Files
@ 4b964a31bd96
Branch filter:
Location: majic-ansible-roles/roles/ldap_server/tasks/main.yml - annotation
4b964a31bd96
6.1 KiB
text/x-yaml
MAR-95: Separated configuration for backing-up the /root and /home directories in the common role. This should allow user to have better fine-grained control over what gets backed-up in the home directory. Updated role reference documentation. Updated the testsite variable configuration so the new setting can be tested.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 | dcd5e6e08117 dcd5e6e08117 dcd5e6e08117 b325005c1a8f dcd5e6e08117 dcd5e6e08117 b325005c1a8f dcd5e6e08117 dcd5e6e08117 dcd5e6e08117 dcd5e6e08117 284ed92d40bb 284ed92d40bb a6633bcc83d1 a6633bcc83d1 a6633bcc83d1 a6633bcc83d1 a6633bcc83d1 284ed92d40bb 7d6c2d8f03bf 7d6c2d8f03bf 7d6c2d8f03bf 97be416e882e 97be416e882e 97be416e882e 97be416e882e 97be416e882e 97be416e882e a561d73e3242 a561d73e3242 a561d73e3242 a561d73e3242 a561d73e3242 ec982756013f a561d73e3242 ec982756013f ec982756013f ec982756013f ec982756013f ec982756013f ec982756013f 30c772db9c58 30c772db9c58 30c772db9c58 ea92f99d9c33 9f804c9501da ea92f99d9c33 d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb d077bd1afabb 0ad9410c243a 18cd76ec050d 0ad9410c243a 0ad9410c243a 0ad9410c243a 0ad9410c243a 0ad9410c243a 18cd76ec050d 0ad9410c243a 0ad9410c243a 0ad9410c243a 0ad9410c243a 3907a5157ef8 18cd76ec050d 430eb250e244 7d6c2d8f03bf 7d6c2d8f03bf dcd5e6e08117 58e1c3121e77 9f804c9501da 58e1c3121e77 308745f2c2a8 9f804c9501da 308745f2c2a8 308745f2c2a8 308745f2c2a8 b0e7faa211ae 308745f2c2a8 308745f2c2a8 308745f2c2a8 308745f2c2a8 308745f2c2a8 f7fe8adec8d3 f7fe8adec8d3 f7fe8adec8d3 308745f2c2a8 dcd5e6e08117 dcd5e6e08117 63d26c0b3d86 63d26c0b3d86 b1e6de7dd8a7 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 922cda0a1834 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 9f804c9501da 922cda0a1834 9f804c9501da 9f804c9501da b1e6de7dd8a7 922cda0a1834 922cda0a1834 922cda0a1834 922cda0a1834 922cda0a1834 eb9a1b525c77 eb9a1b525c77 eb9a1b525c77 eb9a1b525c77 e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a e29b656fbf7a 881a85f08e22 881a85f08e22 881a85f08e22 7387caca37f3 7387caca37f3 7387caca37f3 7387caca37f3 7387caca37f3 7387caca37f3 7387caca37f3 | ---
- name: Set domain for slapd
debconf: name=slapd question=slapd/domain vtype=string value="{{ ldap_server_domain }}"
- name: Set organisation for slapd
debconf: name=slapd question=slapd/organization vtype=string value="{{ ldap_server_organization }}"
- name: Install slapd
apt: name=slapd state=installed
- name: Allow OpenLDAP user to traverse the directory with TLS private keys
user: name=openldap append=yes groups=ssl-cert
register: openldap_in_ssl_cert
- name: Restart slapd if group membership has changed
service: name=slapd state=restarted
when: openldap_in_ssl_cert.changed
- name: Install Python LDAP bindings
apt: name=python-ldap state=installed
- name: Set-up LDAP server to listen on legacy SSL port
lineinfile: dest=/etc/default/slapd state=present backrefs=yes
regexp='^SLAPD_SERVICES=.*' line='SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"'
notify:
- Restart slapd
- name: Enable slapd service on boot (workaround for systemctl broken handling of SysV)
command: rcconf -on slapd
register: result
changed_when: result.stderr == ""
- name: Enable slapd service
service: name=slapd state=started
- name: Deploy system logger configuration file for slapd
copy: src=slapd_rsyslog.conf dest=/etc/rsyslog.d/slapd.conf owner=root group=root mode=0644
notify:
- Restart rsyslog
- name: Deploy configuration file for log rotation of slapd logs
copy: src=slapd_logrotate dest=/etc/logrotate.d/slapd owner=root group=root mode=0644
- name: Change log level for slapd
ldap_entry: dn=cn=config state=replace olcLogLevel="{{ ldap_server_log_level }}"
- name: Test if LDAP misc schema has been applied
command: ldapsearch -Q -LLL -A -Y EXTERNAL -b cn=schema,cn=config -s one '(cn={*}misc)' cn
register: ldap_misc_schema_present
changed_when: false
- name: Deploy LDAP misc schema
command: ldapadd -Y EXTERNAL -f /etc/ldap/schema/misc.ldif
when: ldap_misc_schema_present.stdout == ""
- name: Deploy LDAP TLS private key
copy: dest="/etc/ssl/private/{{ ansible_fqdn }}_ldap.key" content="{{ ldap_server_tls_key }}"
mode=640 owner=root group=openldap
notify:
- Restart slapd
- name: Deploy LDAP TLS certificate
copy: dest="/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem" content="{{ ldap_server_tls_certificate }}"
mode=644 owner=root group=root
notify:
- Restart slapd
- name: Configure TLS for slapd (includes hardening)
ldap_entry: dn=cn=config state=replace olcTLSCertificateFile="/etc/ssl/certs/{{ ansible_fqdn }}_ldap.pem" olcTLSCertificateKeyFile="/etc/ssl/private/{{ ansible_fqdn }}_ldap.key"
olcTLSCipherSuite="{{ ldap_tls_ciphers }}"
notify:
- Restart slapd
- name: Configure SSF
ldap_entry: dn=cn=config state=replace olcSecurity=ssf="{{ ldap_server_ssf }}" olcLocalSSF="{{ ldap_server_ssf }}"
- name: Enable the memberof module
ldap_entry: dn="cn=module{0},cn=config" state=append olcModuleLoad="{1}memberof"
- name: Enable the memberof overlay for database
ldap_entry:
dn: "olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config"
objectClass:
- olcConfig
- olcMemberOf
- olcOverlayConfig
olcOverlay: memberof
olcMemberOfRefInt: "TRUE"
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
- name: Apply database permissions
ldap_permissions:
filter: "(olcSuffix={{ ldap_server_int_basedn }})"
rules: "{{ ldap_permissions }}"
- name: Create basic LDAP directory structure
ldap_entry: ""
args:
dn: "ou={{ item }},{{ ldap_server_int_basedn }}"
objectClass:
- organizationalUnit
ou: "{{ item }}"
with_items:
- people
- groups
- services
- name: Create the entry that will contain mail service information
ldap_entry: ""
args:
dn: "ou=mail,ou=services,{{ ldap_server_int_basedn }}"
objectClass: organizationalUnit
ou: mail
- name: Create LDAP directory structure for mail service
ldap_entry: ""
args:
dn: "ou={{ item }},ou=mail,ou=services,{{ ldap_server_int_basedn }}"
objectClass: organizationalUnit
ou: "{{ item }}"
with_items:
- domains
- aliases
- name: Create or remove login entries for services
ldap_entry: ""
args:
dn: "cn={{ item.name }},ou=services,{{ ldap_server_int_basedn }}"
objectClass:
- applicationProcess
- simpleSecurityObject
cn: "{{ item.name }}"
userPassword: "{{ item.password }}"
state: "{{ item.state | default('present') }}"
with_items: "{{ ldap_server_consumers }}"
- name: Create or remove user-supplied groups
ldap_entry: ""
args:
dn: "cn={{ item.name }},ou=groups,{{ ldap_server_int_basedn }}"
objectClass: groupOfUniqueNames
cn: "{{ item.name }}"
uniqueMember: "cn=NONE"
state: "{{ item.state | default('append') }}"
with_items: "{{ ldap_server_groups }}"
- name: Create user-supplied LDAP entries
ldap_entry: ""
args:
dn: "{{ item.dn }}"
state: "{{ item.state | default(omit)}}"
attributes: "{{ item.attributes }}"
with_items: "{{ ldap_entries }}"
- name: Deploy firewall configuration for LDAP
copy: src="ferm_ldap.conf" dest="/etc/ferm/conf.d/10-ldap.conf" owner=root group=root mode=640
notify:
- Restart ferm
- name: Deploy temporary file with LDAP admin password
template: src="ldap_admin_password.j2" dest="/root/.ldap_admin_password"
owner=root group=root mode=400
changed_when: False
- name: Test if LDAP admin password needs to be changed
command: ldapwhoami -D "cn=admin,{{ ldap_server_int_basedn }}" -x -y /root/.ldap_admin_password
register: ldap_admin_password_check
changed_when: ldap_admin_password_check.rc != 0
failed_when: False
- name: Update LDAP admin password
command: ldappasswd -Y EXTERNAL -H ldapi:/// "cn=admin,{{ ldap_server_int_basedn }}" -T /root/.ldap_admin_password
when: ldap_admin_password_check.rc != 0
- name: Remove temporary file with LDAP admin password
file: path="/root/.ldap_admin_password" state=absent
changed_when: False
- name: Enable backup
include: backup.yml
when: enable_backup
- name: Explicitly run all handlers
include: ../handlers/main.yml
when: "handlers | default(False) | bool() == True"
tags:
- handlers
|