Chapter 21. Managing sudo access using an Ansible playbook

Procedure

1. Add one or more sudo commands:

   1. Create an ensure-reboot-sudocmd-is-present.yml Ansible playbook that ensures the presence of the /usr/sbin/reboot command in the IdM database of sudo commands. To simplify this step, you can copy and modify the example in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudocmd/ensure-sudocmd-is-present.yml file:

      ---
      - name: Playbook to manage sudo command
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        # Ensure sudo command is present
        - freeipa.ansible_freeipa.ipasudocmd:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: /usr/sbin/reboot
            state: present

   2. Run the playbook:

      $ ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-reboot-sudocmd-is-present.yml

2. Create a sudo rule that references the commands:

   1. Create an ensure-sudorule-for-idmuser-on-idmclient-is-present.yml Ansible playbook that uses the sudo command entry to ensure the presence of a sudo rule. The sudo rule allows idm_user to reboot the idmclient machine. To simplify this step, you can copy and modify the example in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudorule/ensure-sudorule-is-present.yml file:

      ---
      - name: Tests
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        # Ensure a sudorule is present granting idm_user the permission to run /usr/sbin/reboot on idmclient
        - freeipa.ansible_freeipa.ipasudorule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: idm_user_reboot
            description: A test sudo rule.
            allow_sudocmd: /usr/sbin/reboot
            host: idmclient.idm.example.com
            user: idm_user
            state: present

   2. Run the playbook:

      $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-sudorule-for-idmuser-on-idmclient-is-present.yml

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-sudocmd.md file on the control node.

1. Log in to idmclient as idm_user.

2. Reboot the machine using sudo. Enter the password for idm_user when prompted:

   $ sudo /usr/sbin/reboot
   [sudo] password for idm_user:

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Create an ensure-presence-of-multiple-sudorules-in-a-task.yml file with the following content:

   ---
   - name: Playbook to handle sudorules
     hosts: ipaserver
     become: true
   
     tasks:
     # Ensure sudo command name: /usr/sbin/dmidecode is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/sbin/dmidecode
   
     # Ensure sudo command /usr/sbin/reboot is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/sbin/reboot
   
     # Ensure sudo command /usr/bin/yum is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/bin/yum
   
     # Ensure a sudo command group is present
     - freeipa.ansible_freeipa.ipasudocmdgroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: sudogroup01
         sudocmd:
         - /usr/sbin/dmidecode
         - /usr/sbin/reboot
   
     - name: Ensure multiple sudo rules are present using batch mode
       freeipa.ansible_freeipa.ipasudorule:
         ipaadmin_password: "{{ ipaadmin_password }}"
         sudorules:
           - name: testrule01
             user:
               - user01
               - user02
             group:
               - usergroup01
             allow_sudocmd:
               - /usr/bin/yum
             allow_sudocmdgroup:
               - sudogroup01
           - name: testrule02
             hostgroup:
               - hostgroup01
               - hostgroup02

   NOTE

   Using the sudorules option, you can specify multiple sudo rule variables that only apply to a particular sudo rule. This sudo rule is defined by the name variable, which is the only mandatory variable for the sudorules option. In the example, the user, group, allow_sudocmd, and allow_sudocmdgroup variables are applied to the testrule01 sudo rule.

3. Save the file.

4. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-presence-of-multiple-sudorules-in-a-task.yml