Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unprivileged user kerberos #1571

Closed
wants to merge 11 commits into from
Closed

Unprivileged user kerberos #1571

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
672aeb7
Use fully qualified collection names in playbooks/
wbclark Aug 24, 2022
4da2826
Use fully qualified collection names in roles/
wbclark Aug 29, 2022
ebb1898
Replace include with include_tasks
wbclark Aug 29, 2022
86da61a
Dont compare Booleans to literal True/False
wbclark Aug 29, 2022
588605e
Name all role tasks and capitalize names
wbclark Aug 29, 2022
c5fb671
Capitalize task names in playbooks/
wbclark Aug 29, 2022
7d9b182
Improve Jinja2 spacing
wbclark Aug 29, 2022
2bc1f49
Optionally add additional groups to unprivileged_user
wbclark Aug 31, 2022
27e491c
Use authorized_key module and optionally import shh pubkey from GitHub
wbclark Aug 31, 2022
625308a
Use community.general.sudoers for unprivileged_user sudoers control
wbclark Aug 31, 2022
8bc3978
Add options to configure unprivileged_user for Kerberos auth
wbclark Aug 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions roles/unprivileged_user/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
---
unprivileged_user_username: vagrant
unprivileged_user_additional_groups: []
unprivileged_user_kerberos_install: False
unprivileged_user_kerberos_copy_config: False
unprivileged_user_kerberos_copy_ccache: False
37 changes: 37 additions & 0 deletions roles/unprivileged_user/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,3 +66,40 @@
- not authorized_keys_file.stat.exists
- unprivileged_user_import_ssh_pub_key | default(True)
become: true

- name: "Configure {{ unprivileged_user_username }} for Kerberos authentication"
block:
- name: "Install krb5-workstation on Red Hat based distributions"
ansible.builtin.dnf:
name:
- "krb5-workstation"
- "krb5-libs"
state: present
when: ansible_os_family == "RedHat"

- name: "Install krb5-user on Debian based distributions"
ansible.builtin.apt:
name: "krb5-user"
state: present
when: ansible_os_family == "Debian"

- name: "Copy Kerberos client config from Host"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seriously feels out of scope for this role. Roles should be small and focused. When I read unprivileged_user I don't think it essentially means "reconfigure the whole system".

What I'd do is create a role to make the system a kerberos client, with an option to copy from the host. You can then combine those in a playbook. Composition is a great thing and playbooks are the right place for that.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the default parameter values, the behavior is exactly the same because none of the extra tasks here will run. But I don't mind extracting it out into a separate role to keep things organized.

ansible.builtin.copy:
src: "{{ unprivileged_user_kerberos_copy_config }}"
dest: /etc/krb5.conf
owner: root
group: root
mode: '0644'
when: unprivileged_user_kerberos_copy_config

- name: "Copy Kerberos Credential Cache from Host"
ansible.builtin.copy:
src: "{{ unprivileged_user_kerberos_copy_ccache }}"
dest: "{{ unprivileged_user_kerberos_copy_ccache }}"
owner: "{{ unprivileged_user_username }}"
group: "{{ unprivileged_user_groupname }}"
mode: '0600'
when: unprivileged_user_kerberos_copy_ccache

when: unprivileged_user_kerberos_install
become: true