68 lines
1.8 KiB
Bash
68 lines
1.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ANSIBLE_USER="ansible"
|
|
ANSIBLE_HOME="/home/${ANSIBLE_USER}"
|
|
SSH_DIR="${ANSIBLE_HOME}/.ssh"
|
|
AUTHORIZED_KEYS="${SSH_DIR}/authorized_keys"
|
|
SUDOERS_FILE="/etc/sudoers.d/${ANSIBLE_USER}"
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
echo "Usage: $0 /path/to/ansible-control-node.pub" >&2
|
|
exit 1
|
|
fi
|
|
|
|
KEY_FILE="$1"
|
|
|
|
if [[ ! -f "$KEY_FILE" ]]; then
|
|
echo "[ERROR] Public key file not found: $KEY_FILE" >&2
|
|
exit 1
|
|
fi
|
|
|
|
PUBLIC_KEY="$(< "$KEY_FILE")"
|
|
|
|
if ! grep -Eq '^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521) [A-Za-z0-9+/=]+([[:space:]].*)?$' <<< "$PUBLIC_KEY"; then
|
|
echo "[ERROR] Invalid OpenSSH public key format" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
SUDO="sudo"
|
|
else
|
|
SUDO=""
|
|
fi
|
|
|
|
$SUDO true
|
|
|
|
if ! id "$ANSIBLE_USER" >/dev/null 2>&1; then
|
|
$SUDO useradd --create-home --shell /bin/bash "$ANSIBLE_USER"
|
|
fi
|
|
|
|
$SUDO passwd -l "$ANSIBLE_USER" >/dev/null
|
|
|
|
$SUDO install -d -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 700 "$SSH_DIR"
|
|
$SUDO touch "$AUTHORIZED_KEYS"
|
|
$SUDO chown "$ANSIBLE_USER:$ANSIBLE_USER" "$AUTHORIZED_KEYS"
|
|
$SUDO chmod 600 "$AUTHORIZED_KEYS"
|
|
|
|
if ! $SUDO grep -Fxq "$PUBLIC_KEY" "$AUTHORIZED_KEYS"; then
|
|
echo "$PUBLIC_KEY" | $SUDO tee -a "$AUTHORIZED_KEYS" >/dev/null
|
|
fi
|
|
|
|
TMP_AUTH_KEYS="$(mktemp)"
|
|
$SUDO awk 'NF && !seen[$0]++' "$AUTHORIZED_KEYS" > "$TMP_AUTH_KEYS"
|
|
$SUDO install -o "$ANSIBLE_USER" -g "$ANSIBLE_USER" -m 600 "$TMP_AUTH_KEYS" "$AUTHORIZED_KEYS"
|
|
rm -f "$TMP_AUTH_KEYS"
|
|
|
|
TMP_SUDOERS="$(mktemp)"
|
|
cat > "$TMP_SUDOERS" <<EOF
|
|
${ANSIBLE_USER} ALL=(ALL) NOPASSWD: ALL
|
|
EOF
|
|
|
|
$SUDO visudo -cf "$TMP_SUDOERS" >/dev/null
|
|
$SUDO install -o root -g root -m 0440 "$TMP_SUDOERS" "$SUDOERS_FILE"
|
|
rm -f "$TMP_SUDOERS"
|
|
|
|
$SUDO visudo -cf "$SUDOERS_FILE" >/dev/null
|
|
|
|
echo "[OK] Ansible service account configured successfully" |