etcinitd/ansible-user-management

ansible-user-management

Ansible User management

Configure users, group, SSH keys and administrative sudo access. The role can:

• Add and remove groups
• Add and remove users
• Install SSH keys for users
• Configure sudo to allow root access for the administration group

Requirements

Ansible 2.1.2 or above

It will work with:

• All Ubuntu
• All Debian

Role Variables

Users management playbook:

ansible-playbook playbooks/manage_users.yaml --become --private-key

Users management playbook inventory file:

ip/hostname of instance where playbook will be deployed

• manage_users role A list containing dictionaries of configuration. Each list item can have the following elements. Italic text indicates the default.

  • name required
  • full_name (Unknown user)
  • state (present)
  • uid
  • group (item.name)
  • groups
  • shell ({{ users_default_shell }})
  • password ({{ users_default_password }})
  • home (/home/{{item.name}})
  • createhome ({{ users_create_homedirs }})
  • system
  • is_admin

All other variable defaults are given below.

is_admin is a boolean. If set, the user is added to the OSs admin group.

All other items correspond to the ansible users module parameters.

Example

users:
  - name: nowshad
    full_name: Nowshad Ibne Amin
    is_admin: true
    uid: 1001
    groups:
      - 'users'
      - 'ubuntu'
      - 'bin'
      - 'devs'
    ssh_key:
      - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDvv9z60YR1YE4Z2OsPrpQMlGttU7ZXOeKwPXPEYAkmpa1LHlvR+Bzg2SkmGm6RJiYQn+UWIiHqqASQ/2IcCnE1+JeYny/5Rxn7rkPFAydNc9Me24ssdetLGhOdwhQ6EwuRr3T5jieVQO8lb6bcoXglbblRUN9+oUVg8o2upkex0IFI2uYqzIyQTWMnGENUbV5rbih0fkkT+QAgILhEyv9DR2/Vs2AC7abGIBcDtk3tYTAI332Cd7RbUf2A49FXPdz+RPj+mJGelse1ok9qf3dzWJQ+fckvXuh+e+/RpgV/ldRnfbAxcnqW/ErZZclaMGsiGMay2fhD9YkcQDc66g3C70wtKT2EmILRqNlmtkPGrD14nME+FN5cj4vImYGb5PzMY0jfwAJSbuOEu5WAQFDAsOp7NiHSgc/gPhkQNiuxY6FR+nrS+goQV4iXdq3pdRiP2uf3SVGlZ06txBVeQpv4EexgF+51uH9ppHRX+gnZ59oxpGgBhzIQa7p/yL7feoo95aC6/BEh39jkplfTzJSy6v8VImyyBbo1xyXmXyg4GojfUlq0i2nf9Lk79ffv7xms9NlRK6nrTY9/ROalXeaZokR2seBqVAj0ozDT+RL7d1luW/qgljVfFr+S+kb0XRcBusZzrZS9JLfpahUKxgI7fmn/lsnoAWevJU33XjkV8w== your_email@example.com"

Groups

• users_groups

A list of user groups to create. Each list item can have the following elements. Italic text indicates the default.

• name required
• state (present)
• system
• gid

Example

users_groups:
  - name: devs
    gid: 1003789
  - name: ops
    gid: 10104

Tuning configuration

• users_default_shell

The default shell for a user if none is specified. Defaults to /bin/bash

• users_create_homedirs

Create home dirs for new users? Set this to false if you manage home directories in some other way. Defaults to true.

• users_per_user_groups

Create groups for users with the same name as the users group. Defaults to true

Sudo configuration

• users_manage_admin_sudoers

If true, create sudo configuration to allow users in the admin group to become root via sudo. Defaults to true

• users_admin_uses_ansible

If true, assume the admin group is also used to run Ansible jobs. This disables requiretty for the admin group in the sudoers configuration. Defaults to true

• users_admin_sudo_password

If true require a password for sudo, false to not require a password. Defaults to true

Ansible Task Profiling

Usage:

Make a directory called callback_plugins next to your playbook and put profile_tasks.py inside of it.

.. code-block:: bash

mkdir callback_plugins
cd callback_plugins
wget https://raw.githubusercontent.com/jlafon/ansible-profile/master/callback_plugins/profile_tasks.py

Now, run your playbook just as you normally would!

ansible PLAY RECAP ******************************************************************** manage_users | Create groups for each user with their name -------------- 7.17s manage_users | Create users --------------------------------------------- 6.78s sudo-permission | Admin sudoers ----------------------------------------- 4.59s manage_users | Create groups -------------------------------------------- 4.09s manage_users | SSH keys ------------------------------------------------- 3.83s sudo-permission | Sudo installed ---------------------------------------- 2.47s manage_users | Add admin users to admin group --------------------------- 2.44s manage_users | Get OS specific values ----------------------------------- 0.02s Playbook finished: Sat Nov 14 18:41:10 2015, 8 total tasks. 0:00:31 elapsed.

If for some reason you want to disable this temporarily, set the environment variable ANSIBLE_PROFILE_DISABLE to any value (even an empty string).