102 lines
2.7 KiB
YAML
Executable file
102 lines
2.7 KiB
YAML
Executable file
---
|
|
- name: Create restricted bin directory for support user
|
|
ansible.builtin.file:
|
|
path: /home/support/bin
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0755'
|
|
|
|
- name: Create symlinks to allowed commands
|
|
ansible.builtin.file:
|
|
src: "{{ item.src }}"
|
|
dest: "/home/support/bin/{{ item.name }}"
|
|
state: link
|
|
loop:
|
|
- {src: '/bin/ping', name: 'ping'}
|
|
- {src: '/usr/bin/telnet', name: 'telnet'}
|
|
- {src: '/usr/bin/mtr', name: 'mtr'}
|
|
- {src: '/usr/local/bin/auspex', name: 'auspex'}
|
|
- {src: '/usr/local/bin/lazydocker', name: 'lazydocker'}
|
|
- {src: '/usr/bin/traceroute', name: 'traceroute'}
|
|
- {src: '/usr/bin/sudo', name: 'sudo'}
|
|
- {src: '/usr/bin/curl', name: 'curl'}
|
|
- {src: '/usr/bin/grep', name: 'grep'}
|
|
- {src: '/usr/bin/tee', name: 'tee'}
|
|
- {src: '/usr/bin/ls', name: 'ls'}
|
|
|
|
- name: Set rbash as shell for support user
|
|
ansible.builtin.user:
|
|
name: support
|
|
shell: /bin/rbash
|
|
home: /home/support
|
|
|
|
- name: Allow support user to run mtr with sudo without password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
support ALL=(root) NOPASSWD: /usr/bin/mtr
|
|
dest: /etc/sudoers.d/support-mtr
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
- name: Allow support user to run lazydocker with sudo without password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
support ALL=(root) NOPASSWD: /usr/local/bin/lazydocker
|
|
dest: /etc/sudoers.d/support-lazydocker
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
- name: Allow support user to run auspecs with sudo without password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
support ALL=(root) NOPASSWD: /usr/local/bin/auspex
|
|
dest: /etc/sudoers.d/support-auspex
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
- name: Allow support user to run curl with sudo without password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
support ALL=(root) NOPASSWD: /usr/bin/curl
|
|
dest: /etc/sudoers.d/support-curl
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
- name: Allow support user to run curl with sudo without password
|
|
ansible.builtin.copy:
|
|
content: |
|
|
support ALL=(root) NOPASSWD: /usr/bin/ls
|
|
dest: /etc/sudoers.d/support-ls
|
|
owner: root
|
|
group: root
|
|
mode: '0440'
|
|
validate: 'visudo -cf %s'
|
|
|
|
|
|
- name: Configure .bash_profile with restricted PATH
|
|
ansible.builtin.copy:
|
|
content: |
|
|
PATH=/home/support/bin
|
|
export PATH
|
|
readonly PATH
|
|
dest: /home/support/.bash_profile
|
|
owner: root
|
|
group: root
|
|
mode: '0444'
|
|
|
|
- name: Remove write permissions from home directory
|
|
ansible.builtin.file:
|
|
path: /home/support
|
|
owner: root
|
|
group: support
|
|
mode: '0755'
|
|
...
|