majic-ansible-roles Changeset

Changeset - b8bfc506359f

Parent rev.

Child rev.

[Not reviewed]

1 1 0

Branko Majic (branko) - 7 days ago 2024-09-21 13:29:58
branko@majic.rs

MAR-218: Rework/improve code for setting LDAP server admin password:

- Avoid dropping temporary file with password by invoking a search on
the LDAP server using the supplied credentials.
- Do not log sensitive informationi when setting the LDAP server admin
password.

2 files changed with 9 insertions and 23 deletions:

roles/ldap_server/tasks/main.yml

roles/ldap_server/templates/ldap_admin_password.j2

0 comments (0 inline, 0 general)

roles/ldap_server/tasks/main.yml

➞

Show inline comments

@@ @@ -200,89 +200,76 @@ @@
     dn: "cn={{ item.name }},ou=services,{{ ldap_server_int_basedn }}"
     objectClass:
       - applicationProcess
       - simpleSecurityObject
     attributes:
       cn: "{{ item.name }}"
       userPassword: "{{ item.password }}"
     state: "{{ item.state | default('present') }}"
   with_items: "{{ ldap_server_consumers }}"
 - name: Update services login passwords
   community.general.ldap_attrs:
     dn: "cn={{ item.name }},ou=services,{{ ldap_server_int_basedn }}"
     attributes:
       userPassword: "{{ item.password }}"
     state: exact
   with_items: "{{ ldap_server_consumers }}"
   when: "item.state | default('present') == 'present'"
 - name: Create or remove user-supplied groups
   community.general.ldap_entry:
     dn: "cn={{ item.name }},ou=groups,{{ ldap_server_int_basedn }}"
     objectClass:
       - groupOfUniqueNames
     attributes:
       cn: "{{ item.name }}"
       uniqueMember: "cn=NONE"
     state: "{{ item.state | default('present') }}"
   with_items: "{{ ldap_server_groups }}"
 - name: Create user-supplied LDAP entries
   community.general.ldap_entry:
     dn: "{{ item.dn }}"
     objectClass: "{{ item.attributes.objectClass }}"
     attributes: "{{ item.attributes }}"
     state: "{{ item.state | default('present') }}"
   with_items: "{{ ldap_entries }}"
 - name: Deploy firewall configuration for LDAP
   ansible.builtin.copy:
     src: "ferm_ldap.conf"
     dest: "/etc/ferm/conf.d/10-ldap.conf"
     owner: root
     group: root
     mode: "0640"
   notify:
     - Restart ferm
 # @TODO: This whole thing could be dropped if newer version of Ansible
 #        was in use (where community collection has the ldap_search
 #        module.
 - name: Deploy temporary file with LDAP admin password
   ansible.builtin.template:
     src: "ldap_admin_password.j2"
     dest: "/root/.ldap_admin_password"
     owner: root
     group: root
     mode: "0400"
   changed_when: false
 - name: Test if LDAP admin password needs to be changed
   ansible.builtin.command: "ldapwhoami -H ldapi:/// -D 'cn=admin,{{ ldap_server_int_basedn }}' -x -y /root/.ldap_admin_password"
 - name: Test LDAP admin password
   community.general.ldap_search:
     bind_dn: "cn=admin,{{ ldap_server_int_basedn }}"
     bind_pw: "{{ ldap_admin_password }}"
     server_uri: "ldapi:///"
     dn: "{{ ldap_server_int_basedn }}"
     scope: base
   register: ldap_admin_password_check
   changed_when: ldap_admin_password_check.rc != 0
   failed_when: false
 - name: Update LDAP admin password
   community.general.ldap_attrs:
     dn: "olcDatabase={1}mdb,cn=config"
     attributes:
       olcRootPW: "{{ ldap_admin_password | ldap_password_hash }}"
     state: exact
   when: ldap_admin_password_check.rc != 0
 - name: Remove temporary file with LDAP admin password
   ansible.builtin.file:
     path: "/root/.ldap_admin_password"
     state: absent
   changed_when: false
   no_log: true
   when: "'results' not in ldap_admin_password_check"
 - name: Enable backup
   ansible.builtin.import_tasks: backup.yml
   when: enable_backup
 - name: Explicitly run all handlers
   ansible.builtin.import_tasks: ../handlers/main.yml
   when: "run_handlers | default(False) | bool()"
   tags:
     - handlers

roles/ldap_server/templates/ldap_admin_password.j2

➞

Show inline comments

deleted file

0 comments (0 inline, 0 general)