From 89a7bfa7896f526700046f9804039021dd994ebf Mon Sep 17 00:00:00 2001 From: aleidk Date: Mon, 9 Dec 2024 13:10:38 -0300 Subject: [PATCH] fix: update bot user permissions --- playbooks/setup/alpine.yaml | 24 +++++++++++++++----- variables/secrets.yaml | 45 ++++++++++++++++++++++++++++++------- 2 files changed, 56 insertions(+), 13 deletions(-) diff --git a/playbooks/setup/alpine.yaml b/playbooks/setup/alpine.yaml index 0eb750d..88cd215 100644 --- a/playbooks/setup/alpine.yaml +++ b/playbooks/setup/alpine.yaml @@ -4,15 +4,15 @@ - name: Setup an alpine machine hosts: homelab user: root + vars_files: + ../../variables/secrets.yaml vars: # alpine_version: v3.19 alpine_version: latest-stable robo: - authorized_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPiEGbVaaSJq/9hGaou3gd6m4Jzyj4AIgCL5wGTxVz1" + authorized_key: "{{ users.robo.ssh_keys.pub }}" allowed_commands: - - "docker ps" - vars_files: - ../../variables/secrets.yaml + - "docker system dial-stdio" tasks: - name: Change login message template: @@ -49,6 +49,15 @@ line: 'PasswordAuthentication no' state: present + - name: Disable password authentication for SSH + become: true + notify: Restart sshd + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^#?PubkeyAuthentication' + line: 'PubkeyAuthentication yes' + state: present + - name: Allow users of the weel group to use doas command become: true ansible.builtin.lineinfile: @@ -74,14 +83,19 @@ ansible.builtin.user: name: robo system: true + shell: /bin/sh + password: "*" create_home: true - groups: nogroup + groups: + - nogroup + - docker state: present - name: Add SSH public key for robo user ansible.posix.authorized_key: user: robo state: present + exclusive: true key: "{{ robo.authorized_key }}" key_options: "command=\"{{ robo.allowed_commands | join('; ') }}\"" diff --git a/variables/secrets.yaml b/variables/secrets.yaml index bc78f77..133e8a2 100644 --- a/variables/secrets.yaml +++ b/variables/secrets.yaml @@ -1,9 +1,38 @@ $ANSIBLE_VAULT;1.1;AES256 -62343433336464323761613330643861353862393130383631306536366639323233663233623735 -3131393037626664333235623764353939613835313030330a346133636334323132623536663830 -65386432383562343738333137386564653963396537653435613566326463356131316437393537 -3239353134323261340a306234393263383331396430396666376337343161313232396566343933 -39356161346439663764663763346666653933316537306336383339626136326639343564613231 -34343730326166356433336266643532393037653363356334383630646335313162366237343234 -34353933383365636662343364303366633662316430646536323861356163383039346234663239 -62376366373864373336 +66623439343462353362333136383366613962326637633939663437333434653031363666353239 +6465366633663063613732393039383732663134333163300a336538633965623330386434636262 +61336130363830623439663262346433663361393830613933386233363730363264346264323531 +3937666332333834630a346437396634316435656631616632616632393362343439643162393832 +63633366386564623433396135633938653864386230373331333931626166303837386464353637 +32343231313664626131653635396334613533666132643661633865323031366262646438643964 +66396338336436326432333966633832303831323439303733356266363437323735363064396531 +34303264343166336532333237633563623763636637613131663138653933373362376561383539 +37373534393931326537393761616162643038386536326661666530303930393237366334393434 +39333335363363343134396337363365346336343033323063316438303835316532623961636135 +64383932643334643031353333346465373861626131336464666566663136336166346438653237 +39363563356262303036386333366665343539363161363764656262646230396436623761663437 +63396265643037663366643239616161386338386363333632376163633464336534306435383839 +39326136363765323831316137386264333162396538343562633336626633363834653031636364 +65393833613737656631363936646664393464376566343961316562663264633763616532666338 +35303234633036343437346334333837616230346565633163323838663539363237633537393461 +30633634353233613064643562323034633134616463393937393234366565626337613766303634 +37663164613833326364643263383564396462626132323032353036306134343863323935363631 +32383232396339363732333831393563346431663639323861613935303531383961663562656463 +30616435643764666639306264636336386163316632613235666561376131656538376532323064 +65373362656636346435373639663436383034656362336439386533396539613633666466663661 +64363734353338336562666234636135376238303966613833363966656566346531666535396433 +33613765656639336131376232323133303764616461623065393365613933656236646238353062 +33393137653535333637343733306439366630633438323638353531326638333465313235656233 +39383834383964393638663664646638333766363964653336626536613437373439303463393330 +63306463376265323062363637333539386236386437643064653432356130346131626335396466 +39303835636638393433633339306463366531313766323035653462373363373064663634356538 +39386333303335353161343631346637343634653932316465363832353031333761353761303162 +38356439363630666662366266663862333333646563396664326530393162633764373866343866 +36383239653531393264313430636564376131373938623861636662393635316634333064336336 +38636666396562643236303239306332393532656534666233353630666235376162353436373033 +62663962663937313530613165653434326235323262326136303863303836326232613938356538 +32336661336235666163306263333464366531616432303163393565326137623562306264666335 +37353039373766653264656666663363336362613933326437633833393961386134313363363431 +38653036636164346138666332613837396561333561313535306232366437303838383938326331 +63373037363036386664363164613735663663626231653366666161383665386336666530383465 +65353162383835643266623762633235363465623764326435303831343730353562