79 lines
2.6 KiB
YAML
79 lines
2.6 KiB
YAML
---
|
|
- name: Configure MOTD
|
|
when: system_cfg.features.banner.motd | bool
|
|
block:
|
|
- name: Create MOTD file
|
|
ansible.builtin.copy:
|
|
content: |
|
|
********************************************************************
|
|
* AUTHORIZED ACCESS ONLY. ALL ACTIVITIES ARE MONITORED AND LOGGED. *
|
|
********************************************************************
|
|
dest: /mnt/etc/motd
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Remove other MOTD files
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: absent
|
|
loop:
|
|
- /mnt/etc/motd.d/99-motd
|
|
- /mnt/etc/motd.d/cockpit
|
|
- /mnt/etc/motd.d/insights-client
|
|
failed_when: false
|
|
|
|
- name: Create login banner
|
|
ansible.builtin.copy:
|
|
dest: "{{ item }}"
|
|
content: |
|
|
**************************************************************
|
|
* WARNING: Unauthorized access to this system is prohibited. *
|
|
* All activities are monitored and logged. *
|
|
* Disconnect immediately if you are not an authorized user. *
|
|
**************************************************************
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- /mnt/etc/issue
|
|
- /mnt/etc/issue.net
|
|
|
|
- name: Configure sudo banner
|
|
when: system_cfg.features.banner.sudo | bool
|
|
block:
|
|
- name: Detect the target sudo implementation
|
|
ansible.builtin.command: "{{ chroot_command }} /usr/bin/sudo --version"
|
|
register: configuration_sudo_version
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
# sudo-rs (Ubuntu 25.10+) implements neither `lecture` nor `lecture_file`
|
|
# and warns on every sudo call when they are set. It prints its version banner
|
|
# to stderr, not stdout, so match against both streams.
|
|
- name: Configure the sudo lecture
|
|
when: "'sudo-rs' not in (configuration_sudo_version.stdout ~ configuration_sudo_version.stderr)"
|
|
block:
|
|
- name: Create sudo lecture file
|
|
ansible.builtin.copy:
|
|
content: |
|
|
I am Groot, and I know what I'm doing.
|
|
dest: /mnt/etc/sudo_lecture
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Enable sudo lecture in sudoers
|
|
ansible.builtin.lineinfile:
|
|
path: /mnt/etc/sudoers
|
|
line: "{{ item }}"
|
|
state: present
|
|
create: true
|
|
mode: "0440"
|
|
owner: root
|
|
group: root
|
|
validate: "/usr/sbin/visudo --check --file=%s"
|
|
loop:
|
|
- "Defaults lecture=always"
|
|
- "Defaults lecture_file=/etc/sudo_lecture"
|