From 1c52e9c4896a6f48eedc4faba8983f7fed345bb5 Mon Sep 17 00:00:00 2001 From: Jonathan Steffan Date: Aug 22 2017 02:36:15 +0000 Subject: [PATCH 1/5] Add users to the node - Create the users - Install the SSH keys - Add users to wheel and mock - Install mock --- diff --git a/provisioning-ansible/README.md b/provisioning-ansible/README.md index 682ae98..f27ea80 100644 --- a/provisioning-ansible/README.md +++ b/provisioning-ansible/README.md @@ -26,20 +26,12 @@ enforcing=0 autorelabel=1 This will auto-reboot, ending in an offline node. Enable Lassie booting. Boot the Linode. -### Run ansible Initial Configuration -Run the initial configuration to create users and install base programs. +### Run Ansible Initial Configuration +Run the initial configuration as `root` to create users and install base programs. After running this playbook, the `root` user will no longer work. -Create a user with sudo to run the playbook: +Run the playbook as `root`: ```shell -useradd $user -usermod $user -a -G wheel -passwd $user -``` -Run the playbook as the user: - -```shell - - +ansible-playbook -u root -l $loc ansible/playbooks/initial_base_setup.yml ``` diff --git a/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml b/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml index e9d16d2..d27886f 100644 --- a/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml +++ b/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml @@ -2,6 +2,12 @@ # basic setup vars conf_users: - - "jon" - - "linuxmodder" - - "kk4ewt" + - username: "jon" + realname: "damaestro" + ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdBuKXUtNlPLrkksu8JBfmdcEDTLcR3DOssjQU5tphRrmhdeV3VrJlrXKZYy8l8gZKD/uzA/XKiZc9rUQgSn4LtufdJbiolhfMUkWCsS1fbONRQ2CgbofhnfKtSYtPj0QZCvi+671K+OVtLDDtof20xRWcKR6GarsRGrQkfOvSXTsunMrPrWA3DbxcsWM/e3DJv6Jcjjup3Pxoz97KzNH219jC/IVZXZcinyzV/biIXN0Omk05g0uQ9fCwGmd4QjQ3xv7j2f8gtp3bpZt9puZbkuWc3M9XwFQjgah5awMVEv8ZIDvIH2hzK1vBRPUu/2SEWB7h+AayM4101/iL+4V80ju/Idt9Hpfurme0GxrQ7qoAD1MdiIwrYNRH8P/vNIhKesTWv28bXwS67gdxI+6B2MvMbhxDI4JEnntN2boqau8LvpbMMBDJiL8VG6/mG5dS+4w5d0GFIpLQC6WOniuKfx+R0PFNK47FHoQh3juBd3KRS5auCfheKpvpeEsYxBOLR3YlQUFUVWEQcNorWRR3VFAB1LQwaNyBC66jKZz4ieOBAcU5mVLCrqrT63jMKnQLWUQXvjHzvZghzVY8LSb6Fa/1GNWwcnuVz7LLwlQVeyve5Z1s21NS+W+hoWMh6LAtNlnEYqJ0GEtQB6mZGpjsQRZG3I64yQzhQ5TKZY1cpQ== fspin" + - username: "linuxmodder" + realname: "linuxmodder" + ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcFhXdHMbpGRKFolSyAC50Mf5gmNogPexgPNLoIysoE linuxmodder@linwin.ameridea.net" + - username: "jbwillia" + realname: "jbwillia" + ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcHYw1yukHoOaSvDXpUF7lg2V/m87FSGuRW6hyAB7ut8ZJjwCO40mJfFkP0IeHWYw1r6+RtbJoeZssA9tGwLRxnNNva+zztY8DnrYSzW1OhVWC7jdVkzW2hLuIsEAEU4gCBFYE0nXtXOaGFaTHPPS/J1zPnmEgyPVANGV4lXqH72IfH+ANB81ytu3S7hiwNxBOWwYNZgb8l7EdKTRCUdeR+rsROBTUzkJtfRqwLHK1cIIVPac2SI8cJJvEMSJ/+Jx6DQ0HEDz6/+ahLYuLuO6Sgx//zOZr6cnJDWk5eUeU5J6bGYbDmO/p5U0fSKyP04bApON0YRDzTMP/ObCI3uXWO/4yp2WwmYl1hPj9GsUlezIWUPbMbdwbHDzwB+h/3yPLLfMV2sxdBvZf1J4WfJWTNLt75/G3+LAuZiK1J22eEaD9ymIKohVOmiCHMqKYJPHlhhDHotA4TzmRIjJf6NDq5qBQsOW9jqiWygVwSxJaZ3ObB3ZvqZiq9nHkGeS5uZyXqKhBxEcRHPXFD3BgbDvNtswcf5QS9qqPB0jdIYGGelxHZwZg8ka9Z9jhUvcGyBznp2WQCmk1JMwkeJBRwXxeNhFOX91IYzSVaQ/Dmb15TRYJbUvbb8uBYcqYbDACBwMwuntIiaXQPlWj8bilE05b3O/nV4cWUTRd5ZRnsZNXwQ== jbwillia@noname.math.vt.edu" diff --git a/provisioning-ansible/ansible/roles/common/files/firewalld_conf.j2 b/provisioning-ansible/ansible/roles/common/files/firewalld_conf.j2 deleted file mode 100755 index 8a1f23c..0000000 --- a/provisioning-ansible/ansible/roles/common/files/firewalld_conf.j2 +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash - -##################################################### -# block_embargoed.sh -# Author: Dan Mossor, danofsatx -# -# Script created to bring the Fedora Live Respins -# team into United States Export Law Compliance. -# The script makes the following assumtions: -# -# the zone files from http://www.ipdeny.com/ipblocks/ -# are downloaded to a directory: -# all-zones.tar.gz is unpacked into ./ipv4/ -# ipv6-all-zones.tar.gz is unpacked into ./ipv6/ -# -# Note: North Korea does not have an IPv6 allocation. -##################################################### - -COUNTRYv4="cu ir kp sd sy" -COUNTRYv6="cu ir sd sy" - -# Create the master lists that everything will be added to -ipset create ipv4-embargoed_nations list:set -ipset create ipv6-embargoed_nations list:set - -#build the ipsets -for i in $COUNTRYv4 - do ipset create $i-embargo hash:net - for ip in `cat ipv4/$i.zone` - do ipset add $i-embargo $ip - done -ipset add ipv4-embargoed_nations $i-embargo -done - -for i in $COUNTRYv6 - do ipset create $i-v6-embargo hash:net family inet6 - for ip in `cat ipv6/$i.zone` - do ipset add $i6-embargo $ip - done -ipset add ipv6-embargoed_nations $i6-embargo -done - -# Build the direct rule for firewalld to drop the connections -# and make it permanent -firewall-cmd --direct --add-rule ipv4 raw PREROUTING_ZONES_SOURCE 0 -m set --match-set ipv4-embargoed_nations src -j DROP -firewall-cmd --direct --add-rule ipv6 raw PREROUTING_ZONES_SOURCE 0 -m set --match-set ipv6-embargoed_nations src -j DROP -firewall-cmd --runtime-to-permanent diff --git a/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml b/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml index 38f412b..75848a3 100644 --- a/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml +++ b/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml @@ -7,3 +7,4 @@ state=latest with_items: - git + - mock diff --git a/provisioning-ansible/ansible/roles/common/tasks/main.yml b/provisioning-ansible/ansible/roles/common/tasks/main.yml index 345d4ee..87763b5 100644 --- a/provisioning-ansible/ansible/roles/common/tasks/main.yml +++ b/provisioning-ansible/ansible/roles/common/tasks/main.yml @@ -5,6 +5,8 @@ - include: base_packages.yml +- include: tools.yml + - include: security.yml -- include: tools.yml +- include: users.yml diff --git a/provisioning-ansible/ansible/roles/common/tasks/users.yml b/provisioning-ansible/ansible/roles/common/tasks/users.yml new file mode 100644 index 0000000..b43f1cc --- /dev/null +++ b/provisioning-ansible/ansible/roles/common/tasks/users.yml @@ -0,0 +1,18 @@ +--- +# configure all users, add to wheel, configure ssh keys + +- name: create user accounts + become: true + user: + name="{{ item.username }}" + comment="{{ item.realname }}" + groups=wheel,mock + append=yes + with_items: "{{ conf_users }}" + +- name: install authorized_keys + become: true + authorized_key: + user="{{ item.username }}" + key="{{ item.ssh_pub_key }}" + with_items: "{{ conf_users }}" From 8a8a21d86894ed8194f24dde3d1ba5f7d6987503 Mon Sep 17 00:00:00 2001 From: Jonathan Steffan Date: Aug 22 2017 02:56:30 +0000 Subject: [PATCH 2/5] Update ansible directory structure relative to README. --- diff --git a/provisioning-ansible/README.md b/provisioning-ansible/README.md index f27ea80..c7cc93b 100644 --- a/provisioning-ansible/README.md +++ b/provisioning-ansible/README.md @@ -32,6 +32,6 @@ Run the initial configuration as `root` to create users and install base program Run the playbook as `root`: ```shell -ansible-playbook -u root -l $loc ansible/playbooks/initial_base_setup.yml +ansible-playbook -u root -l $loc --ask-pass playbooks/initial_base_setup.yml ``` diff --git a/provisioning-ansible/ansible.cfg b/provisioning-ansible/ansible.cfg new file mode 100644 index 0000000..42adac8 --- /dev/null +++ b/provisioning-ansible/ansible.cfg @@ -0,0 +1,7 @@ +[defaults] +roles_path = roles +inventory = hosts +timeout = 60 + +[ssh_connection] +pipelining = true diff --git a/provisioning-ansible/ansible/ansible.cfg b/provisioning-ansible/ansible/ansible.cfg deleted file mode 100644 index 42adac8..0000000 --- a/provisioning-ansible/ansible/ansible.cfg +++ /dev/null @@ -1,7 +0,0 @@ -[defaults] -roles_path = roles -inventory = hosts -timeout = 60 - -[ssh_connection] -pipelining = true diff --git a/provisioning-ansible/ansible/hosts/default b/provisioning-ansible/ansible/hosts/default deleted file mode 100644 index bdb1f15..0000000 --- a/provisioning-ansible/ansible/hosts/default +++ /dev/null @@ -1,9 +0,0 @@ -[all] -tx.fspin.org -de.fspin.org - -[tx] -tx.fspin.org - -[de] -de.fspin.org diff --git a/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml b/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml deleted file mode 100644 index d27886f..0000000 --- a/provisioning-ansible/ansible/playbooks/group_vars/initial_base_setup.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# basic setup vars - -conf_users: - - username: "jon" - realname: "damaestro" - ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdBuKXUtNlPLrkksu8JBfmdcEDTLcR3DOssjQU5tphRrmhdeV3VrJlrXKZYy8l8gZKD/uzA/XKiZc9rUQgSn4LtufdJbiolhfMUkWCsS1fbONRQ2CgbofhnfKtSYtPj0QZCvi+671K+OVtLDDtof20xRWcKR6GarsRGrQkfOvSXTsunMrPrWA3DbxcsWM/e3DJv6Jcjjup3Pxoz97KzNH219jC/IVZXZcinyzV/biIXN0Omk05g0uQ9fCwGmd4QjQ3xv7j2f8gtp3bpZt9puZbkuWc3M9XwFQjgah5awMVEv8ZIDvIH2hzK1vBRPUu/2SEWB7h+AayM4101/iL+4V80ju/Idt9Hpfurme0GxrQ7qoAD1MdiIwrYNRH8P/vNIhKesTWv28bXwS67gdxI+6B2MvMbhxDI4JEnntN2boqau8LvpbMMBDJiL8VG6/mG5dS+4w5d0GFIpLQC6WOniuKfx+R0PFNK47FHoQh3juBd3KRS5auCfheKpvpeEsYxBOLR3YlQUFUVWEQcNorWRR3VFAB1LQwaNyBC66jKZz4ieOBAcU5mVLCrqrT63jMKnQLWUQXvjHzvZghzVY8LSb6Fa/1GNWwcnuVz7LLwlQVeyve5Z1s21NS+W+hoWMh6LAtNlnEYqJ0GEtQB6mZGpjsQRZG3I64yQzhQ5TKZY1cpQ== fspin" - - username: "linuxmodder" - realname: "linuxmodder" - ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcFhXdHMbpGRKFolSyAC50Mf5gmNogPexgPNLoIysoE linuxmodder@linwin.ameridea.net" - - username: "jbwillia" - realname: "jbwillia" - ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcHYw1yukHoOaSvDXpUF7lg2V/m87FSGuRW6hyAB7ut8ZJjwCO40mJfFkP0IeHWYw1r6+RtbJoeZssA9tGwLRxnNNva+zztY8DnrYSzW1OhVWC7jdVkzW2hLuIsEAEU4gCBFYE0nXtXOaGFaTHPPS/J1zPnmEgyPVANGV4lXqH72IfH+ANB81ytu3S7hiwNxBOWwYNZgb8l7EdKTRCUdeR+rsROBTUzkJtfRqwLHK1cIIVPac2SI8cJJvEMSJ/+Jx6DQ0HEDz6/+ahLYuLuO6Sgx//zOZr6cnJDWk5eUeU5J6bGYbDmO/p5U0fSKyP04bApON0YRDzTMP/ObCI3uXWO/4yp2WwmYl1hPj9GsUlezIWUPbMbdwbHDzwB+h/3yPLLfMV2sxdBvZf1J4WfJWTNLt75/G3+LAuZiK1J22eEaD9ymIKohVOmiCHMqKYJPHlhhDHotA4TzmRIjJf6NDq5qBQsOW9jqiWygVwSxJaZ3ObB3ZvqZiq9nHkGeS5uZyXqKhBxEcRHPXFD3BgbDvNtswcf5QS9qqPB0jdIYGGelxHZwZg8ka9Z9jhUvcGyBznp2WQCmk1JMwkeJBRwXxeNhFOX91IYzSVaQ/Dmb15TRYJbUvbb8uBYcqYbDACBwMwuntIiaXQPlWj8bilE05b3O/nV4cWUTRd5ZRnsZNXwQ== jbwillia@noname.math.vt.edu" diff --git a/provisioning-ansible/ansible/playbooks/initial_base_setup.yml b/provisioning-ansible/ansible/playbooks/initial_base_setup.yml deleted file mode 100644 index 2a75fee..0000000 --- a/provisioning-ansible/ansible/playbooks/initial_base_setup.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# setup the base server - -- hosts: all - roles: - - common -# - users - vars_files: - - ../playbooks/group_vars/initial_base_setup.yml diff --git a/provisioning-ansible/ansible/roles/common/files/security/fail2ban_conf.j2 b/provisioning-ansible/ansible/roles/common/files/security/fail2ban_conf.j2 deleted file mode 100644 index 89e2538..0000000 --- a/provisioning-ansible/ansible/roles/common/files/security/fail2ban_conf.j2 +++ /dev/null @@ -1,69 +0,0 @@ -# Fail2Ban main configuration file -# -# Comments: use '#' for comment lines and ';' (following a space) for inline comments -# -# Changes: in most of the cases you should not modify this -# file, but provide customizations in fail2ban.local file, e.g.: -# -# [Definition] -# loglevel = DEBUG -# - -[Definition] - -# Option: loglevel -# Notes.: Set the log level output. -# CRITICAL -# ERROR -# WARNING -# NOTICE -# INFO -# DEBUG -# Values: [ LEVEL ] Default: ERROR -# -loglevel = INFO - -# Option: logtarget -# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. -# Only one log target can be specified. -# If you change logtarget from the default value and you are -# using logrotate -- also adjust or disable rotation in the -# corresponding configuration file -# (e.g. /etc/logrotate.d/fail2ban on Debian systems) -# Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR -# -logtarget = /var/log/fail2ban.log - -# Option: syslogsocket -# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG -# auto uses platform.system() to determine predefined paths -# Values: [ auto | FILE ] Default: auto -syslogsocket = auto - -# Option: socket -# Notes.: Set the socket file. This is used to communicate with the daemon. Do -# not remove this file when Fail2ban runs. It will not be possible to -# communicate with the server afterwards. -# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.sock -# -socket = /var/run/fail2ban/fail2ban.sock - -# Option: pidfile -# Notes.: Set the PID file. This is used to store the process ID of the -# fail2ban server. -# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.pid -# -pidfile = /var/run/fail2ban/fail2ban.pid - -# Options: dbfile -# Notes.: Set the file for the fail2ban persistent data to be stored. -# A value of ":memory:" means database is only stored in memory -# and data is lost when fail2ban is stopped. -# A value of "None" disables the database. -# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3 -dbfile = /var/lib/fail2ban/fail2ban.sqlite3 - -# Options: dbpurgeage -# Notes.: Sets age at which bans should be purged from the database -# Values: [ SECONDS ] Default: 86400 (24hours) -dbpurgeage = 86400 diff --git a/provisioning-ansible/ansible/roles/common/files/security/sshd_config.j2 b/provisioning-ansible/ansible/roles/common/files/security/sshd_config.j2 deleted file mode 100644 index df18c52..0000000 --- a/provisioning-ansible/ansible/roles/common/files/security/sshd_config.j2 +++ /dev/null @@ -1,19 +0,0 @@ -# fspin.org sshd_config 2017-08-18 (f26, damaestro) -HostKey /etc/ssh/ssh_host_rsa_key -HostKey /etc/ssh/ssh_host_ecdsa_key -HostKey /etc/ssh/ssh_host_ed25519_key -SyslogFacility AUTHPRIV -PermitRootLogin no -AuthorizedKeysFile .ssh/authorized_keys -PasswordAuthentication no -ChallengeResponseAuthentication no -UsePAM yes -AllowTcpForwarding no -X11Forwarding no -PrintMotd no -PrintLastLog no -AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES -AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT -AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE -AcceptEnv XMODIFIERS -Subsystem sftp /usr/libexec/openssh/sftp-server diff --git a/provisioning-ansible/ansible/roles/common/handlers/denyhosts_c1.yml b/provisioning-ansible/ansible/roles/common/handlers/denyhosts_c1.yml deleted file mode 100644 index 86cdca6..0000000 --- a/provisioning-ansible/ansible/roles/common/handlers/denyhosts_c1.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# handlers to deal with securing the host from brute forcing attempts -- name: maintain the denyhosts daemon - become: true - service: - name=denyhosts - state=restarted diff --git a/provisioning-ansible/ansible/roles/common/handlers/fail2ban_c1.yml b/provisioning-ansible/ansible/roles/common/handlers/fail2ban_c1.yml deleted file mode 100644 index 5697f06..0000000 --- a/provisioning-ansible/ansible/roles/common/handlers/fail2ban_c1.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# handlers to deal with securing the host from brute forcing attempts -- name: maintain the fail2ban daemon - become: true - service: - name=fail2ban - state=restarted diff --git a/provisioning-ansible/ansible/roles/common/handlers/firewall_c1.yml b/provisioning-ansible/ansible/roles/common/handlers/firewall_c1.yml deleted file mode 100644 index 9a4efd0..0000000 --- a/provisioning-ansible/ansible/roles/common/handlers/firewall_c1.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# handlers to deal with maintaining the firewall -- name: maintain the state of the firewall daemon - become: true - service: - name=firewalld - state=restarted diff --git a/provisioning-ansible/ansible/roles/common/handlers/main.yml b/provisioning-ansible/ansible/roles/common/handlers/main.yml deleted file mode 100644 index 780e9b7..0000000 --- a/provisioning-ansible/ansible/roles/common/handlers/main.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -# handlers to deal with state for common operations -- name: restart the openssh daemon - become: true - service: - name=sshd - state=restarted diff --git a/provisioning-ansible/ansible/roles/common/handlers/tracker.yml b/provisioning-ansible/ansible/roles/common/handlers/tracker.yml deleted file mode 100644 index 16f660b..0000000 --- a/provisioning-ansible/ansible/roles/common/handlers/tracker.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -# handlers to deal with state for tracker operations -- name: restart tracker (ipv4 only) daemon - become: true - service: - name=opentracker-ipv4 - state=restarted - -- name: restart the transmission daemon - become: true - service: - name=transmission-daemon - state=restarted diff --git a/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml b/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml deleted file mode 100644 index 75848a3..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/base_packages.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -# install base packages for respin' -- name: install core tools used in the respin process - become: true - dnf: - name={{ item }} - state=latest - with_items: - - git - - mock diff --git a/provisioning-ansible/ansible/roles/common/tasks/main.yml b/provisioning-ansible/ansible/roles/common/tasks/main.yml deleted file mode 100644 index 87763b5..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/main.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# These are common plays that will be run on all nodes. - -- include: repository.yml - -- include: base_packages.yml - -- include: tools.yml - -- include: security.yml - -- include: users.yml diff --git a/provisioning-ansible/ansible/roles/common/tasks/repository.yml b/provisioning-ansible/ansible/roles/common/tasks/repository.yml deleted file mode 100644 index 84784f6..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/repository.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# ensure the right respositories are enabled and updated - -- name: ensure all updates are applied - become: true - dnf: - name=* - state=latest - diff --git a/provisioning-ansible/ansible/roles/common/tasks/security.yml b/provisioning-ansible/ansible/roles/common/tasks/security.yml deleted file mode 100644 index 44bd0b8..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/security.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- -# configure any security related options - -- name: install denyhosts - become: true - dnf: - name: denyhosts - state: latest - -- name: start and enable the denyhosts daemon - become: true - service: - name=denyhosts - state=started - enabled=true - -- name: configure the openssh daemon - become: true - copy: - src=security/sshd_config.j2 - dest=/etc/ssh/sshd_config - owner=root - group=root - mode=0644 - notify: restart the openssh daemon - -- name: start and enable the openssh daemon - become: true - service: - name=sshd - state=started - enabled=true - diff --git a/provisioning-ansible/ansible/roles/common/tasks/tools.yml b/provisioning-ansible/ansible/roles/common/tasks/tools.yml deleted file mode 100644 index 2cc1da9..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/tools.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# install base packages desired everywhere -- name: install useful sysadmin tools - become: true - dnf: - name={{ item }} - state=latest - with_items: - - atop - - iftop - - htop diff --git a/provisioning-ansible/ansible/roles/common/tasks/users.yml b/provisioning-ansible/ansible/roles/common/tasks/users.yml deleted file mode 100644 index b43f1cc..0000000 --- a/provisioning-ansible/ansible/roles/common/tasks/users.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -# configure all users, add to wheel, configure ssh keys - -- name: create user accounts - become: true - user: - name="{{ item.username }}" - comment="{{ item.realname }}" - groups=wheel,mock - append=yes - with_items: "{{ conf_users }}" - -- name: install authorized_keys - become: true - authorized_key: - user="{{ item.username }}" - key="{{ item.ssh_pub_key }}" - with_items: "{{ conf_users }}" diff --git a/provisioning-ansible/hosts/default b/provisioning-ansible/hosts/default new file mode 100644 index 0000000..bdb1f15 --- /dev/null +++ b/provisioning-ansible/hosts/default @@ -0,0 +1,9 @@ +[all] +tx.fspin.org +de.fspin.org + +[tx] +tx.fspin.org + +[de] +de.fspin.org diff --git a/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml b/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml new file mode 100644 index 0000000..d27886f --- /dev/null +++ b/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml @@ -0,0 +1,13 @@ +--- +# basic setup vars + +conf_users: + - username: "jon" + realname: "damaestro" + ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdBuKXUtNlPLrkksu8JBfmdcEDTLcR3DOssjQU5tphRrmhdeV3VrJlrXKZYy8l8gZKD/uzA/XKiZc9rUQgSn4LtufdJbiolhfMUkWCsS1fbONRQ2CgbofhnfKtSYtPj0QZCvi+671K+OVtLDDtof20xRWcKR6GarsRGrQkfOvSXTsunMrPrWA3DbxcsWM/e3DJv6Jcjjup3Pxoz97KzNH219jC/IVZXZcinyzV/biIXN0Omk05g0uQ9fCwGmd4QjQ3xv7j2f8gtp3bpZt9puZbkuWc3M9XwFQjgah5awMVEv8ZIDvIH2hzK1vBRPUu/2SEWB7h+AayM4101/iL+4V80ju/Idt9Hpfurme0GxrQ7qoAD1MdiIwrYNRH8P/vNIhKesTWv28bXwS67gdxI+6B2MvMbhxDI4JEnntN2boqau8LvpbMMBDJiL8VG6/mG5dS+4w5d0GFIpLQC6WOniuKfx+R0PFNK47FHoQh3juBd3KRS5auCfheKpvpeEsYxBOLR3YlQUFUVWEQcNorWRR3VFAB1LQwaNyBC66jKZz4ieOBAcU5mVLCrqrT63jMKnQLWUQXvjHzvZghzVY8LSb6Fa/1GNWwcnuVz7LLwlQVeyve5Z1s21NS+W+hoWMh6LAtNlnEYqJ0GEtQB6mZGpjsQRZG3I64yQzhQ5TKZY1cpQ== fspin" + - username: "linuxmodder" + realname: "linuxmodder" + ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcFhXdHMbpGRKFolSyAC50Mf5gmNogPexgPNLoIysoE linuxmodder@linwin.ameridea.net" + - username: "jbwillia" + realname: "jbwillia" + ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcHYw1yukHoOaSvDXpUF7lg2V/m87FSGuRW6hyAB7ut8ZJjwCO40mJfFkP0IeHWYw1r6+RtbJoeZssA9tGwLRxnNNva+zztY8DnrYSzW1OhVWC7jdVkzW2hLuIsEAEU4gCBFYE0nXtXOaGFaTHPPS/J1zPnmEgyPVANGV4lXqH72IfH+ANB81ytu3S7hiwNxBOWwYNZgb8l7EdKTRCUdeR+rsROBTUzkJtfRqwLHK1cIIVPac2SI8cJJvEMSJ/+Jx6DQ0HEDz6/+ahLYuLuO6Sgx//zOZr6cnJDWk5eUeU5J6bGYbDmO/p5U0fSKyP04bApON0YRDzTMP/ObCI3uXWO/4yp2WwmYl1hPj9GsUlezIWUPbMbdwbHDzwB+h/3yPLLfMV2sxdBvZf1J4WfJWTNLt75/G3+LAuZiK1J22eEaD9ymIKohVOmiCHMqKYJPHlhhDHotA4TzmRIjJf6NDq5qBQsOW9jqiWygVwSxJaZ3ObB3ZvqZiq9nHkGeS5uZyXqKhBxEcRHPXFD3BgbDvNtswcf5QS9qqPB0jdIYGGelxHZwZg8ka9Z9jhUvcGyBznp2WQCmk1JMwkeJBRwXxeNhFOX91IYzSVaQ/Dmb15TRYJbUvbb8uBYcqYbDACBwMwuntIiaXQPlWj8bilE05b3O/nV4cWUTRd5ZRnsZNXwQ== jbwillia@noname.math.vt.edu" diff --git a/provisioning-ansible/playbooks/initial_base_setup.yml b/provisioning-ansible/playbooks/initial_base_setup.yml new file mode 100644 index 0000000..2a75fee --- /dev/null +++ b/provisioning-ansible/playbooks/initial_base_setup.yml @@ -0,0 +1,9 @@ +--- +# setup the base server + +- hosts: all + roles: + - common +# - users + vars_files: + - ../playbooks/group_vars/initial_base_setup.yml diff --git a/provisioning-ansible/roles/common/files/security/fail2ban_conf.j2 b/provisioning-ansible/roles/common/files/security/fail2ban_conf.j2 new file mode 100644 index 0000000..89e2538 --- /dev/null +++ b/provisioning-ansible/roles/common/files/security/fail2ban_conf.j2 @@ -0,0 +1,69 @@ +# Fail2Ban main configuration file +# +# Comments: use '#' for comment lines and ';' (following a space) for inline comments +# +# Changes: in most of the cases you should not modify this +# file, but provide customizations in fail2ban.local file, e.g.: +# +# [Definition] +# loglevel = DEBUG +# + +[Definition] + +# Option: loglevel +# Notes.: Set the log level output. +# CRITICAL +# ERROR +# WARNING +# NOTICE +# INFO +# DEBUG +# Values: [ LEVEL ] Default: ERROR +# +loglevel = INFO + +# Option: logtarget +# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. +# Only one log target can be specified. +# If you change logtarget from the default value and you are +# using logrotate -- also adjust or disable rotation in the +# corresponding configuration file +# (e.g. /etc/logrotate.d/fail2ban on Debian systems) +# Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR +# +logtarget = /var/log/fail2ban.log + +# Option: syslogsocket +# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG +# auto uses platform.system() to determine predefined paths +# Values: [ auto | FILE ] Default: auto +syslogsocket = auto + +# Option: socket +# Notes.: Set the socket file. This is used to communicate with the daemon. Do +# not remove this file when Fail2ban runs. It will not be possible to +# communicate with the server afterwards. +# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.sock +# +socket = /var/run/fail2ban/fail2ban.sock + +# Option: pidfile +# Notes.: Set the PID file. This is used to store the process ID of the +# fail2ban server. +# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.pid +# +pidfile = /var/run/fail2ban/fail2ban.pid + +# Options: dbfile +# Notes.: Set the file for the fail2ban persistent data to be stored. +# A value of ":memory:" means database is only stored in memory +# and data is lost when fail2ban is stopped. +# A value of "None" disables the database. +# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3 +dbfile = /var/lib/fail2ban/fail2ban.sqlite3 + +# Options: dbpurgeage +# Notes.: Sets age at which bans should be purged from the database +# Values: [ SECONDS ] Default: 86400 (24hours) +dbpurgeage = 86400 diff --git a/provisioning-ansible/roles/common/files/security/sshd_config.j2 b/provisioning-ansible/roles/common/files/security/sshd_config.j2 new file mode 100644 index 0000000..df18c52 --- /dev/null +++ b/provisioning-ansible/roles/common/files/security/sshd_config.j2 @@ -0,0 +1,19 @@ +# fspin.org sshd_config 2017-08-18 (f26, damaestro) +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key +SyslogFacility AUTHPRIV +PermitRootLogin no +AuthorizedKeysFile .ssh/authorized_keys +PasswordAuthentication no +ChallengeResponseAuthentication no +UsePAM yes +AllowTcpForwarding no +X11Forwarding no +PrintMotd no +PrintLastLog no +AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES +AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT +AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE +AcceptEnv XMODIFIERS +Subsystem sftp /usr/libexec/openssh/sftp-server diff --git a/provisioning-ansible/roles/common/handlers/denyhosts_c1.yml b/provisioning-ansible/roles/common/handlers/denyhosts_c1.yml new file mode 100644 index 0000000..86cdca6 --- /dev/null +++ b/provisioning-ansible/roles/common/handlers/denyhosts_c1.yml @@ -0,0 +1,7 @@ +--- +# handlers to deal with securing the host from brute forcing attempts +- name: maintain the denyhosts daemon + become: true + service: + name=denyhosts + state=restarted diff --git a/provisioning-ansible/roles/common/handlers/fail2ban_c1.yml b/provisioning-ansible/roles/common/handlers/fail2ban_c1.yml new file mode 100644 index 0000000..5697f06 --- /dev/null +++ b/provisioning-ansible/roles/common/handlers/fail2ban_c1.yml @@ -0,0 +1,7 @@ +--- +# handlers to deal with securing the host from brute forcing attempts +- name: maintain the fail2ban daemon + become: true + service: + name=fail2ban + state=restarted diff --git a/provisioning-ansible/roles/common/handlers/firewall_c1.yml b/provisioning-ansible/roles/common/handlers/firewall_c1.yml new file mode 100644 index 0000000..9a4efd0 --- /dev/null +++ b/provisioning-ansible/roles/common/handlers/firewall_c1.yml @@ -0,0 +1,7 @@ +--- +# handlers to deal with maintaining the firewall +- name: maintain the state of the firewall daemon + become: true + service: + name=firewalld + state=restarted diff --git a/provisioning-ansible/roles/common/handlers/main.yml b/provisioning-ansible/roles/common/handlers/main.yml new file mode 100644 index 0000000..780e9b7 --- /dev/null +++ b/provisioning-ansible/roles/common/handlers/main.yml @@ -0,0 +1,7 @@ +--- +# handlers to deal with state for common operations +- name: restart the openssh daemon + become: true + service: + name=sshd + state=restarted diff --git a/provisioning-ansible/roles/common/handlers/tracker.yml b/provisioning-ansible/roles/common/handlers/tracker.yml new file mode 100644 index 0000000..16f660b --- /dev/null +++ b/provisioning-ansible/roles/common/handlers/tracker.yml @@ -0,0 +1,13 @@ +--- +# handlers to deal with state for tracker operations +- name: restart tracker (ipv4 only) daemon + become: true + service: + name=opentracker-ipv4 + state=restarted + +- name: restart the transmission daemon + become: true + service: + name=transmission-daemon + state=restarted diff --git a/provisioning-ansible/roles/common/tasks/base_packages.yml b/provisioning-ansible/roles/common/tasks/base_packages.yml new file mode 100644 index 0000000..75848a3 --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/base_packages.yml @@ -0,0 +1,10 @@ +--- +# install base packages for respin' +- name: install core tools used in the respin process + become: true + dnf: + name={{ item }} + state=latest + with_items: + - git + - mock diff --git a/provisioning-ansible/roles/common/tasks/main.yml b/provisioning-ansible/roles/common/tasks/main.yml new file mode 100644 index 0000000..87763b5 --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/main.yml @@ -0,0 +1,12 @@ +--- +# These are common plays that will be run on all nodes. + +- include: repository.yml + +- include: base_packages.yml + +- include: tools.yml + +- include: security.yml + +- include: users.yml diff --git a/provisioning-ansible/roles/common/tasks/repository.yml b/provisioning-ansible/roles/common/tasks/repository.yml new file mode 100644 index 0000000..84784f6 --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/repository.yml @@ -0,0 +1,9 @@ +--- +# ensure the right respositories are enabled and updated + +- name: ensure all updates are applied + become: true + dnf: + name=* + state=latest + diff --git a/provisioning-ansible/roles/common/tasks/security.yml b/provisioning-ansible/roles/common/tasks/security.yml new file mode 100644 index 0000000..44bd0b8 --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/security.yml @@ -0,0 +1,33 @@ +--- +# configure any security related options + +- name: install denyhosts + become: true + dnf: + name: denyhosts + state: latest + +- name: start and enable the denyhosts daemon + become: true + service: + name=denyhosts + state=started + enabled=true + +- name: configure the openssh daemon + become: true + copy: + src=security/sshd_config.j2 + dest=/etc/ssh/sshd_config + owner=root + group=root + mode=0644 + notify: restart the openssh daemon + +- name: start and enable the openssh daemon + become: true + service: + name=sshd + state=started + enabled=true + diff --git a/provisioning-ansible/roles/common/tasks/tools.yml b/provisioning-ansible/roles/common/tasks/tools.yml new file mode 100644 index 0000000..2cc1da9 --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/tools.yml @@ -0,0 +1,11 @@ +--- +# install base packages desired everywhere +- name: install useful sysadmin tools + become: true + dnf: + name={{ item }} + state=latest + with_items: + - atop + - iftop + - htop diff --git a/provisioning-ansible/roles/common/tasks/users.yml b/provisioning-ansible/roles/common/tasks/users.yml new file mode 100644 index 0000000..b43f1cc --- /dev/null +++ b/provisioning-ansible/roles/common/tasks/users.yml @@ -0,0 +1,18 @@ +--- +# configure all users, add to wheel, configure ssh keys + +- name: create user accounts + become: true + user: + name="{{ item.username }}" + comment="{{ item.realname }}" + groups=wheel,mock + append=yes + with_items: "{{ conf_users }}" + +- name: install authorized_keys + become: true + authorized_key: + user="{{ item.username }}" + key="{{ item.ssh_pub_key }}" + with_items: "{{ conf_users }}" From d0ab4e2dbd757a73510038d21870f29160e341a1 Mon Sep 17 00:00:00 2001 From: Jonathan Steffan Date: Aug 22 2017 03:22:19 +0000 Subject: [PATCH 3/5] Remove requirement for password as we disable it. --- diff --git a/provisioning-ansible/roles/common/tasks/users.yml b/provisioning-ansible/roles/common/tasks/users.yml index b43f1cc..c5438c2 100644 --- a/provisioning-ansible/roles/common/tasks/users.yml +++ b/provisioning-ansible/roles/common/tasks/users.yml @@ -16,3 +16,14 @@ user="{{ item.username }}" key="{{ item.ssh_pub_key }}" with_items: "{{ conf_users }}" + +- name: clear user passwords on first run + shell: passwd -d "{{ item.username }}" + args: + creates: /root/users_provisioned + with_items: "{{ conf_users }}" + +- name: note users are provisioned + file: + path=/root/users_provisioned + state=touch From d410ee04c518e8fa3c36c73cb4f225e2b24acf7b Mon Sep 17 00:00:00 2001 From: Jonathan Steffan Date: Aug 22 2017 04:48:04 +0000 Subject: [PATCH 4/5] Update ssh keys. Update using sudo when needed. --- diff --git a/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml b/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml index d27886f..1222862 100644 --- a/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml +++ b/provisioning-ansible/playbooks/group_vars/initial_base_setup.yml @@ -4,10 +4,10 @@ conf_users: - username: "jon" realname: "damaestro" - ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDdBuKXUtNlPLrkksu8JBfmdcEDTLcR3DOssjQU5tphRrmhdeV3VrJlrXKZYy8l8gZKD/uzA/XKiZc9rUQgSn4LtufdJbiolhfMUkWCsS1fbONRQ2CgbofhnfKtSYtPj0QZCvi+671K+OVtLDDtof20xRWcKR6GarsRGrQkfOvSXTsunMrPrWA3DbxcsWM/e3DJv6Jcjjup3Pxoz97KzNH219jC/IVZXZcinyzV/biIXN0Omk05g0uQ9fCwGmd4QjQ3xv7j2f8gtp3bpZt9puZbkuWc3M9XwFQjgah5awMVEv8ZIDvIH2hzK1vBRPUu/2SEWB7h+AayM4101/iL+4V80ju/Idt9Hpfurme0GxrQ7qoAD1MdiIwrYNRH8P/vNIhKesTWv28bXwS67gdxI+6B2MvMbhxDI4JEnntN2boqau8LvpbMMBDJiL8VG6/mG5dS+4w5d0GFIpLQC6WOniuKfx+R0PFNK47FHoQh3juBd3KRS5auCfheKpvpeEsYxBOLR3YlQUFUVWEQcNorWRR3VFAB1LQwaNyBC66jKZz4ieOBAcU5mVLCrqrT63jMKnQLWUQXvjHzvZghzVY8LSb6Fa/1GNWwcnuVz7LLwlQVeyve5Z1s21NS+W+hoWMh6LAtNlnEYqJ0GEtQB6mZGpjsQRZG3I64yQzhQ5TKZY1cpQ== fspin" + ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDccd86FixaBbKMBZ2urqB19Lqcq0AQqakyfUuk/NLlePj89KhsZCl8jf/sestXHW5Ykr1CWU5fEXJRGgTWVQIS8wZ+jSeWgEgLbbWfd/XHkyqTaMK+luk5APK0EOvqUR4tF5vJQxFkbLJ7o5kX5FoytAKbmDeeMYsFTHjSAFmpqolTKsLB2rVD/wgUhlGqI61pbdLX8QFb+SYPyhhSNZ7jaT9sIQ/JnnQx3k6uT4W5mKDBoVgVVTDjQjJF5/Hf258o+/vS+MaGwi9mIW9xXw4JS5h0Pa1iXwqMxsFoAR5nIEW2kg/uIq5O5iiCOTk7TfEEM3TavoYLynwh3ZEYw1g7S8yji+QeBI3yRDJYWyC+WWghm1s1A3W5ty85pPZGWIqtCqvyZF+vlHYeQUD/AVaVHX/nEXPaHA5XXN+S+uldqTMeLir62a5BfSkbOxqHSIlXqYEgk9tTU8TvOq/bsytbGE4o42ID+InUzm9CIanj+gEX+5XU/X/LYzdP8I5WY88F1uEN7DppZ3GYtFrBqCJO7pqYigXZwfvTmncgCVRjbKeAY/sChYyW3gZkqv158h3lanVcs2hDyqcX0gBFALi4hi+FNlNZRsP7q6YHkKsXA/iOY49h9l0wI2/po9vqfQDM1PrFL9QCr15iHcxwmS5u9r7DWVPxvwZw2pG2W0llSQgyEezelN7lO60LyZ+t3CziBkEFpouncfloQKxQ3OO4yKjWCLRGS60ucc7er7JMBPMG7YrPfmHaRrLOCS9EspagLFma/hCxJa4gjqb3FBSd+qVeCKFAlrHkmjIAMyktN87MkSDcghAn8OvurFwb1QL7dSN6mfc75Fb/TU8t5ox3B0NTAt8gTi0+TdpGvvIVAYYgyADt3iP92jVprmeTt5DBwb4nsELRk7DbZRSPZDFFhBW3dsW7EXW0iNt7ilyJV2uM/8uX+2++mL9eqmx3lN+n4e3L1lRr3A3cyXry0ZTMyzoMEE/esc4jNxtYIqIoKFJveUzMT/uBvJSnAfGZOUZe1aQdXnlmep1HPbMdyih96PKFjz1g2O/apbpYq32l1d2RyfTr3BFW1wQ1v1nkM7ojcDBnaR8WdYzuaI1lLrKK6xXKvmpPhBkWJwaXB9HIYJKPQdy4wOskpwlVnmBlb49KxUqrLvOnlxJ9i5GiePjBTfPIE0pcpd7TUtFKeQOx0woCmU8tksqExK1LCeaNdacs2Q4uwz7mMoEec0UgKFDQ5sXVCVPcfEUg+0vp+hixz9I96rQrFVPo8G+582ejJX8BsCKYmRmvcxv+quqgjXa5PSjvmgG+foHmtFr6mpY++FDPgV/m/XGVs3R7vw9KphJ+rl3OSPC9XAyjCQskOStf fspin" - username: "linuxmodder" realname: "linuxmodder" ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKcFhXdHMbpGRKFolSyAC50Mf5gmNogPexgPNLoIysoE linuxmodder@linwin.ameridea.net" - username: "jbwillia" realname: "jbwillia" - ssh_pub_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcHYw1yukHoOaSvDXpUF7lg2V/m87FSGuRW6hyAB7ut8ZJjwCO40mJfFkP0IeHWYw1r6+RtbJoeZssA9tGwLRxnNNva+zztY8DnrYSzW1OhVWC7jdVkzW2hLuIsEAEU4gCBFYE0nXtXOaGFaTHPPS/J1zPnmEgyPVANGV4lXqH72IfH+ANB81ytu3S7hiwNxBOWwYNZgb8l7EdKTRCUdeR+rsROBTUzkJtfRqwLHK1cIIVPac2SI8cJJvEMSJ/+Jx6DQ0HEDz6/+ahLYuLuO6Sgx//zOZr6cnJDWk5eUeU5J6bGYbDmO/p5U0fSKyP04bApON0YRDzTMP/ObCI3uXWO/4yp2WwmYl1hPj9GsUlezIWUPbMbdwbHDzwB+h/3yPLLfMV2sxdBvZf1J4WfJWTNLt75/G3+LAuZiK1J22eEaD9ymIKohVOmiCHMqKYJPHlhhDHotA4TzmRIjJf6NDq5qBQsOW9jqiWygVwSxJaZ3ObB3ZvqZiq9nHkGeS5uZyXqKhBxEcRHPXFD3BgbDvNtswcf5QS9qqPB0jdIYGGelxHZwZg8ka9Z9jhUvcGyBznp2WQCmk1JMwkeJBRwXxeNhFOX91IYzSVaQ/Dmb15TRYJbUvbb8uBYcqYbDACBwMwuntIiaXQPlWj8bilE05b3O/nV4cWUTRd5ZRnsZNXwQ== jbwillia@noname.math.vt.edu" + ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH0KujBs2M5QFckZn+/7r6PC02aKZDHp/+pcoRbdJN46 jbwillia@noname.math.vt.edu" diff --git a/provisioning-ansible/roles/common/tasks/users.yml b/provisioning-ansible/roles/common/tasks/users.yml index c5438c2..9c30459 100644 --- a/provisioning-ansible/roles/common/tasks/users.yml +++ b/provisioning-ansible/roles/common/tasks/users.yml @@ -18,12 +18,14 @@ with_items: "{{ conf_users }}" - name: clear user passwords on first run + become: true shell: passwd -d "{{ item.username }}" args: creates: /root/users_provisioned with_items: "{{ conf_users }}" - name: note users are provisioned + become: true file: path=/root/users_provisioned state=touch From 65e92b92e6b6cc7eed87965049c82c3d2b944c51 Mon Sep 17 00:00:00 2001 From: Jonathan Steffan Date: Aug 22 2017 05:11:42 +0000 Subject: [PATCH 5/5] Update README on how to update user passwords and run subsequent playbooks. --- diff --git a/provisioning-ansible/README.md b/provisioning-ansible/README.md index c7cc93b..bc674ea 100644 --- a/provisioning-ansible/README.md +++ b/provisioning-ansible/README.md @@ -24,7 +24,7 @@ Go into the configuration profile and change the kernel to boot to GRUB 2. Conne enforcing=0 autorelabel=1 ``` -This will auto-reboot, ending in an offline node. Enable Lassie booting. Boot the Linode. +This will auto-reboot, resulting with an offline node. Enable Lassie booting. Boot the Linode. ### Run Ansible Initial Configuration Run the initial configuration as `root` to create users and install base programs. After running this playbook, the `root` user will no longer work. @@ -35,3 +35,15 @@ Run the playbook as `root`: ansible-playbook -u root -l $loc --ask-pass playbooks/initial_base_setup.yml ``` +### Future Playbook Runs +Once a node is provisioned, you need to login as $user and set a password. + +```shell +ssh $user@$loc.fspin.org +[$user@$loc ~]$ passwd +``` + +For further playbook runs, use the following syntax: +```shell +ansible-playbook -u $user -l $loc --ask-sudo-pass playbooks/$target +```