totaldebug.users

An Ansible role for creating users and groups.

Configuration • Features • Contributing • Author • Support • Donate • License

About

ansible-role-users is a high-quality Ansible Role that deploys User Accounts to your ansible clients.

Configuration

Install

ansible-galaxy install totaldebug.users

Role Variables

Main Config

Input	Default	Description
`users_create_per_user_group`	`true`	when creating users, also create a group with the same username and make that the user's primary group.
`users_group`	`users`	if users_create_per_user_group is not set, then this is the primary group for all created users.
`users_default_shell`	`/bin/bash`	the default shell if none is specified for the user.
`users_create_homedirs`	`true`	create home directories for new users. Set this to false if you manage home directories separately.
`authorized_keys_file`	`.ssh/authorized_keys`	Set this if the ssh server is configured to use a non standard authorized keys file.
`users_ssh_key_exclusive`	`false`	Whether to remove all other non-specified keys from the authorized_keys file.

User Creation

Add a users variable containing the list of users to add. A good place to put this is in group_vars/all or group_vars/groupname if you only want the users to be on certain machines.

Input	Default	Description
`username`		The user's username.
`name`		The full name of the user.
`home`	`/home/username`	The home directory of the user to create.
`uid`		The numeric user id for the user (optional). This is required for uid consistency across systems.
`gid`		The numeric group id for the group (optional).
`password`		If a hash is provided then that will be used, but otherwise the account will be locked.
`update_password`	`always`	This can be either 'always' or 'on_create' 'always' will update passwords if they differ. 'on_create' will only set the password for newly created users.
`password_lock`	`false`	allows locking users password.
`expires`		Optional expiry time for the user in epoch, it will be ignored on platforms that do not support this. You can remove the expiry time by specifying a negative value. Currently supported on GNU/Linux and FreeBSD.
`group`		Optional primary group override.
`groups`	`[]`	A list of supplementary groups for the user.
`append`	`false`	If true, will only add groups, not set them to just the list in groups (optional).
`profile`		A string block for setting custom shell profiles.
`ssh_key`		This should be a list of SSH keys for the user (optional). Each SSH key should be included directly and should have no newlines.
`generate_ssh_key`	`false`	Whether to generate a SSH key for the user (optional).
`shell`	`/bin/bash`	The user's shell. This defaults to /bin/bash. The default is configurable using the users_default_shell variable if you want to give all users the same shell, but it is different than /bin/bash.
`system`	`false`	Allows creation of system users.
`ssh_key_exclusive`	`users_ssh_key_exclusive`	Whether to remove all other non-specified keys from the authorized_keys file.

To create a password hash:

sudo apt inatll whois
mkpasswd --method=SHA-512

Group Creation

Input	Default	Description
`name`		The group's name.
`gid`		The numeric group id for the group (optional). This is required for gid consistency across systems.
`system`	`false`	Allows creation of system group.

User Deletion

Input	Default	Description
`username`		The user's username.

Example Configuration

---
users:
  - username: terry
    name: Terry Chocolate
    groups: ['sudo', 'systemd-journal']
    uid: 1001
    home: /local/home/terry
    profile: |
      alias ll='ls -lah'
    ssh_key:
      - "ssh-rsa AAAAA.... foo@machine"
      - "ssh-rsa AAAAB.... foo2@machine"
groups_to_create:
  - name: developers
    gid: 2002
users_deleted:
  - username: Orange

Example different users for different devices

If you require a main user on all devices and different users on different devices, this can be achieved as follows:

in group_vars/all

_default_users:
  - username: mainaccount
    uid: 2000
    groups: ['sudo']
    ssh-key: mypublic ssh key"

users: "{{ _default_users + (_specific_users | default([])) }}"

in group_vars/server

_specific_users:
  - username: serviceaccount
    uid: 666
    system: true

Features

	🔰
Create users	✔️
Delete Users	✔️
Create Groups	✔️

Contributing

Got something interesting you'd like to share? Learn about contributing.

Versioning

This project follows semantic versioning.

In the context of semantic versioning, consider the role contract to be defined by the role variables.

Breaking Changes or changes that require user intervention will increase the major version. This includes changing the default value of a role variable.
Changes that do not require user intervention, but add new features, will increase the minor version.
Bug fixes will increase the patch version.