40 lines
941 B
YAML
40 lines
941 B
YAML
- name: Add sudo group
|
|
ansible.builtin.group:
|
|
name: sudo
|
|
state: present
|
|
- name: Add wheel group
|
|
ansible.builtin.group:
|
|
name: wheel
|
|
state: present
|
|
- name: Add ansible user
|
|
ansible.builtin.user:
|
|
name: nerevar
|
|
append: true
|
|
shell: /bin/bash
|
|
groups:
|
|
- sudo
|
|
- wheel
|
|
- name: Add local user key
|
|
ansible.posix.authorized_key:
|
|
user: nerevar
|
|
state: present
|
|
key: "{{ lookup('file', '~/.ssh/id_rsa.pub')}}"
|
|
- name: >-
|
|
Allow ansible user to passwordless sudo all commands.
|
|
community.general.sudoers:
|
|
name: nerevar-sudo
|
|
state: present
|
|
user: nerevar
|
|
commands: ALL
|
|
- name: Lock root password
|
|
ansible.builtin.user:
|
|
name: root
|
|
password_lock: true
|
|
- name: Disable root SSH login
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regexp: "^PermitRootLogin"
|
|
line: "PermitRootLogin no"
|
|
validate: "/usr/sbin/sshd -t -f %s"
|
|
notify: restart sshd
|