oefenweb / ansible-sudoers

Ansible role to manage sudoers and sudoers.d in Debian-like systems

sudoers

Manage sudoers and sudoers.d in Debian-like systems.

Requirements

None

Variables

• sudoers_sudoers: /etc/sudoers file declarations

• sudoers_sudoers.defaults: [default: see defaults/main.yml]: Default configuration options

• sudoers_sudoers.host_aliases: [default: []]: A list of aliases of type Host_Alias

• sudoers_sudoers.host_aliases.name: Name of the alias

• sudoers_sudoers.host_aliases.members: Member(s) of the alias

• sudoers_sudoers.user_aliases: [default: []]: A list of aliases of type User_Alias

• sudoers_sudoers.user_aliases.name: Name of the alias

• sudoers_sudoers.user_aliases.members: Member(s) of the alias

• sudoers_sudoers.cmnd_aliases: [default: []]: A list of aliases of type Cmnd_Alias

• sudoers_sudoers.cmnd_aliases.name: Name of the alias

• sudoers_sudoers.cmnd_aliases.members: Member(s) of the alias

• sudoers_sudoers.runas_aliases: [default: []]: A list of aliases of type Runas_Alias

• sudoers_sudoers.runas_aliases.name: Name of the alias

• sudoers_sudoers.runas_aliases.members: Member(s) of the alias

• sudoers_sudoers.privileges: [default: see defaults/main.yml]: List of privileges

• sudoers_sudoers.privileges.name: Name of user or group (group should be prefixed with '%')

• sudoers_sudoers.privileges.entry: A privilege entry

• sudoers_sudoers_d_files [default: {}]: /etc/sudoers.d/* file(s) declarations

• sudoers_sudoers_d_files.key: The name of the sudoers configuration file (e.g vagrant)

• sudoers_sudoers_d_files.key.defaults [default: []]: Default configuration options

• sudoers_sudoers_d_files.key.host_aliases [default: []]: A list of aliases of type Host_Alias

• sudoers_sudoers_d_files.key.host_aliases.name: Name of the alias

• sudoers_sudoers_d_files.key.host_aliases.members: Member(s) of the alias

• sudoers_sudoers_d_files.key.user_aliases [default: []]: A list of aliases of type User_Alias

• sudoers_sudoers_d_files.key.user_aliases.name: Name of the alias

• sudoers_sudoers_d_files.key.user_aliases.members: Member(s) of the alias

• sudoers_sudoers_d_files.key.cmnd_aliases [default: []]: A list of aliases of type Cmnd_Alias

• sudoers_sudoers_d_files.key.cmnd_aliases.name: Name of the alias

• sudoers_sudoers_d_files.key.cmnd_aliases.members: Member(s) of the alias

• sudoers_sudoers_d_files.key.runas_aliases [default: []]: A list of aliases of type Runas_Alias

• sudoers_sudoers_d_files.key.runas_aliases.name: Name of the alias

• sudoers_sudoers_d_files.key.runas_aliases.members: Member(s) of the alias

• sudoers_sudoers_d_files.key.privileges [default: []]: List of privileges

• sudoers_sudoers_d_files.key.privileges.name: Name of user or group (group should be prefixed with '%')

• sudoers_sudoers_d_files.key.privileges.entry: A privilege entry

• sudoers_sudoers_d_directory_mode [default: keep as is]: Directory mode for /etc/sudoers.d, e.g. '0750'

Dependencies

None

Example(s)

Simple configuration

---
- hosts: all
  roles:
    - oefenweb.sudoers

Complex configuration

---
- hosts: all
  roles:
    - oefenweb.sudoers
  vars:
    sudoers_sudoers:
      defaults:
        - env_reset
        - exempt_group=sudo
        - mail_badpass
        - secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      host_aliases:
        - name: CUNETS
          members: 128.138.0.0/255.255.0.0
        - name: SERVERS
          members: master, mail, www, ns
      user_aliases:
        - name: FULLTIMERS
          members: millert, mikef, dowdy
        - name: PARTTIMERS
          members: bostley, jwfox, crawl
      cmnd_aliases:
        - name: KILL
          members: /usr/bin/kill
        - name: HALT
          members: /usr/sbin/halt
      privileges:
        - name: root
          entry: "ALL=(ALL:ALL) ALL"
        - name: "%admin"
          entry: "ALL=(ALL) ALL"
        - name: "%sudo"
          entry: "ALL=NOPASSWD:ALL"
    sudoers_sudoers_d_files:
      test:
        defaults:
          - env_reset
          - exempt_group=sudo
          - mail_badpass
          - secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        host_aliases:
          - name: WORKSTATIONS
            members: 128.138.0.0/255.255.0.0
        privileges:
          - name: test
            entry: "ALL=(ALL:ALL) ALL"

License

MIT

Author Information

• Mark van Driel
• Mischa ter Smitten

Feedback, bug-reports, requests, ...

Are welcome!

ansible-sudoers's Issues

Limit permissions of /etc/sudoers.d

For security purpose, the permissions of /etc/sudoers.d should probably be set to 0750. It would be a nice addition to the role. If you agree with that, I can probably make a pull request.

Sudoers

Revise /etc/sudoers

Ubuntu 12.04

Defaults	env_reset
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

Ubuntu 14.04

Defaults	env_reset
Defaults	mail_badpass
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

Ubuntu 16.04

Defaults	env_reset
Defaults	mail_badpass
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

Debian 7

Defaults	env_reset
Defaults	mail_badpass
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

Debian 8

Defaults	env_reset
Defaults	mail_badpass
Defaults	secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo	ALL=(ALL:ALL) ALL

support limited defaults section

From man sudoers on Ubuntu Xenial:

 Defaults
     Certain configuration options may be changed from their default values at run-time via one or more Default_Entry lines.  These may affect all users on any host, all users on a specific host, a
     specific user, a specific command, or commands being run as a specific user.  Note that per-command entries may not include command line arguments.  If you need to specify arguments, define a
     Cmnd_Alias and reference that instead.

     Default_Type ::= 'Defaults' |
                      'Defaults' '@' Host_List |
                      'Defaults' ':' User_List |
                      'Defaults' '!' Cmnd_List |
                      'Defaults' '>' Runas_List

     Default_Entry ::= Default_Type Parameter_List

     Parameter_List ::= Parameter |
                        Parameter ',' Parameter_List

     Parameter ::= Parameter '=' Value |
                   Parameter '+=' Value |
                   Parameter '-=' Value |
                   '!'* Parameter

...
...

     Defaults entries are parsed in the following order: generic, host, user and runas Defaults first, then command defaults.  If there are multiple Defaults settings of the same type, the last
     matching setting is used.  The following Defaults settings are parsed before all others since they may affect subsequent entries: fqdn, group_plugin, runas_default, sudoers_locale.

     See SUDOERS OPTIONS for a list of supported Defaults parameters.

It would be great if this role supported Host/User/Cmnd/Runas defaults as well. The current templates:

• ansible-sudoers/templates/etc/sudoers.d/sudoers.j2

  Line 4 in 03a3615

  Defaults {{ item }}

• ansible-sudoers/templates/etc/sudoers.j2

  Line 12 in 03a3615

  Defaults {{ item }}

make it not possible. Note that an extra space between Defaults and the special characters are not accepted by sudo (e.g. Defaults : !MY_COMMAND !requiretty is rejected by sudo as syntax error.

Can't replace sudoers files

Hi

Thanks for a well-crafted ansible role.

I'm having a problem when using it on Debian Jessie though. I get this error:
[Errno 2] No such file or directory
when this task is being run:
TASK [tersmitten.sudoers : update global configuration file] *******************

The problem seems to be that the ansible template module is not allowed to modify the sudoers file.
I have a similar problem with a file in the sudoers.d dir, which could be worked around by removing the file (file state: absent) just before the template task.

However, this will not work with the global file, since removing that would render any sudo command (including those from ansible) useless.

Do you have an idea on how to solve this ?