--- # --- # Install nis # --- - name: (nis-install-server.yml) Install nis common packages ansible.builtin.package: name: "{{ item }}" state: present with_items: "{{ nis_common_packages }}" register: common_nis_installed tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Set (nis) default domain (/etc/defaultdomain) ansible.builtin.template: dest: /etc/defaultdomain src: etc/defaultdomain.j2 owner: root group: root mode: "0644" tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Create preconfigured /etc/yp.conf on nis clients ansible.builtin.template: dest: /etc/yp.conf src: etc/yp.conf.j2 owner: root group: root mode: "0644" tags: - nis-install - nis-install-client - name: (nis-install-server.yml) Set local host's domain name ansible.builtin.command: domainname "{{ nis_domain }}" changed_when: false tags: - nis-install - nis-install-server # --- # Since Debian 11 (bullseye) password hashing uses 'yescrypt' by default. # # Note: # 'yescrypt' is not supported by Debian 10 (buster) nor by Ubuntu 18.04 and smaller # # --- - name: (nis-install-server.yml) Check if file '/etc/pam.d/common-password' exists ansible.builtin.stat: path: /etc/pam.d/common-password register: common_file_etc_pam_d_common_password tags: - nis-install - nis-install-server when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version']|int >= 11 - name: (nis-install-server.yml) Check if default hash for password is 'yescrypt' ansible.builtin.command: grep -i -q -E '^password.+yescrypt' /etc/pam.d/common-password register: common_presence_of_passwprd_hashing_yescrypt changed_when: false failed_when: - common_presence_of_passwprd_hashing_yescrypt.rc >= 2 when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version']|int >= 11 - common_file_etc_pam_d_common_password.stat.exists # - ansible_distribution_major_version|int <= 12 - name: (nis-install-server.yml) Change default password hash for local system accounts from yescrypt to SHA-512 ansible.builtin.replace: path: /etc/pam.d/common-password regexp: '^(password.+)yescrypt' replace: '\1sha512' when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version']|int >= 11 - common_file_etc_pam_d_common_password.stat.exists - common_presence_of_passwprd_hashing_yescrypt.rc == 0 # - ansible_facts['distribution_major_version']|int <= 12 # --- # /etc/default/nis # --- - name: (nis-install-server.yml) Check if file '/etc/default/nis.ORIG' exists ansible.builtin.stat: path: /etc/default/nis.ORIG register: common_default_nis_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/default/nis ansible.builtin.copy: src: /etc/default/nis dest: /etc/default/nis.ORIG remote_src: true force: false owner: root group: root mode: "0644" when: - not common_default_nis_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISSERVER' (server) ansible.builtin.replace: path: /etc/default/nis regexp: "^NISSERVER=.*" replace: "NISSERVER=master" tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Adjust file /etc/default/nis - set 'NISCLIENT' (server) ansible.builtin.replace: path: /etc/default/nis regexp: "^NISCLIENT=.*" replace: "NISCLIENT=false" tags: - nis-install - nis-install-server # --- # /etc/ypserv.securenets # --- - name: (nis-install-server.yml) Check if file '/etc/ypserv.securenets.ORIG' exists ansible.builtin.stat: path: /etc/ypserv.securenets.ORIG register: common_ypserv_securenets_orig_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/ypserv.securenets ansible.builtin.copy: src: /etc/ypserv.securenets dest: /etc/ypserv.securenets.ORIG remote_src: true force: false owner: root group: root mode: "0644" when: - not common_ypserv_securenets_orig_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Comment line like '0.0.0.0 ..' to file /etc/ypserv.securenets ansible.builtin.replace: path: /etc/ypserv.securenets regexp: "^(0.0.0.0\\s+.*)" replace: "#\\1" tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Add '255.255.0.0 192.168.0.0' to file /etc/ypserv.securenets ansible.builtin.lineinfile: path: /etc/ypserv.securenets line: "255.255.0.0 192.168.0.0" insertafter: EOF state: present owner: root group: root mode: "0644" tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Add '255.0.0.0 10.0.0.0' to file /etc/ypserv.securenets ansible.builtin.lineinfile: path: /etc/ypserv.securenets line: "255.0.0.0 10.0.0.0" insertafter: EOF state: present owner: root group: root mode: "0644" tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Trigger '/usr/lib/yp/ypinit -m' ansible.builtin.command: /usr/lib/yp/ypinit -m args: stdin: "\n" changed_when: false when: - ansible_facts['distribution'] == "Debian" - ansible_facts['distribution_major_version'] | int >= 11 tags: - nis-install - nis-install-server # --- # Base directory containing users' home directory # --- - name: (nis-install-server.yml) Ensure directoriy 'nis_base_home' (usually /data/home) exists ansible.builtin.file: path: "{{ nis_base_home }}" owner: root group: root mode: "0755" state: directory when: - "groups['nis_server']|string is search(inventory_hostname)" tags: - nis-install - nis-install-server # --- # /etc/default/useradd # --- - name: (nis-install-server.yml) HOME in /etc/default/useradd setzen oder hinter Kommentar einfügen ansible.builtin.lineinfile: path: /etc/default/useradd regexp: "^HOME=" insertafter: "^#\\s*HOME=" line: "HOME={{ nis_base_home }}" backup: true when: - nis_base_home is defined - nis_base_home != '/home' # --- # /etc/adduser.conf # --- - name: (nis-install-server.yml) Check if file '/etc/adduser.conf.ORIG exists' ansible.builtin.stat: path: /etc/adduser.conf.ORIG register: common_adduser_conf_exists when: - nis_base_home is defined - nis_base_home != '/home' tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /etc/adduser.conf ansible.builtin.copy: src: /etc/adduser.conf dest: /etc/adduser.conf.ORIG remote_src: true force: false owner: root group: root mode: "0644" when: - nis_base_home is defined - nis_base_home != '/home' - not common_adduser_conf_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) DHOME in /etc/adduser.conf setzen oder hinter Kommentar einfügen ansible.builtin.lineinfile: path: /etc/adduser.conf regexp: "^DHOME=" insertafter: "^#\\s*DHOME=" line: "DHOME={{ nis_base_home }}" backup: true when: - nis_base_home is defined - nis_base_home != '/home' # --- # /var/yp/Makefile # --- - name: (nis-install-server.yml) Check if file '/var/yp/Makefile.ORIG exists' ansible.builtin.stat: path: /var/yp/Makefile.ORIG register: common_yp_makefile_orig_exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Backup existing file /var/yp/Makefile ansible.builtin.copy: src: /var/yp/Makefile dest: /var/yp/Makefile.ORIG remote_src: true force: false owner: root group: root mode: "0644" when: - not common_yp_makefile_orig_exists.stat.exists tags: - nis-install - nis-install-server - name: (nis-install-server.yml) Adjust file '/var/yp/Makefile' ansible.builtin.replace: path: /var/yp/Makefile regexp: "^#?{{ item }}=.*" replace: "{{ item }}=true" with_items: - MERGE_PASSWD - MERGE_GROUP notify: - Renew nis databases tags: - nis-install - nis-install-server # TODO: # /var/yp/Makefile