ability to disable users

Add `windmill_disabled_users` to disable existing users.

Change-Id: Id09cba27e753bc3cc5165293310c356588435778
This commit is contained in:
Gonéri Le Bouder 2020-07-14 16:43:21 -04:00
parent da70ca7f5e
commit df630fb6e3
No known key found for this signature in database
GPG Key ID: 049ED9B94765572E
3 changed files with 38 additions and 0 deletions

View File

@ -14,3 +14,4 @@
---
windmill_root_users: []
windmill_users: {}
windmill_disabled_users: []

View File

@ -0,0 +1,35 @@
# Copyright 2020 Red Hat, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
---
- name: Disable password for sudo users
become: true
copy:
content: "%{{ __windmill_users_sudo_group }} ALL=(ALL) NOPASSWD: ALL"
dest: /etc/sudoers.d/sudo
- name: Disable disabled users
become: true
user:
name: "{{ item }}"
groups: []
shell: /sbin/nologin
with_items: "{{ windmill_disabled_users }}"
- name: Disable SSH access
become: true
file:
path: "~{{ item }}/.ssh"
state: absent
with_items: "{{ windmill_disabled_users }}"

View File

@ -70,3 +70,5 @@
mode: 0644
owner: root
src: root/.forward.j2
- include_tasks: disable_users.yaml