No Description
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

google_auth.yml 1.5KB

12345678910111213141516171819202122232425262728293031323334353637383940
  1. ---
  2. # Defines tasks applicable for Google Authenticator.
  3. - name: Ensure required packages are installed
  4. apt: pkg={{ item }} state=present
  5. with_items:
  6. - libpam-google-authenticator
  7. - libpam0g-dev
  8. - libqrencode3
  9. tags:
  10. - dependencies
  11. - name: Update sshd config to enable challenge responses
  12. lineinfile: dest=/etc/ssh/sshd_config
  13. regexp=^ChallengeResponseAuthentication
  14. line="ChallengeResponseAuthentication yes"
  15. state=present
  16. notify: restart ssh
  17. - name: Add Google authenticator to PAM
  18. lineinfile: dest=/etc/pam.d/sshd
  19. line="auth required pam_google_authenticator.so"
  20. insertbefore=BOF
  21. state=present
  22. - name: Generate a timed-based, no reuse, rate-limited (3 logins per 30 seconds) with one concurrently valid code for default user
  23. command: /usr/bin/google-authenticator -t -f -d --label="{{ main_user_name }}@{{ domain }}" --qr-mode=ANSI -r 3 -R 30 -w 1 --secret=/home/{{ main_user_name }}/.google_authenticator
  24. creates=/home/{{ main_user_name }}/.google_authenticator
  25. sudo: yes
  26. sudo_user: "{{ main_user_name }}"
  27. when: ansible_ssh_user != "vagrant"
  28. - name: Retrieve generated keys from server
  29. fetch: src=/home/{{ main_user_name }}/.google_authenticator
  30. dest=/tmp/sovereign-google-auth-files
  31. when: ansible_ssh_user != "vagrant"
  32. - pause: seconds=5
  33. prompt="Your Google Authentication keys are in /tmp/sovereign-google-auth-files. Press any key to continue..."
  34. when: ansible_ssh_user != "vagrant"