112 lines
4.0 KiB
YAML
112 lines
4.0 KiB
YAML
- name: Accounts (team for the teams, icpc for the administrator)
|
|
hosts: all
|
|
become: yes
|
|
vars:
|
|
# admin_pass comes from build.sh. team_pass is optional: without it, the
|
|
# team account keeps the password of the ICPC image (contest).
|
|
team_pass: ""
|
|
autologin: true
|
|
|
|
tasks:
|
|
# The password of icpc changes and team leaves the sudo group in finish.yml,
|
|
# at the very end, because Ansible may be using those accounts for sudo
|
|
- name: Check that the administrator password is given
|
|
assert:
|
|
that: admin_pass is defined and admin_pass | length > 0
|
|
fail_msg: "Give the new password of the icpc account with -e admin_pass=..."
|
|
|
|
- name: Make sure the root account stays locked (no root password)
|
|
command: passwd -l root
|
|
register: lock_root
|
|
changed_when: "'unchanged' not in lock_root.stdout"
|
|
|
|
- name: Log the teams in automatically (team account)
|
|
copy:
|
|
dest: /etc/lightdm/lightdm.conf.d/90-acpc-autologin.conf
|
|
mode: '0644'
|
|
content: |
|
|
[Seat:*]
|
|
autologin-user=team
|
|
autologin-user-timeout=0
|
|
when: autologin | bool
|
|
|
|
- name: No automatic login
|
|
file:
|
|
path: /etc/lightdm/lightdm.conf.d/90-acpc-autologin.conf
|
|
state: absent
|
|
when: not (autologin | bool)
|
|
|
|
# The ICPC image lets every account run vscode-extension-install as root
|
|
# without a password, at login. That script mounts and changes paths in
|
|
# the home directory, which the account controls. Here it runs at boot for
|
|
# the team account only, after a check of those paths.
|
|
- name: Remove the sudo rule of vscode-extension-install
|
|
file:
|
|
path: /etc/sudoers.d/vscode-extension-install
|
|
state: absent
|
|
|
|
- name: Do not run vscode-extension-install at login
|
|
lineinfile:
|
|
path: /etc/xdg/autostart/vscode-extension-install.desktop
|
|
line: Hidden=true
|
|
|
|
- name: Install the boot-time VS Code setup of the team account
|
|
copy:
|
|
src: "files/security/{{ item.src }}"
|
|
dest: "{{ item.dest }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { src: team-vscode-extensions, dest: /usr/local/sbin/team-vscode-extensions, mode: '0700' }
|
|
- { src: team-vscode-extensions.service, dest: /etc/systemd/system/team-vscode-extensions.service, mode: '0644' }
|
|
|
|
- name: Enable it
|
|
systemd:
|
|
name: team-vscode-extensions.service
|
|
enabled: yes
|
|
daemon_reload: yes
|
|
|
|
# The boot menu is hidden, but Esc shows it, and editing an entry gives a
|
|
# root shell (init=/bin/bash). Editing and the other entries need the user
|
|
# admin with the administrator password. The normal boot needs nothing.
|
|
- name: Hash the boot menu password
|
|
shell: printf '%s\n%s\n' "$PASS" "$PASS" | grub-mkpasswd-pbkdf2 | sed -n 's/.* is //p'
|
|
environment:
|
|
PASS: "{{ admin_pass }}"
|
|
register: grub_hash
|
|
changed_when: false
|
|
no_log: true
|
|
|
|
- name: Protect the boot menu with a password
|
|
copy:
|
|
dest: /etc/grub.d/01_acpc_password
|
|
# Root only: the file holds the password hash (also the icpc password)
|
|
mode: '0700'
|
|
content: |
|
|
#!/bin/sh
|
|
cat <<'EOF'
|
|
set superusers="admin"
|
|
password_pbkdf2 admin {{ grub_hash.stdout }}
|
|
EOF
|
|
no_log: true
|
|
|
|
- name: Let the Ubuntu entries boot without the password
|
|
replace:
|
|
path: /etc/grub.d/10_linux
|
|
regexp: '^CLASS="--class gnu-linux --class gnu --class os"$'
|
|
replace: 'CLASS="--class gnu-linux --class gnu --class os --unrestricted"'
|
|
|
|
- name: No recovery entries in the boot menu
|
|
copy:
|
|
dest: /etc/default/grub.d/90-acpc.cfg
|
|
mode: '0644'
|
|
content: |
|
|
GRUB_DISABLE_RECOVERY="true"
|
|
|
|
- name: Rebuild the boot menu
|
|
command: update-grub
|
|
changed_when: true
|
|
|
|
- name: Check the boot menu
|
|
shell: grep -c -- '--unrestricted' /boot/grub/grub.cfg && grep -q 'set superusers="admin"' /boot/grub/grub.cfg
|
|
changed_when: false
|