Ansible - managing multiple SSH keys for multiple users & roles -


the problem

i managing number of different servers ansible. each server has multiple linux users, such readonly, admin, etc.

i have number of files inside ansible project contain ssh keys particular group of people - eg. appdeveloperspublickeys, dbapublickeys, etc.

different groups of people have different access levels on different servers. eg. on webserver, appdevelopers have admin access, , dbas might have read access. on database servers, vice versa.

to achieve above, have different ansible roles different types of server (eg. webappserver, databaseserver, etc). these roles have variables readonly_key_files , admin_key_files set against them, listing appropriate key files roles should have readonly , admin access.

the ideal solution would:

  1. ensure public keys exlusive - eg. if public key deleted appdeveloperpublickeys file in ansible, servers have key deleted too
  2. only upload / change file on servers when has changed
  3. show accurate diff of files when using --diff option run ansible

i using ansible 2.2.0.0

solutions attempted far

none of below works like:

authorized_key with_file

- authorized_key: user=readonly exclusive=no key={{item}}   with_file: {{readonly_key_files}}
  • this not meet requirement 1, looping on multiple files, exclusive must set no

authorized_key fact

solution per https://github.com/ansible/ansible-modules-core/pull/4167/files

- name: "generate developer keys multiple files"   set_fact: dev_key_list="{{ lookup('file', item) }}"   register: dev_keys   with_items: '{{developer_key_files}}'  - name: "merge developer keys single list"   set_fact: dev_keys_string={{ dev_keys.results | map(attribute='ansible_facts.dev_key_list') | join('\n') }}  - authorized_key: user=readonly exclusive=yes key={{dev_keys_string}}
  • this meets requirement 1, (at least me) not meet requirement 2 - seems order of keys generated not deterministic, running playbook multiple times results in authorized_keys step changing when no keys have been added / removed files. doesn't seem meet requirement 3, when run --check --diff cannot see lines ansible believes changing, highlights file changed.

authorized_key with_template

- authorized_key: user=readonly exclusive=no key={{item}}   with_template: {{readonly_keys.j2}}

where readonly_keys.j2 looks like:

{% key_file in readonly_key_files %} {%   include '/files/' ~ key_file %} {% endfor %}
  • this meets requirements 1 , 2, again fails on requirement 3. when run using --check --diff shows me whether or not ssh file changed, not lines added / removed expect to.

conclusion

is there way solve problem? seems though there may issue using --diff authorized_keys in ansible... other approach can think of not using authorized_keys @ all, , instead managing regular file / template, should show me accurate diffs (as meeting requirements 1 & 2).

ok, understand trying add 2 static users (readonly , admin) servers , have ssh keys of individuals added static user's authorized ssh keys.

why want that? going difficult audit changes. taking security , audit-able environment consideration , best way create groups (sysadmins, dev, dba etc) , add them appropriate servers through roles , add individual users name groups. use lineinfile module groups sudoers. closest best practice.

if need remove user , might need remove user completel group.

though suggestion not answer real question, might give little perspective shift on how setup things more manageable.

i have implemented generic role. posting in repo if might find useful(which still under construction)

https://github.com/ameenibrahim/ansible_users


Comments

Post a Comment

Popular posts from this blog

php - How to add and update images or image url in Volusion using Volusion API -

actually have store importing products store product data insert , update image or image url not insert , update. this xml code name datapro.txt. <products_joined> <productcode>3710_012t</productcode> <vendor_partno>eah5450silent/di/1gd3(lp)</vendor_partno> <productname>test product ta</productname> <hideproduct>n</hideproduct> <stockstatus>20</stockstatus> <lastmodified>1/5/2016 10:25:00 am</lastmodified> <lastmodby>2</lastmodby> <productweight>0.9</productweight> <productprice>100</productprice> <productmanufacturer>asus tek</productmanufacturer> <vendor_price>32.69</vendor_price> <numproductssharingstock>0</numproductssharingstock> <categoryids>107</categoryids> <producturl>http://tebkq.mvlce.servertrust.com/productdetails.asp?productcode=3710_012t</producturl>
Read more

javascript - jQuery UI Splitter/Resizable for unlimited amount of columns -

using jqueryui splitter or resizable functions want create layout allows unlimited amount of columns added , columns need resizable. so fiddle: https://jsfiddle.net/f3glh3mw/ but in fiddle html contains out of nested sets instead of inline. limits possibilities above fiddle can have equal widths 2,4,8,16,32 etc columns. in between shows crooked can see in fiddle. when researching came on question: jquery ui , splitter if @ top answer shows structure like: <div class="wrap"> <div class="resizable resizable1"></div> <div class="resizable resizable2"></div> </div> full fiddle: http://jsfiddle.net/8qztj/86/ which structure want javascript hardcoded 2 resizable items. so here question: how modify last fiddle works amount of .resizable divs. or know of plugin can this. thanks helping! so far found plugin: http://www.bacubacu.com/colresizable/ which says , close functionality want. in
Read more

javascript - IE9 error '$'is not defined -

Image
<!--[if lte ie 9]><html class="lte9"><![endif]--><!--[if gt ie 9]><html><![endif]--> <!--[if !ie]><!--> <html> <!--<![endif]--> blah blah <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.1/jquery.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script> <script src="{{ asset('js/mypage.js') }}" type="text/javascript"></script> </body> </html> when load page, ie9 brings error '$' not defined . how can solve error? +++ mypage.js $(function(){ //when load page, //ie9 tag not moving. $(window).load(function() { $('div.mask').hide(); }); // when click , willshow show. //for not ie 9 if (!$('html').hasclass('lte9')) { var = $('ul.about > li > span.activebtn');
Read more