The sudocmdgroup module allows to ensure presence and absence of sudocmdgroups and members of sudocmdgroups.
The sudocmdgroup module is as compatible as possible to the Ansible upstream ipa_sudocmdgroup
module, but additionally offers to make sure that sudocmds are present or absent in a sudocmdgroup.
FreeIPA versions 4.4.0 and up are supported by the ipasudocmdgroup module.
Controller * Ansible version: 2.8+
Node * Supported FreeIPA version (see above)
Example inventory file
[ipaserver] ipaserver.test.local
Example playbook to make sure sudocmdgroup is present:
--- - name: Playbook to handle sudocmdgroups hosts: ipaserver become: true tasks: # Ensure sudocmdgroup is present - ipasudocmdgroup: ipaadmin_password: SomeADMINpassword name: group01 description: Group of important commands
Example playbook to make sure that a sudo command and sudocmdgroups are present in existing sudocmdgroup:
--- - name: Playbook to handle sudocmdgroups hosts: ipaserver become: true tasks: # Ensure sudo commands are present in existing sudocmdgroup - ipasudocmdgroup: ipaadmin_password: SomeADMINpassword name: group01 sudocmd: - /usr/bin/su - /usr/bin/less action: member
action
controls if the sudocmdgroup or member will be handled. To add or remove members, set action
to member
.
Example playbook to make sure that a sudo command and sudocmdgroups are absent in sudocmdgroup:
--- - name: Playbook to handle sudocmdgroups hosts: ipaserver become: true tasks: # Ensure sudocmds are absent in existing sudocmdgroup - ipasudocmdgroup: ipaadmin_password: SomeADMINpassword name: group01 sudocmd: - /usr/bin/su - /usr/bin/less action: member state: absent
Example playbook to make sure sudocmdgroup is absent:
--- - name: Playbook to handle sudocmdgroups hosts: ipaserver become: true tasks: # Ensure sudocmdgroup is absent - ipasudocmdgroup: ipaadmin_password: SomeADMINpassword name: group01 state: absent
Variable | Description | Required |
---|---|---|
ipaadmin_principal |
The admin principal is a string and defaults to admin |
no |
ipaadmin_password |
The admin password is a string and is required if there is no admin ticket available on the node | no |
name | cn |
The list of sudocmdgroup name strings. | no |
description |
The sudocmdgroup description string. | no |
nomembers |
Suppress processing of membership attributes. (bool) | no |
sudocmd |
List of sudocmdgroup name strings assigned to this sudocmdgroup. | no |
action |
Work on sudocmdgroup or member level. It can be on of member or sudocmdgroup and defaults to sudocmdgroup . |
no |
state |
The state to ensure. It can be one of present or absent , default: present . |
no |
Rafael Guterres Jeffman