diff --git a/defaults/main.yml b/defaults/main.yml index 12e8b69..a4c70e2 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -2,6 +2,8 @@ sudo_packages: - sudo +sudo_logfile: /var/log/sudo.log + sudo_misc_settings: - "!visiblepw" - always_set_home diff --git a/tasks/main.yml b/tasks/main.yml index 1f69f7a..b436460 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,2 +1,33 @@ --- -- include_tasks: setup.yml +- block: + - name: Install requirements + package: + name: "{{ item }}" + state: present + loop: "{{ sudo_packages }}" + + - name: Add base sudo config + template: + src: etc/sudoers.j2 + dest: /etc/sudoers + owner: root + group: root + mode: 0440 + validate: "/usr/sbin/visudo -cf %s" + + - name: Add config files to sudoers.d + template: + src: etc/sudoers.d/sudo_ext.j2 + dest: "/etc/sudoers.d/{{ item.name }}" + owner: root + group: root + mode: 0440 + validate: "/usr/sbin/visudo -cf %s" + loop: "{{ sudo_aliases }}" + loop_control: + label: "{{ item.name }}" + when: + - sudo_aliases is defined + - item.user_aliases is defined + become: True + become_user: root diff --git a/tasks/setup.yml b/tasks/setup.yml deleted file mode 100644 index b436460..0000000 --- a/tasks/setup.yml +++ /dev/null @@ -1,33 +0,0 @@ ---- -- block: - - name: Install requirements - package: - name: "{{ item }}" - state: present - loop: "{{ sudo_packages }}" - - - name: Add base sudo config - template: - src: etc/sudoers.j2 - dest: /etc/sudoers - owner: root - group: root - mode: 0440 - validate: "/usr/sbin/visudo -cf %s" - - - name: Add config files to sudoers.d - template: - src: etc/sudoers.d/sudo_ext.j2 - dest: "/etc/sudoers.d/{{ item.name }}" - owner: root - group: root - mode: 0440 - validate: "/usr/sbin/visudo -cf %s" - loop: "{{ sudo_aliases }}" - loop_control: - label: "{{ item.name }}" - when: - - sudo_aliases is defined - - item.user_aliases is defined - become: True - become_user: root diff --git a/templates/etc/sudoers.j2 b/templates/etc/sudoers.j2 index 7f02bed..f4fb85c 100644 --- a/templates/etc/sudoers.j2 +++ b/templates/etc/sudoers.j2 @@ -5,14 +5,13 @@ Defaults {{ item }} {% endfor %} {% endif %} - {% if sudo_env_keep -%} Defaults env_keep = "{{ sudo_env_keep|join(' ') }}" {% endif %} - {% if sudo_secure_path -%} Defaults secure_path = "{{ sudo_secure_path }}" {% endif %} +Defaults logfile = {{ sudo_logfile }} ## Allow root to run any commands anywhere root ALL=(ALL) ALL