Red Hat Enterprise Linux Automation with Ansible
After completing this section, you should be able to manage Linux users and groups, configure SSH, and modify Sudo configuration on managed hosts.
The Ansible user module lets you manage user accounts on a remote host. You can manage a number of parameters including remove user, set home directory, set the UID for system accounts, manage passwords and associated groupings. To create a user that can log into the machine, you need to provide a hashed password for the password parameter. See the reference section for a link to "How do I generate encrypted passwords for the user module?"
- name: Add new user to the development machine and assign the appropriate groups.
user:
name: devops_user 
shell: /bin/bash 
groups: sys_admins, developers 
append: yes
| The |
| The |
| The |
When creating a user you can specify it to generate_ssh_key. This will not overwrite an existing SSH key.
- name: Create a SSH key for user1
user:
name: user1
generate_ssh_key: yes
ssh_key_bits: 2048
ssh_key_file: .ssh/id_my_rsaNote
The user module also offers some return values. Ansible modules can take a return value and register them into a variable. Find out more with ansible-doc and on the main doc site.
Table 9.1. Some commonly used parameters
| Parameter | Comments |
|---|---|
| comment | Optionally sets the description of a user account. |
| group | Optionally sets the user's primary group. |
| groups | List of multiple groups. When set to a null value, all groups except the primary group is removed. |
| home | Optionally sets the user's home directory. |
| create_home | Takes a boolean value of yes or no. A home directory will be created for the user if the value is set to yes. |
| system | When creating an account state=present, setting this to yes makes the user a system account. This setting cannot be changed on existing users. |
| uid | Sets the UID od user. |
The group module allows you to manage (add, delete, modify) groups on the managed hosts. You need to have groupadd, groupdel or groupmod. For windows targets, use the win_group module.
- name: Verify that auditors group exists
group:
name: auditors
state: presentTable 9.2. Parameters for the group module
| Parameter | Comments |
|---|---|
| gid | Optional GID to set for the group. |
| local | Forces the use of "local" command alternatives on platforms that implement it. |
| name | Name of the group to manage. |
| state | Whether the group should be present or not on the remote host. |
| system | If set to yes, indicates that the group created is a system group. |
If you have a large number of host keys to manage you will want to use the known_hosts module. The known_hosts module lets you add or remove host keys from the known_hosts file on managed host.
The authorized_key module allows you to add or remove SSH authorized keys per user accounts. When adding and subtracting users to a large bank of servers, you need to be able to manage ssh keys.
- name: Set authorized key
authorized_key:
user: user1
state: present
key: "{{ lookup('file', '/home/user1/.ssh/id_rsa.pub') }}
| A key can also be taken from a url: https://github.com/user1.keys. |
