SdNOG Users creation Ansible code - Revision history

Admin at 09:58, 11 August 2024

2024-08-11T09:58:50Z

Manhal.Mohamed: /* Author */

2024-08-08T08:15:28Z

‎Author

Manhal.Mohamed: /* 7. Send Password to Users via Email */

2024-08-08T07:19:14Z

‎7. Send Password to Users via Email

Manhal.Mohamed at 07:18, 8 August 2024

2024-08-08T07:18:35Z

Manhal.Mohamed at 07:10, 8 August 2024

2024-08-08T07:10:06Z

Manhal.Mohamed at 07:06, 8 August 2024

2024-08-08T07:06:46Z

Manhal.Mohamed: /* Ansible Playbook: Configure Sudo Users with SSH Keys and Require Password Change on First Login */

2024-08-08T07:04:15Z

‎Ansible Playbook: Configure Sudo Users with SSH Keys and Require Password Change on First Login

Manhal.Mohamed at 07:01, 8 August 2024

2024-08-08T07:01:54Z

Manhal.Mohamed: Created page with "= Ansible Playbook: Configure Sudo Users with SSH Keys and Require Password Change on First Login = This Ansible playbook configures users with sudo privileges, sets up SSH k..."

2024-08-08T06:58:29Z

Created page with "= Ansible Playbook: Configure Sudo Users with SSH Keys and Require Password Change on First Login = This Ansible playbook configures users with sudo privileges, sets up SSH k..."

New page

= Ansible Playbook: Configure Sudo Users with SSH Keys and Require Password Change on First Login =

This Ansible playbook configures users with sudo privileges, sets up SSH keys, and requires users to change their password upon first login.

== Overview ==

The playbook performs the following tasks:
# Installs necessary packages based on the operating system (Debian/Ubuntu or RedHat/CentOS).
# Checks if users already exist.
# Generates passwords for new users.
# Creates new users with these passwords and assigns them to the sudo group.
# Sets passwords to expire upon the user's first login.
# Deploys SSH public keys for users.
# Sends the password to users via email.

== Variables ==

* '''users''': A list of users to be created, each with the following attributes:
** '''username''': The username for the new account.
** '''ssh_key''': The SSH public key to be deployed for the user.
** '''email''': The email address where the password will be sent.

== Tasks ==

=== 1. Install Required Packages ===

==== For Debian/Ubuntu ====
<pre>
- name: needed packages are installed (Debian/Ubuntu)
apt:
name: "{{ item }}"
state: latest
loop: ["sudo", "openssh-server", "mailutils"]
when: ansible_facts['os_family'] == "Debian"
</pre>

==== For RedHat/CentOS ====
<pre>
- name: needed packages are installed (RedHat/CentOS)
yum:
name: "{{ item }}"
state: latest
loop: ["sudo", "openssh-server", "mailx"]
when: ansible_facts['os_family'] == "RedHat"
</pre>

=== 2. Check if Users Exist and Set Facts for New Users ===
<pre>
- name: Check if users exist and set fact for new users
command: "getent passwd {{ item.username }}"
register: user_check
loop: "{{ users }}"
changed_when: false
failed_when: false
</pre>

=== 3. Generate Passwords for New Users ===
<pre>
- name: Generate passwords for new users
set_fact:
user_passwords: "{{ user_passwords | default({}) | combine({item.item.username: lookup('password', '/dev/null length=15 chars=ascii_letters+digits')}) }}"
loop: "{{ user_check.results }}"
when: item.stdout == ""
</pre>

=== 4. Create New Users with Plain-Text Passwords ===
<pre>
- name: Create new users with plain-text passwords if they do not exist
user:
name: "{{ item.username }}"
password: "{{ user_passwords[item.username] | default('') | password_hash('sha512') }}"
groups: sudo
append: yes
create_home: yes
shell: /bin/bash
update_password: on_create
expires: -1
loop: "{{ users }}"
when: item.username in user_passwords
</pre>

=== 5. Set Password to Expire Upon First Login ===
<pre>
- name: Set password to expire upon first login for newly created users
command: chage -d 0 "{{ item.username }}"
loop: "{{ users }}"
when: item.username in user_passwords
</pre>

=== 6. Deploy SSH Public Keys for the Users ===
<pre>
- name: Deploy SSH public keys for the users
authorized_key:
user: "{{ item.username }}"
state: present
key: "{{ item.ssh_key }}"
loop: "{{ users }}"
</pre>

=== 7. Send Password to Users via Email ===
<pre>
- name: Send password to users via email
mail:
host: relay.example.com
port: 25
to: "{{ item.email }}"
subject: "Your new account password"
body: |
Dear {{ item.username }},

Your new account has been created on the following host: {{ ansible_host }}.

Username: {{ item.username }}
Password: {{ user_passwords[item.username] }}

Please change your password upon first login.

Best regards,
Sdnog Team

from: sdnog-ansible-at-email.com
loop: "{{ users }}"
when: item.username in user_passwords
</pre>

@@ Line 1: / Line 1: @@
 = Ansible Playbook: Sudo Users creation with SSH Keys =
 This Ansible playbook configures users with sudo privileges, sets up SSH keys, and requires users to change their password upon first login.
@@ Line 216: / Line 218: @@
          when: item.username in user_passwords
    </pre>
 == Author ==
 * '''Author''': [[User:Manhal.Mohamed|Manhal Mohamed]]'' , SdNOG Team

← Older revision		Revision as of 08:15, 8 August 2024
Line 218:		Line 218:
	== Author ==		== Author ==

−	* '''Author''': [[User:Manhal.Mohamed\|Manhal Mohamed]]''	+	* '''Author''': [[User:Manhal.Mohamed\|Manhal Mohamed]]'' , SdNOG Team

← Older revision		Revision as of 07:19, 8 August 2024
Line 115:		Line 115:

	Please change your password upon first login.		Please change your password upon first login.
		+	Note: This is an automated message generated by Ansible. Please do not reply to this email.
		+

	Best regards,		Best regards,

← Older revision		Revision as of 07:10, 8 August 2024
Line 215:		Line 215:
	== Author ==		== Author ==

−	* '''Author''': [Manhal ~~Mohammed~~]	+	* '''Author''': [[User:Manhal.Mohamed\|Manhal Mohamed]]''

@@ Line 1: / Line 1: @@
 = Ansible Playbook: Sudo Users creation with SSH Keys =
 This Ansible playbook configures users with sudo privileges, sets up SSH keys, and requires users to change their password upon first login.
@@ Line 214: / Line 213: @@
          when: item.username in user_passwords
    </pre>

@@ Line 200: / Line 200: @@
              Your new account has been created on the following host: {{ ansible_host }}.
              Username: {{ item.username }}
              Password: {{ user_passwords[item.username] }}
              Please change your password upon first login.
              Best regards,

← Older revision		Revision as of 07:04, 8 August 2024
Line 1:		Line 1:
−	= Ansible Playbook: ~~Configure~~ Sudo Users with SSH Keys ~~and Require Password Change on First Login~~ =	+	= Ansible Playbook: Sudo Users creation with SSH Keys =
		+	by : Manhal Mohammed

	This Ansible playbook configures users with sudo privileges, sets up SSH keys, and requires users to change their password upon first login.		This Ansible playbook configures users with sudo privileges, sets up SSH keys, and requires users to change their password upon first login.

@@ Line 122: / Line 122: @@
      loop: "{{ users }}"
      when: item.username in user_passwords
    </pre>