Procházet zdrojové kódy

Изменить ''

Vladimir Smagin před 1 rokem
1 změnil soubory, kde provedl 1 přidání a 54 odebrání
  1. +1

+ 1
- 54 Zobrazit soubor

@@ -2,61 +2,7 @@

Installation: ```git clone```

Now you can configure your security with this simple ansible playbook. Remember that dicts in parent group merges with dicts in child groups.


|- hetzner-balancers
|- hetzner-nodes

All servers will be available to the administrator and assistant, servers must have own internal key for files copying. Configuring parent ```hetzner```group:

admin: { keypath: "../keys/", username: "root" }
techguy: { keypath: "../keys/", username: "root" }
interserver: { keypath: "../keys/", username: "root" }

interserver: { keypath: "../keys/interserver.pem", username: "root" }

You want to make additional access to all nodes for developer guy. Configuring child ```hetzner-nodes``` group:

developer: { keypath: "../keys/", username: "dev" }

Some stupid manager ruined your day, now you want to stop him

admin: { keypath: "../keys/", username: "root" }
techguy: { keypath: "../keys/", username: "root" }
stupid_manager: { keypath: "../keys/", username: "ubuntu", key_state: "absent" }

You can set additional SSHd options like code below, see defaults of ssh_config role.

sshd_config_path: "/etc/ssh/sshd_config"

PubkeyAuthentication: "yes"
PasswordAuthentication: "no"

No need to make additional config for ```hetzner-balancers``` because access list will be inherited, only admins accessible.

**Using master key**

Warning! Playbook will delete all public keys in root's ```.ssh/authorized_keys``` file and setup own **super** key, only after this public keys in group_vars and host_vars will be added into assigned users ```.ssh/authorized_keys``` files. If you do not want to lost already installed pubkeys then add all of them to this playbook before first run.

**Security issue!** You need to generate your own super key! Run ```ssh-keygen -f superkey``` and replace keys in ```secret/``` directory. DO NOT USE DEMO KEY!
Read documentation on wiki pages here


Načítá se…