diff --git a/molecule/default/group_vars/all.yml b/molecule/default/group_vars/all.yml deleted file mode 100644 index 4f82a3e..0000000 --- a/molecule/default/group_vars/all.yml +++ /dev/null @@ -1,3 +0,0 @@ ---- -provision_ansible_user_name: deploy -provision_ansible_user_group: deploy diff --git a/molecule/default/verify.yml b/molecule/default/verify.yml index cd47d7d..0b1377a 100644 --- a/molecule/default/verify.yml +++ b/molecule/default/verify.yml @@ -23,45 +23,45 @@ - name: "Getent user ansible" ansible.builtin.getent: database: passwd - key: deploy - register: ansible_user + key: ansible + register: ednxzu_ansible_user - name: "Getent group ansible" ansible.builtin.getent: database: group - key: deploy - register: ansible_group + key: ansible + register: ednxzu_ansible_group - name: "Verify ansible user and group" ansible.builtin.assert: that: - - not ansible_user.failed - - not ansible_group.failed - - "'deploy' in ansible_user.ansible_facts.getent_passwd.keys()" - - "'/opt/deploy' in ansible_user.ansible_facts.getent_passwd['deploy']" - - "'/bin/bash' in ansible_user.ansible_facts.getent_passwd['deploy']" - - "'deploy' in ansible_group.ansible_facts.getent_group.keys()" + - not ednxzu_ansible_user.failed + - not ednxzu_ansible_group.failed + - "'ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd.keys()" + - "'/opt/ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" + - "'/bin/bash' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" + - "'ansible' in ednxzu_ansible_group.ansible_facts.getent_group.keys()" - name: "Test: ansible sudo permissions" block: - - name: "Stat file /etc/sudoers.d/deploy" + - name: "Stat file /etc/sudoers.d/ansible" ansible.builtin.stat: - path: "/etc/sudoers.d" + path: "/etc/sudoers.d/ansible" register: stat_etc_sudoers_d_ansible - - name: "Verify file /etc/sudoers.d/deploy" + - name: "Verify file /etc/sudoers.d/ansible" ansible.builtin.assert: that: - not stat_etc_sudoers_d_ansible.stat.exists - name: "Test: ansible authorized_keys" block: - - name: "Stat file /opt/deploy/.ssh/authorized_keys" + - name: "Stat file /opt/ansible/.ssh/authorized_keys" ansible.builtin.stat: - path: "/opt/deploy/.ssh/authorized_keys" + path: "/opt/ansible/.ssh/authorized_keys" register: stat_opt_ansible_ssh_authorized_keys - - name: "Verify file /opt/deploy/.ssh/authorized_keys" + - name: "Verify file /opt/ansible/.ssh/authorized_keys" ansible.builtin.assert: that: - not stat_opt_ansible_ssh_authorized_keys.stat.exists diff --git a/molecule/with_ssh_keys/group_vars/all.yml b/molecule/with_ssh_keys/group_vars/all.yml index de080fe..0cd9858 100644 --- a/molecule/with_ssh_keys/group_vars/all.yml +++ b/molecule/with_ssh_keys/group_vars/all.yml @@ -1,6 +1,6 @@ --- -provision_ansible_user_name: deploy -provision_ansible_user_group: deploy +provision_ansible_user_name: ansible +provision_ansible_user_group: ansible provision_ansible_user_password: "*" provision_ansible_user_is_system: true provision_ansible_user_home: /opt/{{ provision_ansible_user_name }} diff --git a/molecule/with_ssh_keys/molecule.yml b/molecule/with_ssh_keys/molecule.yml index 758cfbb..817ac08 100644 --- a/molecule/with_ssh_keys/molecule.yml +++ b/molecule/with_ssh_keys/molecule.yml @@ -20,7 +20,7 @@ provisioner: defaults: remote_tmp: /tmp/.ansible verifier: - name: testinfra + name: ansible scenario: name: with_ssh_keys test_sequence: diff --git a/molecule/with_ssh_keys/verify.yml b/molecule/with_ssh_keys/verify.yml index bf52da2..2d1398f 100644 --- a/molecule/with_ssh_keys/verify.yml +++ b/molecule/with_ssh_keys/verify.yml @@ -17,3 +17,71 @@ - stat_etc_hosts.stat.isreg - stat_etc_hosts.stat.pw_name == 'root' - stat_etc_hosts.stat.gr_name == 'root' + + - name: "Test: ansible user and group" + block: + - name: "Getent user ansible" + ansible.builtin.getent: + database: passwd + key: ansible + register: ednxzu_ansible_user + + - name: "Getent group ansible" + ansible.builtin.getent: + database: group + key: ansible + register: ednxzu_ansible_group + + - name: "Verify ansible user and group" + ansible.builtin.assert: + that: + - not ednxzu_ansible_user.failed + - not ednxzu_ansible_group.failed + - "'ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd.keys()" + - "'/opt/ansible' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" + - "'/bin/bash' in ednxzu_ansible_user.ansible_facts.getent_passwd['ansible']" + - "'ansible' in ednxzu_ansible_group.ansible_facts.getent_group.keys()" + + - name: "Test: ansible sudo permissions" + block: + - name: "Stat file /etc/sudoers.d/ansible" + ansible.builtin.stat: + path: "/etc/sudoers.d/ansible" + register: stat_etc_sudoers_d_ansible + + - name: "Slurp file /etc/sudoers.d/ansible" + ansible.builtin.slurp: + src: "/etc/sudoers.d/ansible" + register: slurp_etc_sudoers_d_ansible + + - name: "Verify file /etc/sudoers.d/ansible" + ansible.builtin.assert: + that: + - stat_etc_sudoers_d_ansible.stat.exists + - stat_etc_sudoers_d_ansible.stat.isreg + - stat_etc_sudoers_d_ansible.stat.pw_name == 'root' + - stat_etc_sudoers_d_ansible.stat.gr_name == 'root' + - stat_etc_sudoers_d_ansible.stat.mode == '0440' + - "'ansible ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ansible.content|b64decode)" + + - name: "Test: ansible authorized_keys" + block: + - name: "Stat file /opt/ansible/.ssh/authorized_keys" + ansible.builtin.stat: + path: "/opt/ansible/.ssh/authorized_keys" + register: stat_opt_ansible_ssh_authorized_keys + + - name: "Slurp file /opt/ansible/.ssh/authorized_keys" + ansible.builtin.slurp: + src: "/opt/ansible/.ssh/authorized_keys" + register: slurp_opt_ansible_ssh_authorized_keys + + - name: "Verify file /opt/ansible/.ssh/authorized_keys" + ansible.builtin.assert: + that: + - stat_opt_ansible_ssh_authorized_keys.stat.exists + - stat_opt_ansible_ssh_authorized_keys.stat.isreg + - stat_opt_ansible_ssh_authorized_keys.stat.pw_name == 'ansible' + - stat_opt_ansible_ssh_authorized_keys.stat.gr_name == 'ansible' + - stat_opt_ansible_ssh_authorized_keys.stat.mode == '0600' + - "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ansible@instance' in (slurp_opt_ansible_ssh_authorized_keys.content|b64decode)" \ No newline at end of file