110 lines
4.1 KiB
YAML
110 lines
4.1 KiB
YAML
---
|
|
- name: Acquiring home of current user
|
|
when: ansible_facts["system"] == "Linux"
|
|
ansible.builtin.shell:
|
|
cmd: "echo ~{{ ansible_user }}"
|
|
register: ansible_user_home
|
|
- name: Acquiring home of current user
|
|
when: ansible_facts["system"] == "Linux"
|
|
ansible.builtin.shell:
|
|
cmd: "echo {{ ansible_user }}"
|
|
register: current_user
|
|
- name: Setting up TOTP using Google Authenticator
|
|
become: true
|
|
become_user: "{{ current_user.stdout }}"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- "google-authenticator"
|
|
- "-t"
|
|
- "-d"
|
|
- "-f"
|
|
- "-C"
|
|
- "-q"
|
|
- "-l {{ ansible_user }}@{{ inventory_hostname }}"
|
|
- "-i {{ inventory_hostname }}"
|
|
- "--qr-mode=NONE"
|
|
- "-r 7"
|
|
- "-R 300"
|
|
- "-w 9"
|
|
creates: "{{ ansible_user_home.stdout }}/.google_authenticator"
|
|
- name: Pausing to inquire about how to proceed
|
|
ansible.builtin.pause:
|
|
prompt: "Type \"fetch\" to get the TOTP secret and backup codes, or \"show\" to see it for manual copying instead"
|
|
echo: true
|
|
register: data_method
|
|
- name: Choosing to present TOTP secret and backup codes to Control Node
|
|
when: data_method.user_input == "show"
|
|
block:
|
|
- name: Acquiring contents of file containing TOTP secret and backup codes
|
|
ansible.builtin.slurp:
|
|
src: "{{ ansible_user_home.stdout }}/.google_authenticator"
|
|
register: totp_token
|
|
- name: Presenting TOTP secret and backup codes to Control Node
|
|
ansible.builtin.debug:
|
|
msg: "Make sure to store the following TOTP secret and backup codes for Google Authenticator:\n {{ totp_token.content | b64decode }}"
|
|
- name: Giving opportunity to manually copy TOTP secret and backup codes
|
|
ansible.builtin.pause:
|
|
- name: Choosing to provide file on control node containing TOTP secret and backup codes
|
|
when: data_method.user_input == "fetch"
|
|
block:
|
|
- name: Placing TOTP secret and backup codes into file on control node
|
|
ansible.builtin.fetch:
|
|
src: "{{ ansible_user_home.stdout }}/.google_authenticator"
|
|
dest: "./.tmp/{{ inventory_hostname }}-google-auth/google_auth.secret"
|
|
flat: true
|
|
- name: Informing control node of acquired files
|
|
ansible.builtin.debug:
|
|
msg: "The TOTP secret and backup codes file has been duplicated to './.tmp/{{ inventory_hostname }}-google-auth/google-auth.secret' at the control node."
|
|
- name: Giving control node user time to read the aforementiioned message
|
|
ansible.builtin.pause:
|
|
seconds: 30
|
|
- name: Adding Google Authenticator OTP module PAM authentication line for SSH
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pam.d/sshd
|
|
line: "auth sufficient pam_google_authenticator.so nullok"
|
|
insertafter: "include common-auth$"
|
|
owner: root
|
|
group: root
|
|
mode: "644"
|
|
- name: Prioritizing authentication methods in SSH
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config.d/auth.conf
|
|
line: "KbdInteractiveAuthentication yes # enable if implementing TOTP 2FA"
|
|
regexp: "^KbdInteractiveAuthentication"
|
|
owner: root
|
|
group: root
|
|
mode: "644"
|
|
- name: Prioritizing authentication methods in SSH
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/ssh/sshd_config.d/auth.conf
|
|
line: "AuthenticationMethods publickey keyboard-interactive:pam"
|
|
insertafter: "^KbdInteractiveAuthentication"
|
|
owner: root
|
|
group: root
|
|
mode: "644"
|
|
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH
|
|
# become: true
|
|
# ansible.builtin.lineinfile:
|
|
# path: /etc/pam.d/sudo
|
|
# line: "auth required pam_google_authenticator.so nullok"
|
|
# insertafter: "include common-auth$"
|
|
# owner: root
|
|
# group: root
|
|
# mode: "644"
|
|
# - name: Adding Google Authenticator OTP module PAM authentication line for SSH
|
|
# become: true
|
|
# ansible.builtin.lineinfile:
|
|
# path: /etc/pam.d/su
|
|
# line: "auth required pam_google_authenticator.so nullok"
|
|
# insertafter: "include common-auth$"
|
|
# owner: root
|
|
# group: root
|
|
# mode: "644"
|
|
- name: Restarting SystemD SSH service
|
|
become: true
|
|
ansible.builtin.systemd_service:
|
|
name: sshd
|
|
state: restarted |