initial

config.yml

@@ -0,0 +1,63 @@
+---
+- name: Sync Configuration Files
+  hosts: servers
+  become: yes
+  vars:
+    worker_limit: 1024  # Global variable used in the template
+
+  tasks:
+    - name: Deploy sssd.conf
+      template:
+        src: templates/sssd.conf
+        dest: /etc/sssd/conf.d/sssd.conf
+        owner: root
+        group: root
+        mode: '0600'
+      notify: Restart sssd  # This triggers the handler only if the file changes
+
+    - name: Deploy ldap.conf
+      template:
+        src: templates/ldap.conf
+        dest: /etc/openldap/ldap.conf
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Deploy sshd.conf
+      template:
+        src: templates/sshd.conf
+        dest: /etc/ssh/sshd_config.d/60_lab.conf
+        owner: root
+        group: root
+        mode: '0600'
+
+    - name: Deploy ssh.conf
+      template:
+        src: templates/ssh.conf
+        dest: /etc/ssh/ssh_config.d/60_lab.conf
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Deploy sudoers
+      template:
+        src: templates/lab-sudo
+        dest: /etc/sudoers.d/sudogroup
+        owner: root
+        group: root
+        mode: '0644'
+
+    - name: Root password
+      user:
+        name: root
+        password: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5."
+
+    - name: Disable SELinux
+      ansible.builtin.selinux:
+        state: disabled
+
+  handlers:
+    - name: Restart sssd
+      service:
+        name: sssd
+        state: restarted

group_vars/all.yml

@@ -0,0 +1,29 @@
+common_packages:
+  - epel-release
+  - sssd
+  - sssd-ldap
+  - net-tools
+  - screen
+  - lsof
+  - sudo
+  - sssd
+  - xfsprogs
+  - parted
+  - wget
+  - tar
+  - bzip2
+  - unzip
+  - autofs
+  - nfs-utils
+  - bash-completion
+  - git
+  - sysstat
+  - atop
+  - htop
+  - iftop
+  - iotop
+  - pv
+  - dstat
+  - nmap
+  - rsync
+  - vim

inventory.ini

@@ -0,0 +1,9 @@
+[servers]
+atc-docker01.dell-atc.lan ansible_user=root
+atc-docker02.dell-atc.lan ansible_user=root
+atc-db01.dell-atc.lan ansible_user=root
+atc-lake01.dell-atc.lan ansible_user=root
+atc-elastic01.dell-atc.lan ansible_user=root
+atc-kafka01.dell-atc.lan ansible_user=root
+atc-portal01.dell-atc.lan ansible_user=root
+atc-grafana.dell-atc.lan ansible_user=root

packages.yml

@@ -0,0 +1,18 @@
+---
+- name: Ensure baseline packages are installed
+  hosts: all
+  become: true
+  pre_tasks:
+    - name: EPEL
+      ansible.builtin.package:
+        name: epel-release
+        state: present
+    - name: SELinux Python Tools
+      ansible.builtin.package:
+        name: python3-policycoreutils
+        state: present
+  tasks:
+    - name: Install packages
+      ansible.builtin.package:
+        name: "{{common_packages}}"
+        state: present

templates/lab-sudo

@@ -0,0 +1,2 @@
+%sudo ALL=(ALL)	NOPASSWD:	ALL
+

templates/ldap.conf

@@ -0,0 +1,32 @@
+#
+# LDAP Defaults
+#
+
+# See ldap.conf(5) for details
+# This file should be world readable but not world writable.
+
+#BASE	dc=example,dc=com
+#URI	ldap://ldap.example.com ldap://ldap-master.example.com:666
+
+#SIZELIMIT	12
+#TIMELIMIT	15
+#DEREF		never
+
+# When no CA certificates are specified the Shared System Certificates
+# are in use. In order to have these available along with the ones specified
+# by TLS_CACERTDIR one has to include them explicitly:
+#TLS_CACERT	/etc/pki/tls/cert.pem
+
+# System-wide Crypto Policies provide up to date cipher suite which should
+# be used unless one needs a finer grinded selection of ciphers. Hence, the
+# PROFILE=SYSTEM value represents the default behavior which is in place
+# when no explicit setting is used. (see openssl-ciphers(1) for more info)
+#TLS_CIPHER_SUITE PROFILE=SYSTEM
+
+# Turning this off breaks GSSAPI used with krb5 when rdns = false
+SASL_NOCANON	on
+
+BASE dc=dell-atc,dc=lan
+URI ldap://atc-mgt01.dell-atc.lan
+
+

templates/ssh.conf

@@ -0,0 +1,3 @@
+Host *
+    ForwardAgent yes
+

templates/sshd.conf

@@ -0,0 +1,4 @@
+PermitRootLogin yes
+AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
+AuthorizedKeysCommandUser nobody
+

templates/sssd.conf

@@ -0,0 +1,48 @@
+# ------------------------------------------------------------------
+# /etc/sssd/sssd.conf
+# Do not directly edit this file! It will be overwritten during boot
+# or configuration changes
+# ------------------------------------------------------------------
+#
+[sssd]
+services = nss, pam, ssh, autofs, sudo
+domains = default
+[nss]
+[pam]
+[sudo]
+[autofs]
+[ssh]
+[pac]
+[ifp]
+[domain/default]
+# debug_level = 9
+ldap_schema = rfc2307
+#
+autofs_provider = ldap
+id_provider     = ldap
+auth_provider   = ldap
+chpass_provider = ldap
+sudo_provider   = ldap
+# Fix EL7 automount bug: 
+# setautomntent: lookup(sss): setautomntent: No such file or directory
+ldap_autofs_map_object_class   = automountMap
+ldap_autofs_map_name           = ou
+ldap_autofs_entry_object_class = automount
+ldap_autofs_entry_key          = cn
+ldap_autofs_entry_value        = automountInformation
+ldap_chpass_update_last_change = true
+# Kerberos - not used
+krb5_realm            = EXAMPLE.COM
+krb5_server           = kerberos.example.com
+# LDAP settings
+ldap_id_use_start_tls = False
+ldap_tls_reqcert      = never
+cache_credentials     = True
+ldap_tls_cacertdir    = /etc/openldap/cacerts
+#
+
+ldap_uri = ldap://atc-mgt01.dell-atc.lan
+ldap_search_base = dc=dell-atc,dc=lan
+
+# override_homedir = /labusers/%u
+