diff --git a/files/etc_ansible_facts_d_users_sh b/files/etc_ansible_facts_d_users_sh deleted file mode 100644 index 4b4c4433c0e715d78bc0996583386f6d3b730579..0000000000000000000000000000000000000000 --- a/files/etc_ansible_facts_d_users_sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -echo "[" >/etc/ansible/facts.d/users.fact -cat /etc/passwd | perl -aF: -ne 'print "{\"name\": \"",$F[0],"\",\"home\": \"",$F[5],"\"},\n" if $F[2] > 499' >>/etc/ansible/facts.d/users.fact -echo "0]" >>/etc/ansible/facts.d/users.fact diff --git a/tasks/cleanup.yml b/tasks/cleanup.yml index cf849132ff0d97e5e276ca8a654772b23abf8aeb..058b62064a0075df00a6ae695594a1da9c0ba80d 100644 --- a/tasks/cleanup.yml +++ b/tasks/cleanup.yml @@ -5,31 +5,24 @@ --- # file: cleanup.yml -- name: "Make sure, the directory exists" - file: dest='/etc/ansible/facts.d' - state=directory - owner=root - group=root - mode=775 -- name: "Copy the extract script" - copy: src='etc_ansible_facts_d_users_sh' - dest='/etc/ansible/facts.d/users.sh' - owner=root - group=root - mode=755 -- name: "Extract user list" - shell: /etc/ansible/facts.d/users.sh -- name: "Gather facts" - setup: +- name: "Grab the user list" + shell: cat /etc/passwd + register: passwd + - name: "Unlock legitimate user accounts" - command: usermod --unlock {{item.name}} - with_items: ansible_local.users - when: item.name is defined and item.name in users + command: usermod --unlock {{item.split(':').0}} + when: item.split(':').0 in users + and item.split(':').2|int > 499 + with_items: passwd.stdout_lines + - name: "Lock deprecated user accounts" - command: usermod --lock {{item.name}} - with_items: ansible_local.users - when: item.name is defined and item.name not in users + command: usermod --lock {{item.split(':').0}} + when: item.split(':').0 not in users + and item.split(':').2|int > 499 + with_items: passwd.stdout_lines + - name: "Disable ssh keys for deprecated user accounts" - command: rm {{item.home}}/.ssh/authorized_keys - with_items: ansible_local.users - when: item.name is defined and item.name not in users + command: rm {{item.split(':').5}}/.ssh/authorized_keys + when: item.split(':').0 not in users + and item.split(':').2|int > 499 + with_items: passwd.stdout_lines