DEBOPS.SUDO(5)

NAME
debops.sudo - Configure 'sudo' support using Ansible

SYNOPSIS

debops service/sudo [--limit group,host,...] [--diff] [--check] [--tags tag1,tag2,...] [--skip-tags tag1,tag2,...] [<ansible-playbook options>] ...

DESCRIPTION

The debops.sudo role can be used to ensure that sudo is supported on a host. The role will automatically install sudo-ldap APT package if LDAP support is detected on a host, otherwise a normal sudo APT package will be installed.

GETTING STARTED

  Support for sudoers in LDAP

The debops.sudo role will automatically enable integration with the debops.ldap Ansible role to configure support for sudoers rules defined in the LDAP directory. When the LDAP support and LDAP-POSIX integration is enabled on a host, the role will register its own LDAP account object (using debops.ldap as a dependency) and configure access to the LDAP directory using simple bind. The debops.slapd role will create the needed LDAP directory structures required for sudoers rules.

See the sudoers.ldap(5) <https://manpages.debian.org/sudoers.ldap(5)> manual page for more details about the LDAP support in sudo.

  Example inventory

The debops.sudo role is included by default in the common.yml DebOps playbook; you don't need to add hosts to any Ansible groups to enable it.

  Example playbook

If you are using this role without DebOps, here's an example Ansible playbook that uses the debops.sudo role:

---
- name: Configure sudo service
  collections: [ 'debops.debops', 'debops.roles01',
                 'debops.roles02', 'debops.roles03' ]
  hosts: [ 'debops_all_hosts', 'debops_service_sudo' ]
  become: True
  environment: '{{ inventory__environment | d({})
                   | combine(inventory__group_environment | d({}))
                   | combine(inventory__host_environment  | d({})) }}'
  roles:
    - role: python
      tags: [ 'role::python', 'skip::python', 'role::ldap' ]
      python__dependent_packages3:
        - '{{ ldap__python__dependent_packages3 }}'
      python__dependent_packages2:
        - '{{ ldap__python__dependent_packages2 }}'
    - role: ldap
      tags: [ 'role::ldap', 'skip::ldap' ]
      ldap__dependent_tasks:
        - '{{ sudo__ldap__dependent_tasks }}'
    - role: sudo
      tags: [ 'role::sudo', 'skip::sudo' ]

  Ansible tags

You can use Ansible --tags or --skip-tags parameters to limit what tasks are performed during Ansible run. This can be used after a host was first configured to speed up playbook execution, when you are sure that most of the configuration is already in the desired state.

Available role tags:

role::sudo
    Main role tag, should be used in the playbook to execute all of the role tasks as well as role dependencies.

  Other resources

List of other useful resources related to the debops.sudo Ansible role:

•   Manual pages: sudo(8) <https://manpages.debian.org/sudo(8)>, sudoers(5) <https://manpages.debian.org/sudoers(5)>, sudoers.ldap(5) <https://manpages.debian.org/sudoers.ldap(5)>

DEFAULT VARIABLE DETAILS

Some of debops.sudo default variables have more extensive configuration than simple strings or lists, here you can find documentation and examples for them.

  sudo__sudoers

The sudo__*_sudoers variables define sudo configuration located in /etc/sudoers.d/ directory. Each variable is a list of YAML dictionaries, with specific parameters:

name
    Required. Name of the configuration section, used as a filename, and as a marker which merges multiple configuration entries together.

filename
    Optional. Set custom filename for a given configuration file, located in /etc/sudoers.d/ directory.

comment
    Optional. A string or YAML text block with comments added at the beginning of the configuration file.

state
    Optional. If not defined or present (default), the configuration file will be generated. If absent, the configuration file will be removed.

    If init, the configuration for a given entry will be prepared but not actually present on the host. It can be activated conditionally in a later entry.

    If ignore, a given configuration entry will not be evaluated by the role.

raw Optional. A string or YAML text block with sudoers(5) <https://manpages.debian.org/sudoers(5)> configuration added at the end of the configuration file as-is.

options
    Optional. A list of sudoers(5) <https://manpages.debian.org/sudoers(5)> configuration snippets specified as YAML dictionaries. Each dictionary can have specific parameters:

name
    Required. Name of a configuration section, only used as a handle for merging options from multiple configuration entries.

value
    Required. A string or YAML text block that contains the sudoers(5) <https://manpages.debian.org/sudoers(5)> configuration snippet. Values from different configuration entries will be merged into one list and present in the configuration file.

comment
    Optional. A string or YAML text block with a comment about a given option.

weight
    Optional. A positive or negative number which influences the order in which the entries will be present in the configuration file. The lower the number, the higher in the file a given option will be present.

state
    Optional. If not defined or present, a given configuration option will be added in the configuration file. If absent, a given option will be removed from the configuration file.

  Examples

Allow user ray on host rushmore to run specific commands with elevated privileges without password confirmation:

sudo__sudoers:
  - name: 'ray-nopasswd-commands'
    raw: |
      ray   rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm

Override some of the built-in defaults conditionally:

sudo__sudoers:
  - name: '00-defaults-override'
    options:
      - name: 'syslog-auth'
        comment: 'Log events to syslog via "auth" facility'
        value: 'Defaults    syslog=auth'
      - name: 'disable-lecture'
        comment: "Don't show the default lecture on specific hosts"
        value: |
          Defaults    !lecture
        state: '{{ "present"
                   if (ansible_hostname == 'bastion')
                   else "absent" }}'

On the contrary, don't create the above defaults file when a host is in a specific Ansible inventory group:

sudo__group_sudoers:
  - name: '00-defaults-override'
    state: 'absent'

AUTHOR
Maciej Delmanowski

COPYRIGHT
2014-2022, Maciej Delmanowski, Nick Janetakis, Robin Schneider and others