users
ansible-role-users
An Ansible role, available via Ansible Galaxy, that creates user accounts on Ubuntu and sets them up for SSH access. The following options are configurable:
- Disallowing SSH password authentication
- Disallowing root SSH access
This role works with our repo to create a vagrant virtualbox vm, but is easily modifed to work with actual ubuntu boxes.
You'll probably want to amend / override:
defaults/main.yml
Installation
Preusming a requirements.yml as follows:
# Install a role from GitHub
- name: ansible-role-users
src: https://github.com/jcdarwin/ansible-role-users
We can install the role locally, using a requirements.yml file:
# Install a role from GitHub
- name: ansible-role-users
src: https://github.com/jcdarwin/ansible-role-users
path: roles/
Install the role:
ansible-galaxy install -r requirements.yml -p ./roles
Requirements
You'll need to provide a public key for the public_key variable that can be used to access the box as a given user.
Role Variables
Available variables are listed below, along with default values as found in defaults/main.yml:
# the users to create
# each user gets a /home directory
users:
- deploy
- git
# the main group to use when creating the user
user_group: wheel
# the groups the user should belong to
user_groups: ssh,wheel,www-data,sudo
# users in the following groups get SSH access to the machine
# note that the value is space-separated
allow_groups: ssh vagrant
# the public key value to use to allow the user ssh access
public_key: '~/.ssh/id_rsa.pub'
# do we want to disallow root ssh access?
disallow_root_ssh: true
# do we want to disallow password ssh access?
disallow_password_ssh: true
Dependencies
None.
Example Playbook
Our hosts file, as generated by our repo to create a vagrant virtualbox vm:
[vagrant]
host1 ansible_ssh_host=127.0.0.1 ansible_ssh_port=2222 ansible_user=vagrant ansible_ssh_private_key_file=../.vagrant/machines/default/virtualbox/private_key
We include a playbook at main.yml.
Running the playbook:
# Note that we're presuming our hosts file has been generated by our vagrant repo
ansible all -m ping -i ../vagrant/ansible/hosts -l all
ansible-playbook -l all main.yml -i ../vagrant/ansible/hosts
# Check that we can access the server
ssh [email protected] -p 2222
sudo -s
Note that after running this playbook you'll have improved security by updating the public key for the user vagrant, but this means you'll no longer be able to vagrant ssh. Instead you'll have to use the following (presuming you've kept the same key in the defaults/main.yml):
ssh [email protected] -p 2222 -i ~/.ssh/id_rsa
License
MIT