mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
Tweaking:
- Ansible Playbooks refinement - Add Ansible Bootstrapping - Add some notes
This commit is contained in:
@ -1,30 +1,53 @@
|
||||
---
|
||||
# Become needs to happen in the task or root will be added to the sudo group instead of the user
|
||||
- name: On Debian, check if sudo is installed
|
||||
#######################################
|
||||
# T-Pot - Debian Bootstrapping (sudo) #
|
||||
#######################################
|
||||
|
||||
# Be sure to use root password as become password
|
||||
- name: T-Pot - Debian Bootstrapping (sudo)
|
||||
hosts: all
|
||||
gather_facts: true
|
||||
gather_facts: false
|
||||
become: false
|
||||
|
||||
pre_tasks:
|
||||
- name: Check for non-root user id
|
||||
debug:
|
||||
msg: "Detected user: '{{ ansible_user_id }}'"
|
||||
failed_when: ansible_user_id == "root"
|
||||
tasks:
|
||||
- name: Check if running as root
|
||||
assert:
|
||||
that: ansible_user != 'root'
|
||||
fail_msg: "T-Pot playbook should not be run as root."
|
||||
success_msg: "Running as user: {{ ansible_user }}."
|
||||
tags:
|
||||
- "Debian"
|
||||
|
||||
- name: Install sudo package if not present already
|
||||
- name: Check if running as tpot
|
||||
assert:
|
||||
that: ansible_user != 'tpot'
|
||||
fail_msg: "Reserved username `tpot` detected."
|
||||
success_msg: "Running as user: {{ ansible_user }}."
|
||||
tags:
|
||||
- "Debian"
|
||||
|
||||
- name: Get distribution name
|
||||
raw: awk -F= '/^NAME/{print $2}' /etc/os-release | tr -d '"' | cut -d " " -f1
|
||||
register: my_distribution
|
||||
tags:
|
||||
- "Debian"
|
||||
|
||||
- name: Check if sudo is installed
|
||||
# Use echo, or task will fail if sudo not found
|
||||
raw: echo -n $(command -v sudo)
|
||||
register: my_sudo
|
||||
tags:
|
||||
- "Debian"
|
||||
|
||||
- name: Add sudo package and add ansible_user to sudo group (Debian)
|
||||
become: true
|
||||
become_method: su
|
||||
apt:
|
||||
name: sudo
|
||||
state: present
|
||||
update-cache: yes
|
||||
when: ansible_distribution == "Debian"
|
||||
|
||||
- name: Add current user to sudo group
|
||||
become: true
|
||||
become_method: su
|
||||
user:
|
||||
name: "{{ ansible_user_id }}"
|
||||
groups: sudo
|
||||
append: yes
|
||||
when: ansible_distribution == "Debian"
|
||||
raw: |
|
||||
apt update
|
||||
apt -y install sudo
|
||||
/usr/sbin/usermod -aG sudo {{ ansible_user }}
|
||||
echo '{{ ansible_user }} ALL=(ALL:ALL) ALL' | tee /etc/sudoers.d/{{ ansible_user }}
|
||||
chmod 440 /etc/sudoers.d/{{ ansible_user }}
|
||||
when: my_distribution.stdout | trim in ["Debian"] and my_sudo.stdout | trim == ""
|
||||
tags:
|
||||
- "Debian"
|
||||
|
Reference in New Issue
Block a user