Browse Source

import ssh

Vladimir Smagin 2 months ago
parent
commit
63243cc40d

+ 1
- 4
.gitignore View File

@@ -1,5 +1,2 @@
1
-*.retry
2 1
 *.log
3
-*.pyc
4
-__PYCACHE__
5
-
2
+*.retry

+ 4
- 0
ansible.cfg View File

@@ -0,0 +1,4 @@
1
+[defaults] 
2
+log_path=ansible.log
3
+nocows = 1
4
+hash_behaviour = merge

+ 4
- 0
group_vars/hetzner-nodes.yml View File

@@ -0,0 +1,4 @@
1
+access_list:
2
+  git: { keypath: "../keys/project-git.pub", username: "root" }
3
+  dev1: { keypath: "../keys/developer1.pub", username: "root" }
4
+  dev2: { keypath: "../keys/developer2.pub", username: "root" }

+ 6
- 0
group_vars/hetzner.yml View File

@@ -0,0 +1,6 @@
1
+access_list:
2
+  admin: { keypath: "../keys/admin.pub", username: "root" }
3
+  techguy: { keypath: "../keys/techguy.pub", username: "root" }
4
+  interserver: { keypath: "../keys/interserver.pub", username: "root" }
5
+secret_list:
6
+  interserver: { keypath: "../keys/interserver.pem", username: "root" }

+ 3
- 0
host_vars/monitor.yml View File

@@ -0,0 +1,3 @@
1
+access_list:
2
+  admin: { keypath: "../keys/admin.pub", username: "root" }
3
+  techguy: { keypath: "../keys/techguy.pub", username: "root" }

+ 15
- 0
inventory.ini View File

@@ -0,0 +1,15 @@
1
+[monitoring]
2
+monitor ansible_host=44.165.225.144 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"
3
+
4
+[hetzner:children]
5
+hetzner-balancers
6
+hetzner-nodes
7
+
8
+[hetzner-nodes]
9
+hetzner-node0 ansible_host=145.251.216.112 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"
10
+hetzner-node1 ansible_host=154.64.4.185 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"
11
+hetzner-node2 ansible_host=168.251.172.244 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"
12
+
13
+[hetzner-balancers]
14
+hetzner-balancer0 ansible_host=145.251.216.154 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"
15
+hetzner-balancer1 ansible_host=78.46.246.78 ansible_user=root ansible_ssh_private_key_file="secrets/superkey.pem"

+ 35
- 7
readme.md View File

@@ -1,13 +1,41 @@
1
-# My useful ansible playbooks
1
+# Ansible centralized keys management
2 2
 
3
-Security management:
3
+Dicts in parent group merges with dicts in child groups. 
4 4
 
5
-- [Centralized SSH keys management](https://git.blindage.org/21h/ansible-library/src/branch/centralized-keys)
5
+Warning! Playbook will delete all public keys in root's ```.ssh/authorized_keys``` file and setup own **super** key, only after this public keys in group_vars and host_vars will be added into assigned users ```.ssh/authorized_keys``` files.
6 6
 
7
-System and monitoring:
7
+**Security issue!** You need to generate your own super key! Run ```ssh-keygen -f superkey``` and replace keys in ```secret/``` directory.
8 8
 
9
-- [Create systemd and upstart scripts](https://git.blindage.org/21h/ansible-library/src/branch/sys-systemd-and-upstart)
9
+Infrastructure:
10 10
 
11
-Web deployment:
11
+```
12
+--[ hetzner ]--\
13
+               |- hetzner-balancers
14
+               \- hetzner-nodes
15
+```
12 16
 
13
-- [PHP 7.1 FPM + Nginx](https://git.blindage.org/21h/ansible-library/src/branch/web-nginx-php-fpm7.1)
17
+All servers will be available to the administrator and assistant, servers must have own internal key for files copying. Configuring parent ```hetzner```group:
18
+
19
+```
20
+    access_list:
21
+      admin: { keypath: "../keys/admin.pub", username: "root" }
22
+      techguy: { keypath: "../keys/techguy.pub", username: "root" }
23
+      interserver: { keypath: "../keys/interserver.pub", username: "root" }
24
+
25
+    secret_list:
26
+      interserver: { keypath: "../keys/interserver.pem", username: "root" }
27
+```
28
+
29
+You want to make additional access to all nodes for developer guy. Configuring child ```hetzner-nodes``` group:
30
+
31
+```
32
+    access_list:
33
+      developer: { keypath: "../keys/developer.pub", username: "dev" }
34
+```
35
+
36
+No need to make additional config for ```hetzner-balancers``` because access list will be inherited, only admins accessible.
37
+
38
+---
39
+Copyright by Vladimir Smagin, 2018
40
+http://blindage.org
41
+21h@blindage.org

+ 1
- 0
roles/master_key/meta/main.yml View File

@@ -0,0 +1 @@
1
+allow_duplicates: true

+ 7
- 0
roles/master_key/tasks/main.yml View File

@@ -0,0 +1,7 @@
1
+---
2
+- name: Set primary ansible key and remove others
3
+  authorized_key:
4
+    user: root
5
+    state: present
6
+    exclusive: True
7
+    key: "{{ lookup('file', 'secrets/superkey.pub') }}"

+ 1
- 0
roles/preinstall/meta/main.yml View File

@@ -0,0 +1 @@
1
+allow_duplicates: true

+ 18
- 0
roles/preinstall/tasks/main.yml View File

@@ -0,0 +1,18 @@
1
+---
2
+- name: Minimum packages for Debian-like
3
+  apt: name="{{ item }}" state=present update_cache=yes
4
+  become: yes
5
+  with_items:
6
+    - mc
7
+    - htop 
8
+  when: (ansible_distribution == 'Ubuntu' or ansible_distribution == 'Debian') and preinstall is defined
9
+
10
+- name: Minimum packages for RedHat-like
11
+  become: yes
12
+  yum: name="{{ item }}" state=present update_cache=yes
13
+  with_items:
14
+    - mc
15
+    - htop
16
+  when: (ansible_distribution == 'Red Hat' or ansible_distribution == 'Centos') and preinstall is defined
17
+
18
+

+ 1
- 0
roles/ssh_access/meta/main.yml View File

@@ -0,0 +1 @@
1
+allow_duplicates: true

+ 21
- 0
roles/ssh_access/tasks/main.yml View File

@@ -0,0 +1,21 @@
1
+---
2
+#- debug:
3
+#    msg: "{{ access_list }}"
4
+  
5
+- name: Set public keys
6
+  become: true
7
+  become_user: "{{ item.value.username }}"
8
+  authorized_key: user="{{ item.value.username }}" key="{{ lookup('file', item.value.keypath) }}" state=present
9
+  with_dict: "{{ access_list }}"
10
+  when: access_list != None and access_list is defined
11
+
12
+#- debug:
13
+#    msg: "{{ secret_list }}"
14
+
15
+- name: Upload secret keys
16
+  become: true
17
+  become_user: "{{ item.value.username }}"
18
+  copy: src="{{ item.value.keypath }}" dest="~/.ssh/{{ item.value.keypath | basename }}" mode=0600
19
+  with_dict: "{{ secret_list }}"
20
+  when: secret_list != None and secret_list is defined
21
+

+ 27
- 0
secrets/superkey.key View File

@@ -0,0 +1,27 @@
1
+-----BEGIN RSA PRIVATE KEY-----
2
+MIIEpAIBAAKCAQEAwNv29GRDfroj6Ue5iPsj/E5nX7QWRPzfHIj8pMms3+YY/rt6
3
+em077AXFGQITr874Y5tnjS7joO1LnOU71D/Yy80ty4kqL56U20OBGLrFxv/swJgf
4
+QweSv9nFkj+sEONqu/kM7Ailu4sOkcAzH/aA8tLVpAyC5xf+wYhtX3twUkbSPgpG
5
+N6hV/TaNMt27moWwOMui0Hm6EYriPYBD7c7wHwgLwkksq+SLLHDqJqiWrBSRnwCv
6
+KBAIpMyqwhjLICk7LyuAZdXF+LdJXssXLnnpwl1HspkRt/QhbznRqyLqdD6pfVRv
7
+yRalZxK7xv8akYlCzzWgCHGbw98KexUBLcw8oQIDAQABAoIBAFcjS7pyjth0bANc
8
+B+Vva3v1RNnF+YXkJz6yWkxuXvCu+z4lIRqtvjRPCxXYjWKTBkGjFq+ArxKoBND3
9
+9gdZba/vnbBn4iqv4RwMrQiqYvAd9C+0y/MyOcj7MTx6Dll3F2OlDISdB5zsIIIU
10
+MEVR0ENmpWbAzGhzvARfiuNoV4CkfCMk8+1l5m0eLuFih74IW3Ka62tUx6DUIl9/
11
+KTsgFqsGY7if6RomEWJssoDWYhfVpy2PyIR9Rvs3sTSKXKlHAZIewTbiwsjsknjw
12
+8x6eJpi6KogZ2jsgmjOzAUkyAjFm5+Su7l0H58nJk6V0b4eskXGZD4nzzmUSmjEw
13
+L1MmW90CgYEA59RpCp3t0MGX5IPkKezaCXC6uvP1cUPKIcz9MrYDDzX4mWUIiKza
14
+hyPPllmV75sUk11/bMcwOlYiRlpwCRq6Wh5BV3D34/YSNF7gOyUkNrEWt04UAlSD
15
+pwEP8RMv+GXhPGfWJrhuF3zTYoWy8347LKuKgkLxDgWYwvYaJTXMVDsCgYEA1Pds
16
+Poup+X8eOOtF80w8T7joTEI4TM0h7LdJnK8Don99jG4dQdgXB/r8qsCSkjHG6nkn
17
+6qsJXEULybxuc4qD444LwNWAVVxHE6e69plW5jtzO5ZXEEMFOpBawAZDIOtiePUr
18
+ZrXp4X48o429XWBenZPJZmtCFCnd8943AEkLcNMCgYEAocEMNZMx3qllMNVxumr/
19
+Svzz3QPhKlFRVLoxpFNo2REgTu82wB5TL12mNtJ1EkSTW6suAJkOpnV43ru1VjTm
20
+94AKuVciL1V/KDlWnQ3yMZLoNaftwB516W2NUPjBTMDRIhOVUVj3v72hxCljTg+y
21
+fB2IvBC3HsB68PVEEthxpAcCgYA+3N39xFojBGvWX1RhkcJHwgwH3pAh03dNGXlI
22
+H70R7VIQ7rwCIJgDygllGbzqHHlb4vFuapgzvUnSfaWYw21U8Sv0+tCL4dY1LhCZ
23
+FAA7q5bDIwiGC1JyzAONpQuRnwmNLMln4xCreAjMOl2IP5cOKn6LleOGcilK/+/6
24
+TJVs8wKBgQDSOzTch2lQViWQhSFO2nnQ5Os7nLhQGhWLQP+L6JJiTIeAv0oITyQC
25
+IVOzsysepQYnm/bSHDXRHpzYR/Cq2FJIIPKvBIHuh60zqhpfpG97+fCibRFfWcoe
26
+DFR+2w5mcReEHjwAT5dVBfYVlLb75Zmu7P0/C4KG6DGtRNxEGSjUSw==
27
+-----END RSA PRIVATE KEY-----

+ 1
- 0
secrets/superkey.pub View File

@@ -0,0 +1 @@
1
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDA2/b0ZEN+uiPpR7mI+yP8TmdftBZE/N8ciPykyazf5hj+u3p6bTvsBcUZAhOvzvhjm2eNLuOg7Uuc5TvUP9jLzS3LiSovnpTbQ4EYusXG/+zAmB9DB5K/2cWSP6wQ42q7+QzsCKW7iw6RwDMf9oDy0tWkDILnF/7BiG1fe3BSRtI+CkY3qFX9No0y3buahbA4y6LQeboRiuI9gEPtzvAfCAvCSSyr5IsscOomqJasFJGfAK8oEAikzKrCGMsgKTsvK4Bl1cX4t0leyxcueenCXUeymRG39CFvOdGrIup0Pql9VG/JFqVnErvG/xqRiULPNaAIcZvD3wp7FQEtzDyh demo key. do not use it!

+ 3
- 0
ssh-keys.sh View File

@@ -0,0 +1,3 @@
1
+#!/bin/bash
2
+
3
+ansible-playbook ssh-keys.yml -i inventory.ini

+ 7
- 0
ssh-keys.yml View File

@@ -0,0 +1,7 @@
1
+---
2
+- hosts: all
3
+  gather_facts: True
4
+  roles:
5
+    - master_key
6
+    - preinstall
7
+    - ssh_access

Loading…
Cancel
Save