desktop.yml

@@ -1,9 +0,0 @@
----
-- hosts: desktop
-  roles:
-    - common
-    - wake_on_lan
-    - timeshift
-    - zabbix-agent
-    - autofs_client
-    - ldap_client

roles/fail2ban/tasks/main.yml

@@ -1,39 +1,149 @@
 - block:
-  - name: Install fail2ban packages
+  - name: Install ldap packages
     ansible.builtin.apt:
       name: 
-        - fail2ban
+        - libpam-ldapd
-        - sendmail
+        - ldap-utils
-  - name: Copy files
+        - libnss-ldapd
-    copy:
+  # - name: Reconfigure ldap base
-      src: "{{ item }}"
+  #   ansible.builtin.lineinfile:
-      dest: /etc/fail2ban/jail.d/
+  #     path: /etc/ldap.conf
-    with_fileglob:
+  #     regexp: "^base "
-      - "jail.d/*.conf"
+  #     line: "base dc=sectorq,dc=eu"
 
-  - name: Copy files
+  # - name: Reconfigure ldap uri
-    copy:
+  #   ansible.builtin.lineinfile:
-      src: "{{ item }}"
+  #     path: /etc/ldap.conf
-      dest: /etc/fail2ban/filter.d/
+  #     regexp: "^uri ldap.*"
-    with_fileglob:
+  #     line: "uri ldaps://ldap-server.loc/"
-      - "filter.d/*.conf"
+  # - name: Reconfigure ldap version
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/ldap.conf
+  #     regexp: "^ldap_version.*"
+  #     line: "ldap_version 3"
 
-  - name: Copy files
+  # - name: Reconfigure ldap rootbinddn
-    copy:
+  #   ansible.builtin.lineinfile:
-      src: "{{ item }}"
+  #     path: /etc/ldap.conf
-      dest: /etc/fail2ban/action.d/
+  #     regexp: "^rootbinddn.*"
-    with_fileglob:
+  #     line: "rootbinddn cn=admin,dc=sectorq,dc=eu"
-      - "action.d/*.conf"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session optional pam_mkhomedir.so.*"
+      line: "session optional pam_mkhomedir.so skel=/etc/skel umask=077"
+  - name: Reconfigure common-session
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-session
+      regexp: "^session.*pam_ldap.so.*"
+      line: "session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000"      
+  - name: Reconfigure common-password
+    ansible.builtin.lineinfile:
+      path: /etc/pam.d/common-password
+      regexp: "^password.*success=1 user_unknown=ignore default=die.*"
+      line: "password        [success=1 default=ignore]     pam_ldap.so minimum_uid=1000 try_first_pass"
+  - name: Reconfigure nsswitch passwd
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^passwd:.*"
+      line: "passwd:         compat systemd ldap"
+  - name: Reconfigure nsswitch group
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^group:.*"
+      line: "group:          compat systemd ldap"
+  - name: Reconfigure nsswitch shadow
+    ansible.builtin.lineinfile:
+      path: /etc/nsswitch.conf
+      regexp: "^shadow:.*"
+      line: "shadow:         compat ldap"
 
-  - name: disable sendmail service
+  - name: Reconfigure nslcd uri
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^uri ldap.*"
+      line: "uri ldap://192.168.77.101:2389/"
+
+
+  - name: Reconfigure ldap base
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^base "
+      line: "base dc=sectorq,dc=eu"
+
+
+  - name: Reconfigure nslcd binddn
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^binddn"
+      line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
+      
+  - name: Reconfigure nslcd bindpw
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^bindpw"
+      line: "bindpw {{ ldap_admin_password }}"
+  # - name: Reconfigure ldap base
+  #   ansible.builtin.lineinfile:
+  #     path: /etc/nslcd.conf
+  #     regexp: "^#ssl"
+  #     line: "ssl start_tls"
+  - name: Reconfigure nslcd tls_reqcert
+    ansible.builtin.lineinfile:
+      path: /etc/nslcd.conf
+      regexp: "^tls_reqcert"
+      line: "tls_reqcert allow"
+  - name: Restart nslcd service
     ansible.builtin.service:
-      name: sendmail.service
+      name: nslcd.service
-      state: stopped
+      state: restarted
-      enabled: false
+
-
+  - name: Creating a file with content
-  - name: Restart fail2ban service
+    copy:
-    ansible.builtin.service:
+      dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
-      name: fail2ban.service
+      content: |
+        #!/usr/bin/bash
+        ldapsearch  -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'  
+      mode: '0755'
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommand *"
+      line: "AuthorizedKeysCommand /usr/local/bin/fetchSSHKeysFromLDAP"
+
+  - name: Reconfigure sshd
+    ansible.builtin.lineinfile:
+      path: /etc/ssh/sshd_config
+      regexp: "^#AuthorizedKeysCommandUser *"
+      line: "AuthorizedKeysCommandUser root"
+  - name: Create a directory LDAP if it does not exist
+    ansible.builtin.file:
+      path: /etc/ldap/
+      state: directory
+      mode: '0755'
+  - name: Creating a file with content
+    copy:
+      dest: "/etc/ldap/ldap.conf"
+      content: |
+        #
+        # LDAP Defaults
+        #
+
+        # See ldap.conf(5) for details
+        # This file should be world readable but not world writable.
+
+        BASE    dc=sectorq,dc=eu
+        URI     ldap://192.168.77.101:2389
+
+        #SIZELIMIT      12
+        #TIMELIMIT      15
+        #DEREF          never
+
+        # TLS certificates (needed for GnuTLS)
+        TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
+  
+  - name: Restart sshd service
+    ansible.builtin.service:
+      name: sshd.service
       state: restarted
-      enabled: true
   become: true

roles/ldap_client/tasks/main.yml

@@ -76,7 +76,7 @@
     ansible.builtin.lineinfile:
       path: /etc/nslcd.conf
       regexp: "^binddn"
-      line: "binddn cn=ldapservice,ou=users,dc=sectorq,dc=eu"
+      line: "binddn cn=jaydee,dc=users,dc=sectorq,dc=eu"
       
   - name: Reconfigure nslcd bindpw
     ansible.builtin.lineinfile:
@@ -103,10 +103,8 @@
       dest: "/usr/local/bin/fetchSSHKeysFromLDAP"
       content: |
         #!/usr/bin/bash
-        ldapsearch  -x -H ldap://192.168.77.101:2389 -D 'cn=ldapservice,ou=users,DC=sectorq,DC=eu' -w {{ ldap_admin_password }} '(&(objectClass=person)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
+        ldapsearch  -x '(&(objectClass=ldapPublicKey)(cn='"$1"'))' 'sshPublicKey' |     sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'  
-      owner: root
+      mode: '0755'
-      group: root
-      mode: '0700'
   - name: Reconfigure sshd
     ansible.builtin.lineinfile:
       path: /etc/ssh/sshd_config
@@ -146,6 +144,6 @@
   
   - name: Restart sshd service
     ansible.builtin.service:
-      name: ssh
+      name: sshd.service
       state: restarted
   become: true

roles/ssh_banner/tasks/main.yml

@@ -1,35 +0,0 @@
-- block:
-  - name: Install packages
-    ansible.builtin.apt:
-      name: 
-        - figlet 
-        - toilet
-        
-  - name: Create Banner
-    ansible.builtin.command: |
-      figlet -c  {{ (inventory_hostname|split('.'))[0] }} -f slant
-    register: logo
-
-  - name: Creating a file with content
-    copy:
-      dest: "/etc/banner"
-      content: |
-        {{ logo.stdout }}
-
-  - name: Reconfigure sshd
-    ansible.builtin.lineinfile:
-      path: /etc/ssh/sshd_config
-      regexp: "^Banner.* "
-      line: "Banner /etc/banner"
-
-  - name: Reconfigure sshd
-    ansible.builtin.lineinfile:
-      path: /etc/ssh/sshd_config
-      regexp: "^#PrintLastLog.* "
-      line: "PrintLastLog no"
-
-  - name: sshd
-    ansible.builtin.service:
-      name: ssh.service
-      state: restarted
-  become: true

roles/vnc_server/tasks/main.yml

@@ -1,5 +1,3 @@
-- block:
-  
 - name: Install vnc packages
   ansible.builtin.apt:
     name: 
@@ -7,35 +5,15 @@
       - tigervnc-common
     update_cache: yes
 
-  - name: Create a directory if it does not exist
+
-    ansible.builtin.file:
-      path: /home/jd/.vnc/
-      state: directory
-      mode: '0755'
-      owner: jd
-      group: jd
 - name: Creating a file with content
   copy:
     dest: "/home/jd/.vnc/config"
     content: |
-        session=mate
+      session=cinnamon
       geometry=1200x721
       localhost
       alwaysshared
-      mode: '0755'
-      owner: jd
-      group: jd
-  - name: Reconfigure vnc
-    ansible.builtin.lineinfile:
-      path: /etc/tigervnc/vncserver-config-defaults
-      regexp: "^$localhost =.* "
-      line: '$localhost = "no";'
-
-  - name: Reconfigure vnc1
-    ansible.builtin.lineinfile:
-      path:  /etc/tigervnc/vncserver.users
-      #regexp: "^:1=.*"
-      line: ':1=jd'
 
   - name: Reconfigure zabbix agent Server
     ansible.builtin.lineinfile:

roles/wake_on_lan/tasks/main.yml

@@ -8,13 +8,9 @@
     var: ansible_facts.interfaces
 - name: Get wifi adapter
   set_fact: 
-    active_adapter: '{{ item }}'
+    wifi_adapter: '{{ item }}'
   loop: '{{ ansible_facts.interfaces }}'
   when: 'item.startswith("eno")'
-- name: Display all interfaces name
-  debug:
-    msg:  "{{ ansible_default_ipv4.interface }}"
-
   
 - name: Creating config
   become: true
@@ -27,7 +23,7 @@
 
       [Service]
       Type=oneshot
-      ExecStart = /usr/sbin/ethtool --change {{ ansible_default_ipv4.interface }} wol g
+      ExecStart = /usr/sbin/ethtool --change {{ wifi_adapter }} wol g
 
       [Install]
       WantedBy=basic.target

servers.yml

@@ -10,4 +10,3 @@
     - zabbix-agent
     - autofs_client
     - ldap_client
-    - ssh_banner

test.yml

@@ -1,4 +0,0 @@
----
-- hosts: datacenter
-  roles:
-    - vnc_server