||
|
||||
- name: Reconfigure nslcd uri
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^uri ldap.*"
|
||||
line: "uri ldap://192.168.77.101:2389/"
|
||||
|
||||
|
||||
- name: Reconfigure ldap base
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^base "
|
||||
line: "base dc=sectorq,dc=eu"
|
||||
|
||||
|
||||
- name: Reconfigure nslcd binddn
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^binddn"
|
||||
line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
|
||||
|
||||
- name: Reconfigure nslcd bindpw
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^bindpw"
|
||||
line: "bindpw {{ ldap_admin_password }}"
|
||||
# - name: Reconfigure ldap base
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/nslcd.conf
|
||||
# regexp: "^#ssl"
|
||||
# line: "ssl start_tls"
|
||||
- name: Reconfigure nslcd tls_reqcert
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^tls_reqcert"
|
||||
line: "tls_reqcert allow"
|
||||
- name: Restart nslcd service
|
||||
ansible.builtin.service:
|
||||
name: nslcd.service
|
||||
state: restarted
|
||||
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
|
||||
content: |
|
||||
#!/usr/bin/bash
|
||||
ldapsearch -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
|
||||
mode: '0755'
|
||||
- name: Reconfigure sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#AuthorizedKeysCommand *"
|
||||
line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"
|
||||
|
||||
- name: Reconfigure sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#AuthorizedKeysCommandUser *"
|
||||
line: "AuthorizedKeysCommandUser root"
|
||||
- name: Create a directory LDAP if it does not exist
|
||||
ansible.builtin.file:
|
||||
path: /etc/ldap/
|
||||
state: directory
|
||||
mode: '0755'
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/etc/ldap/ldap.conf"
|
||||
content: |
|
||||
#
|
||||
# LDAP Defaults
|
||||
#
|
||||
|
||||
# See ldap.conf(5) for details
|
||||
# This file should be world readable but not world writable.
|
||||
|
||||
BASE dc=sectorq,dc=eu
|
||||
URI ldap://192.168.77.101:2389
|
||||
|
||||
#SIZELIMIT 12
|
||||
#TIMELIMIT 15
|
||||
#DEREF never
|
||||
|
||||
# TLS certificates (needed for GnuTLS)
|
||||
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
- name: Restart sshd service
|
||||
ansible.builtin.service:
|
||||
name: sshd.service
|
||||
state: restarted
|
||||
become: true
|
||||
149
roles/ldap_client/tasks/main.yml
Executable file
149
roles/ldap_client/tasks/main.yml
Executable file
@ -0,0 +1,149 @@
|
||||
- block:
|
||||
- name: Install ldap packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- libpam-ldapd
|
||||
- ldap-utils
|
||||
- libnss-ldapd
|
||||
# - name: Reconfigure ldap base
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^base "
|
||||
# line: "base dc=sectorq,dc=eu"
|
||||
|
||||
# - name: Reconfigure ldap uri
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^uri ldap.*"
|
||||
# line: "uri ldaps://ldap-server.loc/"
|
||||
# - name: Reconfigure ldap version
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^ldap_version.*"
|
||||
# line: "ldap_version 3"
|
||||
|
||||
# - name: Reconfigure ldap rootbinddn
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/ldap.conf
|
||||
# regexp: "^rootbinddn.*"
|
||||
# line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
|
||||
- name: Reconfigure common-session
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-session
|
||||
regexp: "^session optional pam_mkhomedir.so.*"
|
||||
line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
|
||||
- name: Reconfigure common-session
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-session
|
||||
regexp: "^session.*pam_ldap.so.*"
|
||||
line: "session [success=ok default=ignore] pam_ldap.so minimum_uid=1000"
|
||||
- name: Reconfigure common-password
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/pam.d/common-password
|
||||
regexp: "^password.*success=1 user_unknown=ignore default=die.*"
|
||||
line: "password [success=1 default=ignore] pam_ldap.so minimum_uid=1000 try_first_pass"
|
||||
- name: Reconfigure nsswitch passwd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^passwd:.*"
|
||||
line: "passwd: compat systemd ldap"
|
||||
- name: Reconfigure nsswitch group
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^group:.*"
|
||||
line: "group: compat systemd ldap"
|
||||
- name: Reconfigure nsswitch shadow
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
regexp: "^shadow:.*"
|
||||
line: "shadow: compat ldap"
|
||||
|
||||
- name: Reconfigure nslcd uri
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^uri ldap.*"
|
||||
line: "uri ldap://192.168.77.101:2389/"
|
||||
|
||||
|
||||
- name: Reconfigure ldap base
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^base "
|
||||
line: "base dc=sectorq,dc=eu"
|
||||
|
||||
|
||||
- name: Reconfigure nslcd binddn
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^binddn"
|
||||
line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
|
||||
|
||||
- name: Reconfigure nslcd bindpw
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^bindpw"
|
||||
line: "bindpw {{ ldap_admin_password }}"
|
||||
# - name: Reconfigure ldap base
|
||||
# ansible.builtin.lineinfile:
|
||||
# path: /etc/nslcd.conf
|
||||
# regexp: "^#ssl"
|
||||
# line: "ssl start_tls"
|
||||
- name: Reconfigure nslcd tls_reqcert
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/nslcd.conf
|
||||
regexp: "^tls_reqcert"
|
||||
line: "tls_reqcert allow"
|
||||
- name: Restart nslcd service
|
||||
ansible.builtin.service:
|
||||
name: nslcd.service
|
||||
state: restarted
|
||||
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
|
||||
content: |
|
||||
#!/usr/bin/bash
|
||||
ldapsearch -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
|
||||
mode: '0755'
|
||||
- name: Reconfigure sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#AuthorizedKeysCommand *"
|
||||
line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"
|
||||
|
||||
- name: Reconfigure sshd
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: "^#AuthorizedKeysCommandUser *"
|
||||
line: "AuthorizedKeysCommandUser root"
|
||||
- name: Create a directory LDAP if it does not exist
|
||||
ansible.builtin.file:
|
||||
path: /etc/ldap/
|
||||
state: directory
|
||||
mode: '0755'
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/etc/ldap/ldap.conf"
|
||||
content: |
|
||||
#
|
||||
# LDAP Defaults
|
||||
#
|
||||
|
||||
# See ldap.conf(5) for details
|
||||
# This file should be world readable but not world writable.
|
||||
|
||||
BASE dc=sectorq,dc=eu
|
||||
URI ldap://192.168.77.101:2389
|
||||
|
||||
#SIZELIMIT 12
|
||||
#TIMELIMIT 15
|
||||
#DEREF never
|
||||
|
||||
# TLS certificates (needed for GnuTLS)
|
||||
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
- name: Restart sshd service
|
||||
ansible.builtin.service:
|
||||
name: sshd.service
|
||||
state: restarted
|
||||
become: true
|
||||
24
roles/vnc_server/tasks/main.yml
Executable file
24
roles/vnc_server/tasks/main.yml
Executable file
@ -0,0 +1,24 @@
|
||||
- name: Install vnc packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- tigervnc-standalone-server
|
||||
- tigervnc-common
|
||||
update_cache: yes
|
||||
|
||||
|
||||
- name: Creating a file with content
|
||||
copy:
|
||||
dest: "/home/jd/.vnc/config"
|
||||
content: |
|
||||
session=cinnamon
|
||||
geometry=1200x721
|
||||
localhost
|
||||
alwaysshared
|
||||
|
||||
- name: Reconfigure zabbix agent Server
|
||||
ansible.builtin.lineinfile:
|
||||
path: "/etc/tigervnc/vncserver.users"
|
||||
regexp: "^:1=jd"
|
||||
line: ":1=jd"
|
||||
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user