Apr 28, 2018 Join GitHub today. GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together. Whether this module should manage the directory of the authorized key file. If set to yes, the module will create the directory, as well as set the owner and permissions of an existing directory. Be sure to set managedir=no if you are using an alternate directory for authorizedkeys, as set with path, since you could lock yourself out of SSH access. 1) First all the ansible variable is included 2) Using the ansible user module creating users from the user lists (users.yml) 3) Using the ansible authorizedkey adding the ssh public key to the created user home directory 4) Finally uploading the sudoers entry file which users should be granter sudoers access which doesn't. Run the playbook.
| Parameter | Choices/Defaults | Comments |
|---|---|---|
| append boolean |
| If yes, add the user to the groups specified in groups.If no, user will only be added to the groups specified in groups, removing them from all other groups. |
| authorization added in 2.8 | Does nothing when used with other platforms. Can set multiple authorizations using comma separation. To delete all authorizations, use authorization='. | |
| comment | Optionally sets the description (aka GECOS) of user account. | |
| create_home boolean |
| Unless set to no, a home directory will be made for the user when the account is created or if the home directory does not exist.Changed from createhome to create_home in Ansible 2.5. |
| expires | An expiry time for the user in epoch, it will be ignored on platforms that do not support this. Currently supported on GNU/Linux, FreeBSD, and DragonFlyBSD. Since Ansible 2.6 you can remove the expiry time specify a negative value. Currently supported on GNU/Linux and FreeBSD. | |
| force boolean |
| This only affects state=absent, it forces removal of the user and associated directories on supported platforms.The behavior is the same as userdel --force, check the man page for userdel on your system for details and support.When used with generate_ssh_key=yes this forces an existing key to be overwritten. |
| generate_ssh_key boolean |
| Whether to generate a SSH key for the user in question. This will not overwrite an existing SSH key unless used with force=yes. |
| group string | Optionally sets the user's primary group (takes a group name). | |
| groups list | List of groups user will be added to. When set to an empty string ', the user is removed from all groups except the primary group.Before Ansible 2.3, the only input format allowed was a comma separated string. | |
| hidden added in 2.6 |
| macOS only, optionally hide the user from the login window and system preferences. The default will be yes if the system option is used. |
| home path | ||
| local added in 2.4 |
| Forces the use of 'local' command alternatives on platforms that implement it. This is useful in environments that use centralized authentification when you want to manipulate the local users (i.e. it uses luseradd instead of useradd).This will check /etc/passwd for an existing account before invoking commands. If the local account database exists somewhere other than /etc/passwd, this setting will not work properly.This requires that the above commands as well as /etc/passwd must exist on the target host, otherwise it will be a fatal error. |
| login_class | Optionally sets the user's login class, a feature of most BSD OSs. | |
| move_home boolean |
| If set to yes when used with home: , attempt to move the user's old home directory to the specified directory if it isn't there already and the old home exists. |
| name string / required | aliases: user | |
| non_unique boolean |
| Optionally when used with the -u option, this option allows to change the user ID to a non-unique value. |
| password string | Optionally set the user's password to this crypted value. On macOS systems, this value has to be cleartext. Beware of security issues. To create a disabled account on Linux systems, set this to '!' or '*'.To create a disabled account on OpenBSD, set this to '*************'.See https://docs.ansible.com/ansible/faq.html#how-do-i-generate-encrypted-passwords-for-the-user-module for details on various ways to generate these password values. | |
| password_lock boolean |
| Lock the password (usermod -L, pw lock, usermod -C). BUT implementation differs on different platforms, this option does not always mean the user cannot login via other methods. This option does not disable the user, only lock the password. Do not change the password in the same task. Currently supported on Linux, FreeBSD, DragonFlyBSD, NetBSD, OpenBSD. |
| profile string | Sets the profile of the user. Can set multiple profiles using comma separation. Currently supported on Illumos/Solaris. | |
| remove boolean |
| This only affects state=absent, it attempts to remove directories associated with the user.The behavior is the same as userdel --remove, check the man page for details and support. |
| role string | Sets the role of the user. Can set multiple roles using comma separation. Currently supported on Illumos/Solaris. | |
| seuser string | Optionally sets the seuser type (user_u) on selinux enabled systems. | |
| shell string | On macOS, before Ansible 2.5, the default shell for non-system users was /usr/bin/false. Since Ansible 2.5, the default shell for non-system users on macOS is /bin/bash.On other operating systems, the default shell is determined by the underlying tool being used. See Notes for details. | |
| skeleton string | Requires create_home option! | |
| ssh_key_bits integer | Default: | Optionally specify number of bits in SSH key to create. |
| ssh_key_comment string | Default: | Optionally define the comment for the SSH key. |
| ssh_key_file path | If this is a relative filename then it will be relative to the user's home directory. | |
| ssh_key_passphrase | Set a passphrase for the SSH key. If no passphrase is provided, the SSH key will default to having no passphrase. | |
| ssh_key_type string | Default: | Optionally specify the type of SSH key to generate. Available SSH key types will depend on implementation present on target host. |
| state string |
| Whether the account should exist or not, taking action if the state is different from what is stated. |
| system boolean |
| When creating an account state=present, setting this to yes makes the user a system account. |
| uid | Optionally sets the UID of the user. | |
| update_password string |
| always will update passwords if they differ.on_create will only set the password for newly created users. |
Note
So Ansible is attempting to find your users' keys on 'Ansible Server'. Personally I wouldn't use the generatesshkey parameter in your user task. Each user will have a different key for each server. You will have to distribute the keys to each user since they won't be able to get. The ansible command module does not pass commands through a shell. This means you can't use shell operators such as the pipe, and that is why you are seeing the pipe symbol in the output. As far as ansible is concerned, it has executed the command echo with all of the rest of the line as arguments to echo. /resident-evil-6-key-generator.html.
dscl to create, modify, and delete accounts. dseditgroup is used to modify group membership. Accounts are hidden from the login window by modifying /Library/Preferences/com.apple.loginwindow.plist.pwuseradd and chpass to create, pwusermod and chpass to modify, pwuserdel remove, pwlock to lock, and pwunlock to unlock accounts.useradd to create, usermod to modify, and userdel to remove accounts.See also
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
| append boolean | When state is 'present' and the user exists | Sample: |
| comment | When user exists | Comment section from passwd file, usually the user name Agent Smith |
| create_home boolean | When user does not exist and not check mode | Sample: |
| force | When state is 'absent' and user exists | Whether or not a user account was forcibly deleted |
| group integer | When user exists | Sample: |
| groups | When groups is not empty and state is 'present' | List of groups of which the user is a member chrony,apache |
| home string | When state is 'present' | Sample: |
| move_home | When state is 'present' and user exists | Whether or not to move an existing home directory |
| name string | always | Sample: |
| password | When state is 'present' and password is not empty | Masked value of the password NOT_LOGGING_PASSWORD |
| remove boolean | When state is 'absent' and user exists | Sample: |
| shell | When state is 'present' | User login shell /bin/bash |
| ssh_fingerprint string | When generate_ssh_key is True | Sample: 2048 SHA256:aYNHYcyVm87Igh0IMEDMbvW0QDlRQfE0aJugp684ko8 ansible-generated on host (RSA) |
| ssh_key_file string | When generate_ssh_key is True | Sample: |
| ssh_public_key | When generate_ssh_key is True | Generated SSH public key file 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC95opt4SPEC06tOYsJQJIuN23BbLMGmYo8ysVZQc4h2DZE9ugbjWWGS1/pweUGjVstgzMkBEeBCByaEf/RJKNecKRPeGd2Bw9DCj/bn5Z6rGfNENKBmo 618mUJBvdlEgea96QGjOwSB7/gmonduC7gsWDMNcOdSE3wJMTim4lddiBx4RgC9yXsJ6Tkz9BHD73MXPpT5ETnse+A3fw3IGVSjaueVnlUyUmOBf7fzmZbhlFVXf2Zi2rFTXqvbdGHKkzpw1U8eB8xFPP7y d5u1u0e6Acju/8aZ/l17IDFiLke5IzlqIMRTEbDwLNeO84YQKWTm9fODHzhYe0yvxqLiK07 ansible-generated on host' |
| stderr string | When stderr is returned by a command that is run | Sample: |
| stdout | When standard output is returned by the command that is run | Standard output from running commands |
| system boolean | When system is passed to the module and the account does not exist | Sample: |
| uid | When UID is passed to the module | User ID of the user account 1044 |
More information about Red Hat’s support of this module is available from this Red Hat Knowledge Base article.
Hint
If you notice any issues in this documentation, you can edit this document to improve it.