40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
- name: Set root password
|
|
ansible.builtin.user:
|
|
name: root
|
|
password: "{{ vapp['metacluster.password'] | password_hash('sha512', 65534 | random(seed=vapp['guestinfo.hostname']) | string) }}"
|
|
generate_ssh_key: yes
|
|
ssh_key_bits: 2048
|
|
ssh_key_file: .ssh/id_rsa
|
|
|
|
- name: Save root SSH publickey
|
|
ansible.builtin.lineinfile:
|
|
path: /root/.ssh/authorized_keys
|
|
line: "{{ vapp['guestinfo.rootsshkey'] }}"
|
|
|
|
- name: Disable SSH password authentication
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config
|
|
regex: "{{ item.regex }}"
|
|
line: "{{ item.line }}"
|
|
state: "{{ item.state }}"
|
|
loop:
|
|
- regex: '^#PasswordAuthentication'
|
|
line: 'PasswordAuthentication no'
|
|
state: present
|
|
- regex: '^PasswordAuthentication yes'
|
|
line: 'PasswordAuthentication yes'
|
|
state: absent
|
|
loop_control:
|
|
label: "{{ '[' ~ item.regex ~ '] ' ~ item.state }}"
|
|
|
|
- name: Create dedicated SSH keypair
|
|
community.crypto.openssh_keypair:
|
|
path: /root/.ssh/git_rsa_id
|
|
register: gitops_sshkey
|
|
|
|
- name: Delete 'ubuntu' user
|
|
ansible.builtin.user:
|
|
name: ubuntu
|
|
state: absent
|
|
remove: yes
|