60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
---
|
||
# Вывод участников привилегированных групп (root, wheel, sudo) на всех управляемых хостах.
|
||
# Отмечает пользователей, которые НЕ определены в group_vars/all/users.yml.
|
||
# Запуск: ansible-playbook -i inventory/prod playbooks/audit_root_group.yml
|
||
- name: Audit privileged group members
|
||
hosts: all
|
||
gather_facts: false
|
||
become: true
|
||
|
||
vars:
|
||
known_usernames: >-
|
||
{{
|
||
users_admin_groups.values()
|
||
| sum(start=[])
|
||
| map(attribute='username')
|
||
| list
|
||
}}
|
||
|
||
tasks:
|
||
- name: Get members of privileged groups
|
||
ansible.builtin.command: getent group {{ item }}
|
||
register: group_entries
|
||
changed_when: false
|
||
failed_when: group_entries.rc not in [0, 2]
|
||
loop:
|
||
- root
|
||
- wheel
|
||
- sudo
|
||
|
||
- name: Parse group members
|
||
ansible.builtin.set_fact:
|
||
privileged_groups: >-
|
||
{{
|
||
privileged_groups | default([]) + [{
|
||
'group': item.item,
|
||
'members': (item.stdout.split(':')[3].split(',') | select) | list
|
||
if item.rc == 0 and item.stdout != '' else []
|
||
}]
|
||
}}
|
||
loop: "{{ group_entries.results }}"
|
||
loop_control:
|
||
label: "{{ item.item }}"
|
||
|
||
- name: Show privileged group members
|
||
ansible.builtin.debug:
|
||
msg: >-
|
||
{{ inventory_hostname }} — {{ item.group }}:
|
||
{% if item.members | length == 0 %}(none)
|
||
{% else %}
|
||
{{ item.members | join(', ') }}
|
||
{% set unknown = item.members | difference(known_usernames) %}
|
||
{% if unknown | length > 0 %}
|
||
| UNKNOWN (not in users.yml): {{ unknown | join(', ') }}
|
||
{% endif %}
|
||
{% endif %}
|
||
loop: "{{ privileged_groups }}"
|
||
loop_control:
|
||
label: "{{ item.group }}"
|
||
when: item.members | length > 0 or item.group == 'root'
|