11 | This ansible role is used to create users on server. 12 |
13 | 14 |
15 |
16 |
17 | 
21 |
22 |
23 | 
32 |
33 |
34 | 
35 |
36 |
37 | 
38 |
39 |
40 | 
41 |
42 |
43 |
We are The Cloud Experts!
125 |We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.
127 | 128 | [website]: https://clouddrove.com 129 | [github]: https://github.com/clouddrove 130 | [linkedin]: https://cpco.io/linkedin 131 | [twitter]: https://twitter.com/clouddrove/ 132 | [email]: https://clouddrove.com/contact-us.html 133 | [terraform_modules]: https://github.com/clouddrove?utf8=%E2%9C%93&q=terraform-&type=&language= 134 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | # 3 | # This is the canonical configuration for the `README.md` 4 | # Run `make readme` to rebuild the `README.md` 5 | # 6 | 7 | # Name of this project 8 | name: Ansible Role User 9 | 10 | # License of this project 11 | license: "MIT" 12 | 13 | # Canonical GitHub repo 14 | github_repo: clouddrove/ansible-role-user 15 | 16 | # Badges to display 17 | badges: 18 | - name: "Ansible" 19 | image: "https://img.shields.io/badge/Ansible-2.8-green?style=flat&logo=ansible" 20 | url: "https://www.ansible.com" 21 | - name: "Licence" 22 | image: "https://img.shields.io/badge/License-MIT-blue.svg" 23 | url: "LICENSE.md" 24 | - name: "Distribution" 25 | image: "https://img.shields.io/badge/ubuntu-16.x-orange?style=flat&logo=ubuntu" 26 | url: "https://ubuntu.com/" 27 | - name: "Distribution" 28 | image: "https://img.shields.io/badge/ubuntu-18.x-orange?style=flat&logo=ubuntu" 29 | url: "https://ubuntu.com/" 30 | # Prerequesties to display 31 | # yamllint disable 32 | prerequesties: 33 | - name: "Ansible2.8" 34 | url: "https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html" 35 | - name: "Python" 36 | url: "https://www.python.org/downloads" 37 | # yamllint enable 38 | # What Includes to display 39 | what_includes: 40 | - name: "user management" 41 | 42 | # description of this project 43 | description: |- 44 | This ansible role is used to create users on server. 45 | 46 | # How to use this project 47 | usage: |- 48 | ```yaml 49 | - hosts: localhost 50 | remote_user: ubuntu 51 | become: true 52 | roles: 53 | - clouddrove.ansible_role_user 54 | ``` 55 | # Variables use in the project 56 | variables: |- 57 | ```yaml 58 | users: 59 | - username: nikita 60 | use_sudo: true 61 | 62 | - username: anmol 63 | use_sudo: false 64 | 65 | rm_users: 66 | - username: sohan 67 | ``` 68 | # How to install project 69 | installation: |- 70 | ```console 71 | $ ansible-galaxy install clouddrove.ansible_role_user 72 | ``` 73 | -------------------------------------------------------------------------------- /defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | # users list to create 4 | users: 5 | - username: anmol 6 | use_sudo: true 7 | zsh_theme: steeef 8 | 9 | # users list to remove 10 | rm_user_flag: false 11 | # rm_users: 12 | # - username: user #username 13 | -------------------------------------------------------------------------------- /meta/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | dependencies: [] 3 | 4 | galaxy_info: 5 | author: Anmol Nagpal 6 | description: This ansible role is used to create users on server. 7 | company: "CloudDrove Inc." 8 | license: "license (BSD, MIT)" 9 | role_name: ansible_role_user 10 | namespace: "clouddrove" 11 | min_ansible_version: 2.4 12 | platforms: 13 | - name: Debian 14 | versions: 15 | - jessie 16 | - stretch 17 | - name: Ubuntu 18 | versions: 19 | - trusty 20 | - xenial 21 | - bionic 22 | galaxy_tags: 23 | - server 24 | - ubuntu 25 | - linux 26 | - user 27 | - users 28 | -------------------------------------------------------------------------------- /tasks/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | - import_tasks: users.yml 4 | - import_tasks: zsh.yml 5 | -------------------------------------------------------------------------------- /tasks/users.yml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | - name: add users | create users, shell, home dirs 4 | user: 5 | name: "{{ item.username }}" 6 | shell: "/bin/bash" 7 | createhome: true 8 | comment: 'created with ansible' 9 | with_items: '{{ users }}' 10 | 11 | - name: modify .ssh permissions 12 | file: 13 | path: '/home/{{ item.username }}/.ssh' 14 | state: directory 15 | owner: "{{ item.username }}" 16 | group: "{{ item.username }}" 17 | mode: 0700 18 | with_items: '{{ users }}' 19 | 20 | - name: setup | authorized key upload 21 | authorized_key: 22 | user: "{{ item.username }}" 23 | key: "{{ lookup('file', './../../_ssh/'+Env+'/'+item.username+'.pub') }}" 24 | path: '/home/{{ item.username }}/.ssh/authorized_keys' 25 | manage_dir: false 26 | with_items: '{{ users }}' 27 | 28 | - name: transfer ssh config /etc/ssh/ssh_config 29 | copy: 30 | src: templates/keys/ssh_config 31 | dest: /home/{{ item.username }}/.ssh/config 32 | owner: "{{ item.username }}" 33 | group: "{{ item.username }}" 34 | mode: 0600 35 | with_items: '{{ users }}' 36 | 37 | - name: sudoers | update sudoers file and validate 38 | lineinfile: 39 | dest: "/etc/sudoers" 40 | insertafter: EOF 41 | line: '{{ item.username }} ALL=(ALL) NOPASSWD: ALL' 42 | regexp: '^{{ item.username }} .*' 43 | state: present 44 | when: item.use_sudo 45 | with_items: '{{ users }}' 46 | 47 | - name: delete user | remove user 48 | user: 49 | name: "{{ item.username }}" 50 | state: absent 51 | remove: true 52 | failed_when: "'NOTHING' in command_result.stderr" 53 | when: rm_user_flag 54 | with_items: '{{ rm_users }}' 55 | -------------------------------------------------------------------------------- /tasks/zsh.yml: -------------------------------------------------------------------------------- 1 | --- 2 | ## Install Oh-my-zsh 3 | 4 | - name: install git and zsh debian 5 | apt: 6 | name: ['git', 'zsh'] 7 | state: present 8 | update_cache: true 9 | cache_valid_time: 5400 10 | 11 | - name: clone oh-my-zsh repo 12 | git: 13 | depth: 1 14 | repo: "{{ item.name }}" 15 | version: master 16 | dest: /usr/local/share/{{ item.dir }} 17 | with_items: 18 | - name: https://github.com/robbyrussell/oh-my-zsh 19 | dir: oh-my-zsh 20 | - name: https://github.com/zsh-users/zsh-syntax-highlighting 21 | dir: zsh-syntax-highlighting 22 | - name: https://github.com/zsh-users/zsh-autosuggestions 23 | dir: zsh-autosuggestions 24 | 25 | - name: create conf folder in home directory 26 | file: 27 | path: "{{ item }}" 28 | state: directory 29 | mode: 0777 30 | with_items: 31 | - "/usr/local/share/oh-my-zsh/conf/" 32 | - "/usr/local/share/oh-my-zsh/cache/" 33 | 34 | - name: deploy .zshrc 35 | template: 36 | src: config/zshrc.in 37 | dest: /usr/local/share/oh-my-zsh/conf/zshrc 38 | mode: 0777 39 | 40 | - name: deploy .extra 41 | template: 42 | src: config/extra.in 43 | dest: "{{ home_dir | default('/home/') }}{{ item.username }}/.extra" 44 | mode: 0777 45 | with_items: '{{ users }}' 46 | 47 | - name: deploy .bash_profile 48 | template: 49 | src: config/bash_profile.in 50 | dest: "{{ home_dir | default('/home/') }}{{ item.username }}/.bash_profile" 51 | mode: 0777 52 | with_items: '{{ users }}' 53 | 54 | - name: remove standard zshrc 55 | file: 56 | path: "{{ home_dir | default('/home/') }}{{ item.username }}/.zshrc" 57 | state: absent 58 | changed_when: false 59 | with_items: '{{ users }}' 60 | 61 | - name: symlink zshrc 62 | file: 63 | path: "{{ home_dir | default('/home/') }}{{ item.username }}/.zshrc" 64 | src: /usr/local/share/oh-my-zsh/conf/zshrc 65 | state: link 66 | mode: 0777 67 | changed_when: false 68 | with_items: '{{ users }}' 69 | 70 | - name: set zsh as default shell 71 | shell: "chsh -s $(which zsh) {{ item.username }}" 72 | changed_when: false 73 | with_items: '{{ users }}' 74 | -------------------------------------------------------------------------------- /templates/config/bash_profile.in: -------------------------------------------------------------------------------- 1 | # {{ ansible_managed }} 2 | 3 | printf "\n" 4 | TEXT="{{Env | default ('')}} {{hostvars[inventory_hostname].EcType | default ('')}} {{hostvars[inventory_hostname].Nr | default ('')}}" 5 | sysbanner=`perl -e "print uc('$TEXT');"` 6 | figlet $sysbanner 7 | printf "\n" 8 | 9 | # Terminal PS1 10 | export PS1="\n\[\\e[1;37m\\]\T : \[\033[01;31m\]\u\[\033[01;33m\] @ \[\033[01;36m\]\H \[\033[01;33m\]\w \[\033[01;35m\]\$ \[\033[00m\]" 11 | 12 | #UTF-8 Compass generation 13 | export LC_ALL="en_US.UTF-8" 14 | export LANG="en_US.UTF-8" 15 | -------------------------------------------------------------------------------- /templates/config/extra.in: -------------------------------------------------------------------------------- 1 | # Ansible managed 2 | 3 | TEXT="prod bastion 1" 4 | 5 | upSeconds="$(/usr/bin/cut -d. -f1 /proc/uptime)" 6 | secs=$((${upSeconds}%60)) 7 | mins=$((${upSeconds}/60%60)) 8 | hours=$((${upSeconds}/3600%24)) 9 | days=$((${upSeconds}/86400)) 10 | UPTIME=`printf "%d days, %02dh%02dm%02ds" "$days" "$hours" "$mins" "$secs"` 11 | 12 | # get the load averages 13 | read one five fifteen rest < /proc/loadavg 14 | 15 | echo "$(tput setaf 033) 16 | .//////////////, 17 | //////////////////// 18 | .///////////////////(((. 19 | /(((((((((((((((((. $(tput setaf 244) ./((((( (( ((((((* (( /( (((((/, $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) HostName...........:$(tput setaf 244) $(tput bold)`perl -e "print uc('$TEXT');"`$(tput sgr0)$(tput setaf 033) 20 | /(((((((((((((%(, $(tput setaf 244) (/ (( /( /( (( (( (( ,( $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) OS.................:$(tput setaf 244) `uname -srmo`$(tput setaf 033) 21 | /((((((((((((/ $(tput setaf 244) (( (( (( (, (( (( (( (/ $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) Uptime.............:$(tput setaf 244) ${UPTIME}$(tput setaf 033) 22 | /((((((((((%*. $(tput setaf 244) .((((((( (((((( ((((((((, (((((((* (((((((( $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) Memory.............:$(tput setaf 244) `cat /proc/meminfo | grep MemFree | awk {'print $2/1000000'}`G (Free) / `cat /proc/meminfo | grep MemTotal | awk {'print $2/1000000'}`G (Total) $(tput setaf 033) 23 | /((((####(, $(tput setaf 244) $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) HDD................:$(tput setaf 244) `df -h --total | grep total | awk '{print $4}'` (Free) / `df -h --total | grep total | awk '{print $2}'` (Total) $(tput setaf 033) 24 | /######### $(tput setaf 244) ###(####. ###*/(## ###%#(##/ ### ## ####### $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) Load Averages......:$(tput setaf 244) ${one}, ${five}, ${fifteen} (1, 5, 15 min) $(tput setaf 033) 25 | /##########. $(tput setaf 244) ##* ## ### ### ## ##. ### ## #,,,,, $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) Running Processes..:$(tput setaf 244) `ps ax | wc -l | tr -d " "` $(tput setaf 033) 26 | /################ $(tput setaf 244) ##* %## ###.## ### ### ## ##/ #''''' $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) Internal IP........:$(tput setaf 244) `ip a | grep glo | awk '{print $2}' | head -1 | cut -f1 -d/` $(tput setaf 033) 27 | *#################* $(tput setaf 244) %%%%%%% %%# %%# %%%%%%. %%%# %%%%%%% $(tput setaf 033)|$(tput setaf 244)| $(tput setaf 033) External IP........:$(tput setaf 244) `wget -q -O - http://icanhazip.com/ | tail` $(tput setaf 033) 28 | %%%%%%%%%%%%%%%%%%%%%%. 29 | *%%%%%%%%%%%%%%%%%%* 30 | .,/#%%%%%%%%#/,. 31 | 32 | $(tput sgr0)" 33 | 34 | # UTF-8 Compass generation 35 | export LC_ALL='en_US.UTF-8' 36 | export LANG='en_US.UTF-8' 37 | -------------------------------------------------------------------------------- /templates/config/nrpe.in: -------------------------------------------------------------------------------- 1 | # {{ ansible_managed }} 2 | 3 | ############################################################################# 4 | # Sample NRPE Config File 5 | # Written by: Ethan Galstad (nagios@nagios.org) 6 | # 7 | # Last Modified: 11-23-2007 8 | # 9 | # NOTES: 10 | # This is a sample configuration file for the NRPE daemon. It needs to be 11 | # located on the remote host that is running the NRPE daemon, not the host 12 | # from which the check_nrpe client is being executed. 13 | ############################################################################# 14 | 15 | 16 | # LOG FACILITY 17 | # The syslog facility that should be used for logging purposes. 18 | 19 | log_facility=daemon 20 | 21 | 22 | 23 | # PID FILE 24 | # The name of the file in which the NRPE daemon should write it's process ID 25 | # number. The file is only written if the NRPE daemon is started by the root 26 | # user and is running in standalone mode. 27 | 28 | pid_file=/var/run/nagios/nrpe.pid 29 | 30 | 31 | 32 | # PORT NUMBER 33 | # Port number we should wait for connections on. 34 | # NOTE: This must be a non-priviledged port (i.e. > 1024). 35 | # NOTE: This option is ignored if NRPE is running under either inetd or xinetd 36 | 37 | server_port=5666 38 | 39 | 40 | 41 | # SERVER ADDRESS 42 | # Address that nrpe should bind to in case there are more than one interface 43 | # and you do not want nrpe to bind on all interfaces. 44 | # NOTE: This option is ignored if NRPE is running under either inetd or xinetd 45 | 46 | #server_address={{ansible_hostname}} 47 | 48 | 49 | 50 | # NRPE USER 51 | # This determines the effective user that the NRPE daemon should run as. 52 | # You can either supply a username or a UID. 53 | # 54 | # NOTE: This option is ignored if NRPE is running under either inetd or xinetd 55 | 56 | nrpe_user=nagios 57 | 58 | 59 | 60 | # NRPE GROUP 61 | # This determines the effective group that the NRPE daemon should run as. 62 | # You can either supply a group name or a GID. 63 | # 64 | # NOTE: This option is ignored if NRPE is running under either inetd or xinetd 65 | 66 | nrpe_group=nagios 67 | 68 | 69 | 70 | # ALLOWED HOST ADDRESSES 71 | # This is an optional comma-delimited list of IP address or hostnames 72 | # that are allowed to talk to the NRPE daemon. Network addresses with a bit mask 73 | # (i.e. 192.168.1.0/24) are also supported. Hostname wildcards are not currently 74 | # supported. 75 | # 76 | # Note: The daemon only does rudimentary checking of the client's IP 77 | # address. I would highly recommend adding entries in your /etc/hosts.allow 78 | # file to allow only the specified host to connect to the port 79 | # you are running this daemon on. 80 | # 81 | # NOTE: This option is ignored if NRPE is running under either inetd or xinetd 82 | 83 | allowed_hosts=52.31.32.200 84 | 85 | 86 | 87 | # COMMAND ARGUMENT PROCESSING 88 | # This option determines whether or not the NRPE daemon will allow clients 89 | # to specify arguments to commands that are executed. This option only works 90 | # if the daemon was configured with the --enable-command-args configure script 91 | # option. 92 | # 93 | # *** ENABLING THIS OPTION IS A SECURITY RISK! *** 94 | # Read the SECURITY file for information on some of the security implications 95 | # of enabling this variable. 96 | # 97 | # Values: 0=do not allow arguments, 1=allow command arguments 98 | 99 | dont_blame_nrpe=0 100 | 101 | 102 | 103 | # BASH COMMAND SUBTITUTION 104 | # This option determines whether or not the NRPE daemon will allow clients 105 | # to specify arguments that contain bash command substitutions of the form 106 | # $(...). This option only works if the daemon was configured with both 107 | # the --enable-command-args and --enable-bash-command-substitution configure 108 | # script options. 109 | # 110 | # *** ENABLING THIS OPTION IS A HIGH SECURITY RISK! *** 111 | # Read the SECURITY file for information on some of the security implications 112 | # of enabling this variable. 113 | # 114 | # Values: 0=do not allow bash command substitutions, 115 | # 1=allow bash command substitutions 116 | 117 | allow_bash_command_substitution=0 118 | 119 | 120 | 121 | # COMMAND PREFIX 122 | # This option allows you to prefix all commands with a user-defined string. 123 | # A space is automatically added between the specified prefix string and the 124 | # command line from the command definition. 125 | # 126 | # *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! *** 127 | # Usage scenario: 128 | # Execute restricted commmands using sudo. For this to work, you need to add 129 | # the nagios user to your /etc/sudoers. An example entry for alllowing 130 | # execution of the plugins from might be: 131 | # 132 | # nagios ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/ 133 | # 134 | # This lets the nagios user run all commands in that directory (and only them) 135 | # without asking for a password. If you do this, make sure you don't give 136 | # random users write access to that directory or its contents! 137 | 138 | # command_prefix=/usr/bin/sudo 139 | 140 | 141 | 142 | # DEBUGGING OPTION 143 | # This option determines whether or not debugging messages are logged to the 144 | # syslog facility. 145 | # Values: 0=debugging off, 1=debugging on 146 | 147 | debug=0 148 | 149 | 150 | 151 | # COMMAND TIMEOUT 152 | # This specifies the maximum number of seconds that the NRPE daemon will 153 | # allow plugins to finish executing before killing them off. 154 | 155 | command_timeout=60 156 | 157 | 158 | 159 | # CONNECTION TIMEOUT 160 | # This specifies the maximum number of seconds that the NRPE daemon will 161 | # wait for a connection to be established before exiting. This is sometimes 162 | # seen where a network problem stops the SSL being established even though 163 | # all network sessions are connected. This causes the nrpe daemons to 164 | # accumulate, eating system resources. Do not set this too low. 165 | 166 | connection_timeout=300 167 | 168 | 169 | 170 | # WEEK RANDOM SEED OPTION 171 | # This directive allows you to use SSL even if your system does not have 172 | # a /dev/random or /dev/urandom (on purpose or because the necessary patches 173 | # were not applied). The random number generator will be seeded from a file 174 | # which is either a file pointed to by the environment valiable $RANDFILE 175 | # or $HOME/.rnd. If neither exists, the pseudo random number generator will 176 | # be initialized and a warning will be issued. 177 | # Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness 178 | 179 | #allow_weak_random_seed=1 180 | 181 | 182 | 183 | # INCLUDE CONFIG FILE 184 | # This directive allows you to include definitions from an external config file. 185 | 186 | #include=