Ansible Role Sudo/Sudoers

Description

:grey_exclamation: Before using this role, please know that all my Ansible roles are fully written and accustomed to my IT infrastructure. So, even if they are as generic as possible they will not necessarily fill your needs, I advice you to carrefully analyse what they do and evaluate their capability to be installed securely on your servers.

This roles configures sudo

Requirements

Require Ansible >= 2.4

Dependencies

OS Family

This role is available for Debian and CentOS

Features

At this day the role can be used to :

• install sudo
• configure defaults and command rules
• provide a pseudo "type" to allow other role to include sudo rules
• local facts

Configuration

Role

All variables which can be overridden are stored in defaults/main.yml file as well as in table below. To see default values please refer to this file.

Sudo rule

This role provide a pseudo "type" that you can use from another role. This allow this another role to declare a set of sudo rules out of this sudoers role's scope and after it application in the playbook.

To use it just declare a task like this

- name: Configure sudoers rule for ROLE
  include_role:
    name: sudoers
    tasks_from: types/sudo_rule
  vars:
    sudoers__sudo_rule: {}

The whole rule configuration items must be under the variable named sudoers__sudo_rule.

"defaults" directive

Because sudo "defaults" directive can take optional value, ansible support two form for each defaults directive under defaults key:

Defaults   always_set_home
Defaults   listpw = always

• a simple string
• a mapping

The string version is the simplest to use because the string will be just put after the sudo keyword Defaults.

The mapping one allow more fine setup. First, be conscious that sudo Defaults directive support host, user, command and runas filtering. But you can only choose one filter condition for a default directive. So this ansible role will used the previous keys order as priority order if you set multiple filtering keys.

If the directive require a value you must set the directive name a key of the mapping and it's value associated as the value of the key.
Else if the directive require only it's name (like requiretty) you have (it's a limitation) to put the static world "defaults" as key, and the name of the directive as the value.

For example to apply "requiretty" on user1 user set the following vars :

sudoers__sudo_rule:
  name: rule1
  defaults:
    - defaults: requiretty
      user: user1

And to apply "listpw" one set :

sudoers__sudo_rule:
  name: rule1
  defaults:
    - listpw: always
      user: user1

To summarize all theses dict keys are available inside a defaults specification :

"commands" directive

Each command under commands key allow the user to run a system command with or without restrictions

A command bloc allow the following keys

For example to allow user "user1" to run ls any where as root user without typing password :

sudoers__sudo_rule:
  name: rule1
  commands:
   - commands: /bin/ls
     run_as_user: user1
     run_as_group: root
     tags: NOPASSWD

Facts

By default the local fact are installed and expose the following variables :

• ansible_local.sudoers.version_full
• ansible_local.sudoers.version_major

Example

Playbook

Use it in a playbook as follows:

- hosts: all
  roles:
    - turgon37.sudoers

Inventory

• Declare your defaults settings

sudoers__defaults_global:
  - always_set_home
  - insults
  - listpw: always
  - mailsub: "[PRODUCTION][%h][SUDO SECURITY]"
  - mailto: [email protected]
  - mail_no_user
  - mail_no_perms
  - mail_no_host
  - mail_badpass
  - passprompt_override
  - pwfeedback
  - secure_path: /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
  - '!visiblepw'

• Usage with sssd

# Required for sudo to retrieve rules from LDAP
sudoers__sss: true

• Declare sudo rules from another role

- name: Configure sudoers rule for ROLE
  include_role:
    name: sudoers
    tasks_from: types/sudo_rule
  vars:
    sudoers__sudo_rule:
      name: role__autogenerated_rule_10
      remove_using_regexp:
        - role__autogenerated_rule_0[0-9]+
      force_remove_using_regexp: true
      users: '{{ role__user }}'
      hosts: ALL
      comment: Autogenerated rule for role
      commands:
        - commands: /bin/ls
          run_as_user: '{{ role__another_user }}'
          run_as_group: root
          tags: NOPASSWD
        - commands: /bin/cat /home/[a-zA-Z]*/.ssh/config
          run_as_user: ALL
          run_as_group: root
      defaults:
        - defaults: '!requiretty'
          user: '{{ role__user }}'
      state: present