fix 🐛: Remove unprivileged key management

This commit addresses a security concern by removing unnecessary and potentially risky tasks related to authorized key management for unprivileged users. This simplifies the system and reduces the attack surface. The changes align with best practices for user access control.
This commit is contained in:
2025-12-14 06:19:09 +01:00
parent 3dec85c5a8
commit 1551565825

View File

@@ -10,28 +10,28 @@
skeleton: /etc/skel
append: true
- name: Check the primary key for the unprivileged user
ansible.posix.authorized_key:
user: "{{ interactive_user }}"
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
state: present
exclusive: false
register: setkey
# - name: Check the primary key for the unprivileged user
# ansible.posix.authorized_key:
# user: "{{ interactive_user }}"
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
# state: present
# exclusive: false
# register: setkey
- name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
when: setkey.changed
ansible.posix.authorized_key:
user: "{{ interactive_user }}"
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
state: present
exclusive: true
# - name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
# when: setkey.changed
# ansible.posix.authorized_key:
# user: "{{ interactive_user }}"
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
# state: present
# exclusive: true
- name: Set the secondary key for the unprivileged user
ansible.posix.authorized_key:
user: "{{ interactive_user }}"
key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
state: present
exclusive: false
# - name: Set the secondary key for the unprivileged user
# ansible.posix.authorized_key:
# user: "{{ interactive_user }}"
# key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
# state: present
# exclusive: false
- name: Install required package to become unprivileged users
ansible.builtin.apt: