feat ✨: Import unprivileged user task

This commit introduces the `unpriv-user.yml` task, enabling the creation of unprivileged user accounts. This addition expands user management capabilities, allowing for more granular control over user permissions and access within the system. The task facilitates the streamlined setup of users without requiring elevated privileges.

defaults/main.yml

@@ -4,3 +4,9 @@
 # [WARNING]: Module remote_tmp /root/.ansible/tmp did not exist and was created with a mode of 0700,
 # this may cause issues when running as another user. To avoid this, create the remote_tmp dir with the correct permissions manually"
 allow_world_readable_tmpfiles: true
+
+
+ansible_user_id: root
+interactive_user: "{{ remote_user | default('ansible') }}"
+interactive_home: "/home/{{ interactive_user}}"
+interactive_password: "{{ test_password }}"

tasks/edit-journald.yml

@@ -10,8 +10,8 @@
     - { regexp: "^#?ForwardToSyslog", line: ForwardToSyslog=no }
     - { regexp: "^#?SystemMaxUse", line: SystemMaxUse=100M }
   notify: Restart systemd-journald
-  vars:
+  # vars:
-    ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
+  #   ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
 
 # A succesful vacuum does impact log size, but is not considered a change
 - name: Vacuum journalctl before

tasks/main.yml

@@ -6,8 +6,9 @@
 - name: Ensure required packages are present on systems
   ansible.builtin.import_tasks: prereq-packages.yml
 
-- name: Make /tmp non-executable
+# not sure if needed, but I'll leave it here as a reference if needed.
-  ansible.builtin.import_tasks: tmp-nonexec.yml
+# - name: Make /tmp non-executable
+#   ansible.builtin.import_tasks: tmp-nonexec.yml
 
 - name: Import tasks to ensure creation of unprivileged user
   ansible.builtin.import_tasks: unpriv-user.yml
@@ -19,11 +20,12 @@
   ansible.builtin.debug:
     var: ansible_local['cpu_info']
 
-- name: Firmware block for x86_64 systems
+# Not necessary for me
-  when: "'Dell' in ansible_board_vendor or 'LENOVO' in ansible_board_vendor"
+# - name: Firmware block for x86_64 systems
-  block:
+#   when: "'Dell' in ansible_board_vendor or 'LENOVO' in ansible_board_vendor"
-    - name: Import firmware tasks
+#   block:
-      ansible.builtin.import_tasks: additional-firmware.yml
+#     - name: Import firmware tasks
+#       ansible.builtin.import_tasks: additional-firmware.yml
 
 - name: Import color-shell tasks for the common-role
   ansible.builtin.import_tasks: color-shell.yml
@@ -40,5 +42,5 @@
 - name: Set the custom message of the day (motd)
   ansible.builtin.import_tasks: motd.yml
 
-- name: Perform SSH daemon hardening
+# - name: Perform SSH daemon hardening
-  ansible.builtin.import_tasks: ssh-config.yml
+#   ansible.builtin.import_tasks: ssh-config.yml

tasks/set-hostname.yml

@@ -8,8 +8,8 @@
     path: /etc/hosts
     regexp: 127\.0\.1\.1
     replace: "{{ ansible_host }} {{ inventory_hostname }}"
-  vars:
+  # vars:
-    ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
+  #   ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
 
 - name: Ensure at least one full hostname entry is present
   ansible.builtin.lineinfile:
@@ -17,6 +17,6 @@
     regexp: "{{ ansible_host }}.*{{ inventory_hostname }}"
     line: "{{ ansible_host }} {{ inventory_hostname }}"
     state: present
-  vars:
+  # vars:
-    ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
+  #   ansible_remote_tmp: /tmp # Prevent warnings for auto-created tmp dir
   when: "'activedirectory' not in group_names"

tasks/set-locale.yml

@@ -2,7 +2,7 @@
 - name: Ensure the proper locales are present and generated
   community.general.locale_gen:
     name:
-      - "nl_NL.UTF-8"
+      - "it_IT.UTF-8"
       - "en_US.UTF-8"
       - "en_GB.UTF-8"
     state: present

tasks/unpriv-user.yml

@@ -10,28 +10,28 @@
     skeleton: /etc/skel
     append: true
 
-- name: Check the primary key for the unprivileged user
+# - name: Check the primary key for the unprivileged user
-  ansible.posix.authorized_key:
+#   ansible.posix.authorized_key:
-    user: "{{ interactive_user }}"
+#     user: "{{ interactive_user }}"
-    key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
+#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
-    state: present
+#     state: present
-    exclusive: false
+#     exclusive: false
-  register: setkey
+#   register: setkey
 
-- name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
+# - name: Re-set the primary key as exclusive, if we found that the key was not present yet # noqa: no-handler
-  when: setkey.changed
+#   when: setkey.changed
-  ansible.posix.authorized_key:
+#   ansible.posix.authorized_key:
-    user: "{{ interactive_user }}"
+#     user: "{{ interactive_user }}"
-    key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
+#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-1.pub') }}"
-    state: present
+#     state: present
-    exclusive: true
+#     exclusive: true
 
-- name: Set the secondary key for the unprivileged user
+# - name: Set the secondary key for the unprivileged user
-  ansible.posix.authorized_key:
+#   ansible.posix.authorized_key:
-    user: "{{ interactive_user }}"
+#     user: "{{ interactive_user }}"
-    key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
+#     key: "{{ lookup('file', '../home/ssh-keys/' ~ interactive_user ~ '/' ~ interactive_user ~ '-yubi-2.pub') }}"
-    state: present
+#     state: present
-    exclusive: false
+#     exclusive: false
 
 - name: Install required package to become unprivileged users
   ansible.builtin.apt: