fix 🐛: Remove unprivileged key management
This commit addresses a security concern by removing unnecessary and potentially risky tasks related to authorized key management for unprivileged users. This simplifies the system and reduces the attack surface. The changes align with best practices for user access control.
This commit is contained in:
@@ -10,28 +10,28 @@
|
||||
skeleton: /etc/skel
|
||||
append: true
|
||||
|
||||
- name: Check the primary key for the unprivileged user
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ interactive_user }}"
|
||||
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
|
||||
state: present
|
||||
exclusive: false
|
||||
register: setkey
|
||||
# - name: Check the primary key for the unprivileged user
|
||||
# ansible.posix.authorized_key:
|
||||
# user: "{{ interactive_user }}"
|
||||
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
|
||||
# state: present
|
||||
# exclusive: false
|
||||
# register: setkey
|
||||
|
||||
- name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
|
||||
when: setkey.changed
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ interactive_user }}"
|
||||
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
|
||||
state: present
|
||||
exclusive: true
|
||||
# - name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
|
||||
# when: setkey.changed
|
||||
# ansible.posix.authorized_key:
|
||||
# user: "{{ interactive_user }}"
|
||||
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
|
||||
# state: present
|
||||
# exclusive: true
|
||||
|
||||
- name: Set the secondary key for the unprivileged user
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ interactive_user }}"
|
||||
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
|
||||
state: present
|
||||
exclusive: false
|
||||
# - name: Set the secondary key for the unprivileged user
|
||||
# ansible.posix.authorized_key:
|
||||
# user: "{{ interactive_user }}"
|
||||
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
|
||||
# state: present
|
||||
# exclusive: false
|
||||
|
||||
- name: Install required package to become unprivileged users
|
||||
ansible.builtin.apt:
|
||||
|
||||
Reference in New Issue
Block a user