diff --git a/.ansible-lint b/.ansible-lint new file mode 100644 index 0000000..608474c --- /dev/null +++ b/.ansible-lint @@ -0,0 +1,11 @@ +profile: basic + +skip_list: # or 'skip_list' to silence them completely + - experimental # all rules tagged as experimental + - unnamed-task # All tasks should be named + - fqcn-builtins + +warn_list: + - name[casing] + - var-naming[pattern] + - no-free-form \ No newline at end of file diff --git a/.yamllint b/.yamllint index 8827676..8956e9b 100644 --- a/.yamllint +++ b/.yamllint @@ -2,6 +2,8 @@ # Based on ansible-lint config extends: default +ignore: + - .venv/ rules: braces: max-spaces-inside: 1 diff --git a/handlers/main.yml b/handlers/main.yml index b7387ea..401fd21 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -1,6 +1,6 @@ --- # handlers file for auth_duo -- name: restart sshd +- name: Restart sshd service: name: sshd state: restarted \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml index 86c6925..dcac050 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -2,7 +2,8 @@ galaxy_info: author: Aaron Guise description: Enable duo_unix - Multifactor Authentication for Linux company: Ultrafast Fibre - + namespace: cybercinch + role_name: auth_duo # If the issue tracker for your role is not on github, uncomment the # next line and provide a value # issue_tracker_url: http://example.com/issue/tracker @@ -16,7 +17,7 @@ galaxy_info: # - CC-BY-4.0 license: MIT - min_ansible_version: 2.9 + min_ansible_version: "2.9" # If this a Container Enabled role, provide the minimum Ansible Container version. # min_ansible_container_version: @@ -30,7 +31,8 @@ galaxy_info: platforms: - name: EL versions: - - 7 + - "7" + - "8" # galaxy_tags: [] # # List tags for your role here, one per line. A tag is a keyword that describes diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index cf724bd..226ae58 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -2,14 +2,14 @@ - name: Converge hosts: all tasks: - - name: "Include auth_duo" + - name: "Include role under test" include_role: - name: "auth_duo" + name: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') | basename }}" vars: auth_duo_settings: - key: ikey - value: "{{ lookup('env','AUTH_DUO_IKEY') }}" + value: "{{ lookup('env', 'AUTH_DUO_IKEY') }}" - key: skey - value: "{{ lookup('env','AUTH_DUO_SKEY') }}" + value: "{{ lookup('env', 'AUTH_DUO_SKEY') }}" - key: host - value: "{{ lookup('env','AUTH_DUO_HOST') }}" + value: "{{ lookup('env', 'AUTH_DUO_HOST') }}" diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index 2a916f6..5451039 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -6,7 +6,7 @@ driver: platforms: - name: instance command: ${MOLECULE_DOCKER_COMMAND:-""} - image: "geerlingguy/docker-${MOLECULE_DISTRO:-centos7}-ansible:latest" + image: "cybercinch/docker-${MOLECULE_DISTRO:-almalinux8}-ansible:latest" volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro privileged: true diff --git a/molecule/default/prepare.yml b/molecule/default/prepare.yml index 8f8861b..56e8d22 100644 --- a/molecule/default/prepare.yml +++ b/molecule/default/prepare.yml @@ -2,21 +2,21 @@ - name: Prepare hosts: all tasks: - - name: ensure openssh installed + - name: Ensure openssh installed yum: name: openssh-server, openssh-clients, sshpass state: installed - - name: ensure sshd is running + - name: Ensure sshd is running service: name: sshd state: started enabled: true - - name: ensure nologin files are absent + - name: Ensure nologin files are absent file: path: "{{ item }}" state: absent with_items: - /etc/nologin - - /var/run/nologin \ No newline at end of file + - /var/run/nologin diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml index 9ef6350..17d3baf 100644 --- a/molecule/default/verify.yml +++ b/molecule/default/verify.yml @@ -25,4 +25,4 @@ - name: Did duo prompt show? assert: - that: "'Duo two-factor login for auth_duo_test' in slurpfile['content'] | b64decode" + that: "'Duo two-factor login for' in slurpfile['content'] | b64decode" diff --git a/tasks/main.yml b/tasks/main.yml index 12b649c..0ec96d3 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -28,7 +28,7 @@ copy: src: etc.pam.d.sshd dest: /etc/pam.d/sshd - notify: restart sshd + notify: Restart sshd - name: Ensure PAM is enabled for SSH lineinfile: @@ -40,12 +40,15 @@ line: 'UsePAM yes' - regex: '^ChallengeResponseAuthentication ' line: 'ChallengeResponseAuthentication yes' - notify: restart sshd + notify: Restart sshd - name: Flush Handlers meta: flush_handlers - name: Duo SELinux Enablement + when: > + ansible_virtualization_type != 'docker' and + ansible_virtualization_type != 'container' block: - name: Copy SELinux Module copy: