diff --git a/config.yml b/config.yml new file mode 100644 index 0000000..a6009d0 --- /dev/null +++ b/config.yml @@ -0,0 +1,63 @@ +--- +- name: Sync Configuration Files + hosts: servers + become: yes + vars: + worker_limit: 1024 # Global variable used in the template + + tasks: + - name: Deploy sssd.conf + template: + src: templates/sssd.conf + dest: /etc/sssd/conf.d/sssd.conf + owner: root + group: root + mode: '0600' + notify: Restart sssd # This triggers the handler only if the file changes + + - name: Deploy ldap.conf + template: + src: templates/ldap.conf + dest: /etc/openldap/ldap.conf + owner: root + group: root + mode: '0644' + + - name: Deploy sshd.conf + template: + src: templates/sshd.conf + dest: /etc/ssh/sshd_config.d/60_lab.conf + owner: root + group: root + mode: '0600' + + - name: Deploy ssh.conf + template: + src: templates/ssh.conf + dest: /etc/ssh/ssh_config.d/60_lab.conf + owner: root + group: root + mode: '0644' + + - name: Deploy sudoers + template: + src: templates/lab-sudo + dest: /etc/sudoers.d/sudogroup + owner: root + group: root + mode: '0644' + + - name: Root password + user: + name: root + password: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5." + + - name: Disable SELinux + ansible.builtin.selinux: + state: disabled + + handlers: + - name: Restart sssd + service: + name: sssd + state: restarted diff --git a/group_vars/all.yml b/group_vars/all.yml new file mode 100644 index 0000000..474ad54 --- /dev/null +++ b/group_vars/all.yml @@ -0,0 +1,29 @@ +common_packages: + - epel-release + - sssd + - sssd-ldap + - net-tools + - screen + - lsof + - sudo + - sssd + - xfsprogs + - parted + - wget + - tar + - bzip2 + - unzip + - autofs + - nfs-utils + - bash-completion + - git + - sysstat + - atop + - htop + - iftop + - iotop + - pv + - dstat + - nmap + - rsync + - vim diff --git a/inventory.ini b/inventory.ini new file mode 100644 index 0000000..97d0b7a --- /dev/null +++ b/inventory.ini @@ -0,0 +1,9 @@ +[servers] +atc-docker01.dell-atc.lan ansible_user=root +atc-docker02.dell-atc.lan ansible_user=root +atc-db01.dell-atc.lan ansible_user=root +atc-lake01.dell-atc.lan ansible_user=root +atc-elastic01.dell-atc.lan ansible_user=root +atc-kafka01.dell-atc.lan ansible_user=root +atc-portal01.dell-atc.lan ansible_user=root +atc-grafana.dell-atc.lan ansible_user=root diff --git a/packages.yml b/packages.yml new file mode 100644 index 0000000..bacf4d7 --- /dev/null +++ b/packages.yml @@ -0,0 +1,18 @@ +--- +- name: Ensure baseline packages are installed + hosts: all + become: true + pre_tasks: + - name: EPEL + ansible.builtin.package: + name: epel-release + state: present + - name: SELinux Python Tools + ansible.builtin.package: + name: python3-policycoreutils + state: present + tasks: + - name: Install packages + ansible.builtin.package: + name: "{{common_packages}}" + state: present diff --git a/templates/lab-sudo b/templates/lab-sudo new file mode 100644 index 0000000..295482f --- /dev/null +++ b/templates/lab-sudo @@ -0,0 +1,2 @@ +%sudo ALL=(ALL) NOPASSWD: ALL + diff --git a/templates/ldap.conf b/templates/ldap.conf new file mode 100644 index 0000000..764a5f6 --- /dev/null +++ b/templates/ldap.conf @@ -0,0 +1,32 @@ +# +# LDAP Defaults +# + +# See ldap.conf(5) for details +# This file should be world readable but not world writable. + +#BASE dc=example,dc=com +#URI ldap://ldap.example.com ldap://ldap-master.example.com:666 + +#SIZELIMIT 12 +#TIMELIMIT 15 +#DEREF never + +# When no CA certificates are specified the Shared System Certificates +# are in use. In order to have these available along with the ones specified +# by TLS_CACERTDIR one has to include them explicitly: +#TLS_CACERT /etc/pki/tls/cert.pem + +# System-wide Crypto Policies provide up to date cipher suite which should +# be used unless one needs a finer grinded selection of ciphers. Hence, the +# PROFILE=SYSTEM value represents the default behavior which is in place +# when no explicit setting is used. (see openssl-ciphers(1) for more info) +#TLS_CIPHER_SUITE PROFILE=SYSTEM + +# Turning this off breaks GSSAPI used with krb5 when rdns = false +SASL_NOCANON on + +BASE dc=dell-atc,dc=lan +URI ldap://atc-mgt01.dell-atc.lan + + diff --git a/templates/ssh.conf b/templates/ssh.conf new file mode 100644 index 0000000..469fd85 --- /dev/null +++ b/templates/ssh.conf @@ -0,0 +1,3 @@ +Host * + ForwardAgent yes + diff --git a/templates/sshd.conf b/templates/sshd.conf new file mode 100644 index 0000000..343ce35 --- /dev/null +++ b/templates/sshd.conf @@ -0,0 +1,4 @@ +PermitRootLogin yes +AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys +AuthorizedKeysCommandUser nobody + diff --git a/templates/sssd.conf b/templates/sssd.conf new file mode 100644 index 0000000..b70634e --- /dev/null +++ b/templates/sssd.conf @@ -0,0 +1,48 @@ +# ------------------------------------------------------------------ +# /etc/sssd/sssd.conf +# Do not directly edit this file! It will be overwritten during boot +# or configuration changes +# ------------------------------------------------------------------ +# +[sssd] +services = nss, pam, ssh, autofs, sudo +domains = default +[nss] +[pam] +[sudo] +[autofs] +[ssh] +[pac] +[ifp] +[domain/default] +# debug_level = 9 +ldap_schema = rfc2307 +# +autofs_provider = ldap +id_provider = ldap +auth_provider = ldap +chpass_provider = ldap +sudo_provider = ldap +# Fix EL7 automount bug: +# setautomntent: lookup(sss): setautomntent: No such file or directory +ldap_autofs_map_object_class = automountMap +ldap_autofs_map_name = ou +ldap_autofs_entry_object_class = automount +ldap_autofs_entry_key = cn +ldap_autofs_entry_value = automountInformation +ldap_chpass_update_last_change = true +# Kerberos - not used +krb5_realm = EXAMPLE.COM +krb5_server = kerberos.example.com +# LDAP settings +ldap_id_use_start_tls = False +ldap_tls_reqcert = never +cache_credentials = True +ldap_tls_cacertdir = /etc/openldap/cacerts +# + +ldap_uri = ldap://atc-mgt01.dell-atc.lan +ldap_search_base = dc=dell-atc,dc=lan + +# override_homedir = /labusers/%u +