You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
86 lines
2.4 KiB
YAML
86 lines
2.4 KiB
YAML
|
|
#
|
|
# Add users expected by tests to an OS X machine. Assumes passwordless sudo to
|
|
# root.
|
|
#
|
|
# WARNING: this creates non-privilged accounts with pre-set passwords!
|
|
#
|
|
|
|
- hosts: all
|
|
become: true
|
|
tasks:
|
|
- name: Disable non-localhost SSH for Mitogen users
|
|
blockinfile:
|
|
path: /etc/ssh/sshd_config
|
|
block: |
|
|
Match User mitogen__* Address !127.0.0.1
|
|
DenyUsers *
|
|
|
|
- name: Create Mitogen test users
|
|
user:
|
|
name: "{{item}}"
|
|
shell: /bin/bash
|
|
password: mitogen__password
|
|
with_items:
|
|
- mitogen__require_tty
|
|
- mitogen__pw_required
|
|
- mitogen__require_tty_pw_required
|
|
|
|
- name: Create Mitogen test users
|
|
user:
|
|
name: "mitogen__user{{item}}"
|
|
shell: /bin/bash
|
|
password: mitogen__password
|
|
with_sequence: start=1 end=21
|
|
|
|
- name: Hide test users from login window.
|
|
shell: >
|
|
defaults
|
|
write
|
|
/Library/Preferences/com.apple.loginwindow
|
|
HiddenUsersList
|
|
-array-add '{{item}}'
|
|
with_items:
|
|
- mitogen__require_tty
|
|
- mitogen__pw_required
|
|
- mitogen__require_tty_pw_required
|
|
|
|
- name: Hide test users from login window.
|
|
shell: >
|
|
defaults
|
|
write
|
|
/Library/Preferences/com.apple.loginwindow
|
|
HiddenUsersList
|
|
-array-add 'mitogen__user{{item}}'
|
|
with_sequence: start=1 end=21
|
|
|
|
- name: Require a TTY for two accounts
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
line: "{{item}}"
|
|
with_items:
|
|
- Defaults>mitogen__pw_required targetpw
|
|
- Defaults>mitogen__require_tty requiretty
|
|
- Defaults>mitogen__require_tty_pw_required requiretty,targetpw
|
|
|
|
- name: Require password for two accounts
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
line: "{{lookup('pipe', 'whoami')}} ALL = ({{item}}) ALL"
|
|
with_items:
|
|
- mitogen__pw_required
|
|
- mitogen__require_tty_pw_required
|
|
|
|
- name: Allow passwordless for one account
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
line: "{{lookup('pipe', 'whoami')}} ALL = ({{item}}) NOPASSWD:ALL"
|
|
with_items:
|
|
- mitogen__require_tty
|
|
|
|
- name: Allow passwordless for many accounts
|
|
lineinfile:
|
|
path: /etc/sudoers
|
|
line: "{{lookup('pipe', 'whoami')}} ALL = (mitogen__user{{item}}) NOPASSWD:ALL"
|
|
with_sequence: start=1 end=21
|