nickjj/ansible-user

Create and configure a user for SSH key based logins and passwordless sudo.

What is ansible-user?

It is an Ansible role to:

• Create user groups
• Create a single user, add it to any groups you created and configure its shell
• Set your public SSH key as an authorized key so you can login without a password
• Enable passwordless sudo

Why would you want to use this role?

When you spin up a new server, you'll often want to set up a non-root user that you can login as and run your applications under. That's because running your applications as root is a questionable idea from a security point of view.

This role sets you up to do that, but it also includes a few other user related tasks, such as what's listed in the above bullets. Having all of these things together in 1 role means less work for you to do!

Supported platforms

• Ubuntu 16.04 LTS (Xenial)
• Ubuntu 18.04 LTS (Bionic)
• Debian 8 (Jessie)
• Debian 9 (Stretch)

Role variables

# Optionally create additional user groupss. If empty, the user you create will
# automatically be a part of their user's group, ie. deploy:deploy.
user_groups: []

# The user you want to create.
user_name: "deploy"

# Which shell should you default to? Typically "bash" or "sh".
user_shell: "/bin/bash"

# Do you want to create an SSH keypair for this user? You probably don't for a
# regular user that you plan to login as which is why it's disabled by default.
user_generate_ssh_key: False

# When set, this will copy your local SSH public key from this path to your
# user's authorized keys on your server.
#
# If you don't want this behavior then use an empty string as the value but keep
# in mind this role does not set a default password for the user you create, so
# you will be locked out if you don't supply your public SSH key.
user_local_ssh_key_path: "~/.ssh/id_rsa.pub"

# Do you want to enable running root commands without needing a password?
user_enable_passwordless_sudo: True

Example usage

For the sake of this example let's assume you have a group called app and you have a typical site.yml playbook.

To use this role edit your site.yml file to look something like this:

---

- name: "Configure app server(s)"
  hosts: "app"
  become: True

  roles:
    - { role: "nickjj.user", tags: "user" }

Let's say you want to edit the user name, you can do this by opening or creating group_vars/app.yml which is located relative to your inventory directory and then make it look something like this:

---

user_name: "thor"

Now you would run ansible-playbook -i inventory/hosts site.yml -t user.

Installation

$ ansible-galaxy install nickjj.user

Ansible Galaxy

You can find it on the official Ansible Galaxy if you want to rate it.

License

MIT

ansible-user's Issues

Content has no field named 'owner'

Getting the error WARNING]: - . was NOT installed successfully: Content has no field named 'owner' on using ansible-galaxy install nickjj.user .

set random password

Hello,

Would you consider adding a random password to the user creation 'cause otherwise the account is locked and passwordless keys will not work.

Try this role and then dev-sec.ssh-hardening. You will not be able to login at all.

- name: Create user
  user:
    generate_ssh_key: "{{ user_generate_ssh_key }}"
    groups: "{{ (user_groups | join(',')) }}"
    append: True
    name: "{{ user_name }}"
    shell: "{{ user_shell }}"
    # this generates a hashed and random uuid string
    password: "{{ 9999999999999999999999 | random | string | to_uuid | password_hash('sha512', 65534 | random | string) }}"
    update_password: on_create

% or # ?

Hi Nick,

Did you mean for the leading % here? Because that means "group named", but user_name is not a group name.

- name: Enable passwordless sudo
  copy:
    content: '%{{ user_name }} ALL=(ALL) NOPASSWD:ALL'

Usually works, except I accidentally nuked my user "app"'s ownership in the group named app and sudo suddenly started asking me for a password.

(I think ansible has a bug with their group module, but that's not your issue).

User once added to sudoers does not get removed

Hi,

Your ansible role fails in a particular scenario and fails to maintain state on the target server as per the value of "user_enable_passwordless_sudo".

Steps:

1. Set "user_enable_passwordless_sudo" to True and execute ansible script on target server.
2. Set "user_enable_passwordless_sudo" to False and execute ansible script on target server.
3. Observe that user is not removed from sudoers file on target server.

I have made change and tested on my local.
Would you accept PR for this issue?

--
Best Regards,
Ritesh

Installation, version control

Hi Nick,

ansible-galaxy has --roles-path so that I can put your cool roles right in my project's roles/ dir.

Better, a ./requirements.yml with:

---
- name: ansible-user
  src: https://github.com/nickjj/ansible-user

Then ansible-galaxy install -r requirements.yml

With ./ansible.cfg having:

[defaults]
roles_path = roles.galaxy:roles

Works a treat!

Would this be a useful edit to README.md and PR?

Cheers,
Greg (gbellinoz)

Set multiple ssh keys

user_local_ssh_key_path: "~/.ssh/id_rsa.pub"

It would be helpful if we could specify multiple keys, or write the authorized_keys inline.