User Management and Security Automation

# CHAPTER 10

User Management and Security Automation #

1. Introduction #

2. Learning Objectives #

• Automate the creation and deletion of Linux user accounts (user module).

• Securely distribute and revoke SSH public keys (authorizedkey module).

• AuthorizedKey Module (The Security Desk): Security programs the electronic door locks to only accept specific ID badges.

• Firewall Module (The Perimeter Fence): The physical fence outside the building that ensures people can only enter through the front door (Port 80/443), and permanently blocks the back alley entrance (Port 22 from the public internet).

Ansible allows the "CEO" to update the security protocols for all 500 offices worldwide with a single keystroke.

4. Managing Users and SSH Keys #

- name: Security Baseline - User Management
  hosts: all
  become: yes

  tasks:
    # 1. Create a new developer account
    - name: Ensure developer user exists
      user:
        name: jdoe
        state: present
        shell: /bin/bash
        groups: sudo      # Add them to the admin group
        append: yes

    # 2. Deploy their SSH Public Key (Passwordless login)
    - name: Set authorized SSH key for jdoe
      authorized_key:
        user: jdoe
        state: present
        # We pass the actual public key string
        key: "ssh-rsa AAAAB3NzaC1yc... jdoe@laptop"

    # 3. Offboarding an ex-employee instantly
    - name: Remove terminated employee access
      user:
        name: msmith
        state: absent    # Deletes the user account!
        remove: yes      # Deletes their home directory and files

5. Automating the Firewall (UFW) #

- name: Security Baseline - Firewall Configuration
  hosts: webservers
  become: yes

  tasks:
    # 1. Allow HTTP traffic (Public)
    - name: Allow HTTP (Port 80)
      ufw:
        rule: allow
        port: '80'
        proto: tcp

    # 2. Restrict SSH traffic to a specific Corporate IP!
    - name: Restrict SSH to Corporate VPN
      ufw:
        rule: allow
        port: '22'
        src: '192.168.100.0/24' # Only allow logins from this specific network

    # 3. Turn the firewall ON and block everything else
    - name: Enable UFW and deny all other incoming traffic
      ufw:
        state: enabled
        default: deny

6. Mini Project: Secure Sudoers Configuration #

Step-by-Step Architecture Concept: Let's allow the deploy_bot user to restart the Nginx service without a password, but NOTHING ELSE.

---
- name: Configure Secure Deployment Bot
  hosts: webservers
  become: yes

  tasks:
    - name: Create the deploy_bot user
      user:
        name: deploy_bot
        state: present

    # The lineinfile module surgically adds or replaces a single line of text in a file
    - name: Allow deploy_bot to restart Nginx without sudo password
      lineinfile:
        path: /etc/sudoers.d/deploy_bot # Safest place to put sudo rules
        state: present
        create: yes
        mode: '0440'
        # The specific sudoers syntax
        line: 'deploy_bot ALL=(ALL) NOPASSWD: /usr/sbin/service nginx restart'
        # Validation is critical! Visudo checks for syntax errors BEFORE saving.
        # If there is a syntax error, Ansible halts to prevent locking you out of the server.
        validate: /usr/sbin/visudo -cf %s 

7. Real-World Scenarios #

• Never Use Passwords: The user module allows you to pass a password: argument. You should almost never use this. Modern Linux environments should rely 100% on SSH Key authentication via the authorizedkey module. Passwords can be brute-forced; cryptographic keys cannot.

9. Security Recommendations #

• The validate Parameter: Modifying security files like /etc/sudoers or /etc/ssh/sshdconfig is extremely dangerous. A single typo will lock you out of your server permanently, requiring physical console access to fix. Always use the validate parameter in the lineinfile or template modules when touching these files. Ansible will run the validation command on a temporary copy of the file; if the command fails, Ansible aborts the task and does not overwrite your live configuration file.

1. 2. Write a task using the authorizedkey module to remove an ex-employee's SSH key from a server.

12. FAQs #

15. Next Chapter Recommendation #