xoxys.sshd/tasks/ssh_2fa.yml
Robert Kaussow 3afa931e05
All checks were successful
ci/woodpecker/push/lint Pipeline was successful
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/push/notify Pipeline was successful
ci/woodpecker/push/docs Pipeline was successful
ci: migrate to woodpecker
2024-02-18 13:22:43 +01:00

40 lines
1019 B
YAML

---
- name: Install google authenticator PAM module
ansible.builtin.package:
name: google-authenticator
state: present
- name: Add google auth module to PAM
community.general.pamd:
name: sshd
type: account
control: required
module_path: pam_nologin.so
new_type: auth
new_control: required
new_module_path: pam_google_authenticator.so
state: before
- name: Skip google auth for specific group
community.general.pamd:
name: sshd
type: auth
control: required
module_path: pam_google_authenticator.so
new_type: auth
new_control: "[success=done default=ignore]"
new_module_path: pam_succeed_if.so
module_arguments:
- user
- ingroup
- "{{ sshd_google_auth_exclude_group }}"
state: "{{ 'before' if sshd_google_auth_exclude_group is defined else 'absent' }}"
- name: Remove password auth from PAM
community.general.pamd:
name: sshd
type: auth
control: substack
module_path: password-auth
state: absent