add user for backup

allow user cert for backup user
This commit is contained in:
Pim Kunis 2023-04-11 08:54:34 +02:00
parent d570b1eb4f
commit 4ab792c254
3 changed files with 31 additions and 0 deletions

View file

@ -10,6 +10,10 @@
- name: enable interfaces
command:
cmd: ifup -a
- name: restart sshd
systemd:
name: sshd
state: restarted
tasks:
- name: Update
@ -88,5 +92,25 @@
src: dmz.conf
dest: /etc/network/interfaces.d/dmz.conf
notify: enable interfaces
- name: Add backup user
user:
name: lewis
create_home: false
password: '!'
shell: /sbin/nologin
system: true
- name: Add backup user principals file
copy:
dest: "/etc/ssh/lewis_principals"
content: "backup"
- name: Install user CA
copy:
dest: "/etc/ssh/user_ca_key.pub"
content: "{{ user_ca }}"
- name: Copy ssh config for backup user
copy:
src: "sshd.conf"
dest: "/etc/ssh/sshd_config.d/custom.conf"
notify: restart sshd
roles:
- githubixx.ansible_role_wireguard

View file

@ -1,3 +1,4 @@
user_ca: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKOClnK6/Hj8INjEgULY/lD2FM/nbiJHqaSXtEw4+Fj User Certificate Authority for DMZ"
storage_pools: [iso, disk, init]
wireguard_addresses:
- "10.42.0.1/32"

6
configure/sshd.conf Normal file
View file

@ -0,0 +1,6 @@
TrustedUserCAKeys /etc/ssh/user_ca_key.pub
Match User lewis
AuthorizedPrincipalsFile /etc/ssh/lewis_principals
ChrootDirectory /kvm/data
ForceCommand internal-sftp