第 21 章 使用 Ansible playbook 管理 sudo 访问权限

步骤

1. 添加一个或多个 sudo 命令：

   1. 创建一个 ensure-reboot-sudocmd-is-present.yml Ansible playbook，来确保 sudo 命令的 IdM 数据库中存在 /usr/sbin/reboot 命令。要简化此步骤，您可以复制并修改 /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudocmd/ensure-sudocmd-is-present.yml 文件中的示例：

      ---
      - name: Playbook to manage sudo command
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        # Ensure sudo command is present
        - freeipa.ansible_freeipa.ipasudocmd:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: /usr/sbin/reboot
            state: present

      Copy to Clipboard Toggle word wrap

   2. 运行 playbook：

      $ ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-reboot-sudocmd-is-present.yml

      Copy to Clipboard Toggle word wrap

2. 创建一个引用命令的 sudo 规则：

   1. 创建一个 ensure-sudorule-for-idmuser-on-idmclient-is-present.yml Ansible playbook，来使用 sudo 命令条目确保存在 sudo 规则。sudo 规则允许 idm_user 重新启动 idmclient 机器。要简化此步骤，您可以复制并修改 /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/sudorule/ensure-sudorule-is-present.yml 文件中的示例：

      ---
      - name: Tests
        hosts: ipaserver
      
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
        # Ensure a sudorule is present granting idm_user the permission to run /usr/sbin/reboot on idmclient
        - freeipa.ansible_freeipa.ipasudorule:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: idm_user_reboot
            description: A test sudo rule.
            allow_sudocmd: /usr/sbin/reboot
            host: idmclient.idm.example.com
            user: idm_user
            state: present

      Copy to Clipboard Toggle word wrap

   2. 运行 playbook：

      $ ansible-playbook -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-sudorule-for-idmuser-on-idmclient-is-present.yml

      Copy to Clipboard Toggle word wrap

1. 以 idm_user 用户身份登录到 idmclient。

2. 使用 sudo 重新启动计算机。在提示时输入 idm_user 的密码：

   $ sudo /usr/sbin/reboot
   [sudo] password for idm_user:

   Copy to Clipboard Toggle word wrap