37 lines
2.2 KiB
Bash
37 lines
2.2 KiB
Bash
nodes_wait 60 || true
|
|
# ans CMD: run CMD as greg in his project directory.
|
|
ans() { setsid -w timeout 180 runuser -l greg -c "cd ~/ansible && $*" </dev/null; }
|
|
OUT=$LAB_STATE/check.out
|
|
P='-e ansible_password=Lab-Pass-1 -e ansible_become_password=Lab-Pass-1'
|
|
A=/home/greg/ansible
|
|
# sudo_ok NODE: devops's drop-in is valid, mode 0440, and gives NOPASSWD: ALL.
|
|
sudo_ok() {
|
|
in_node "$1" 'visudo -cf /etc/sudoers.d/devops && [ "$(stat -c %a /etc/sudoers.d/devops)" = 440 ] &&
|
|
sudo -l -U devops | grep -q "NOPASSWD: ALL" && runuser -u devops -- sudo -n true'
|
|
}
|
|
idroot() { ans ansible all -o -a id >"$OUT" && grep -q . "$OUT" && ! grep -v "uid=0(root)" "$OUT"; }
|
|
|
|
task 1 "Passwordless sudo for devops from a validated drop-in, mode 0440"
|
|
need "/home/greg/ansible/sudo.yml exists" "[ -f $A/sudo.yml ]"
|
|
need "sudo.yml validates the file with visudo" "grep -Eq 'validate:.*visudo' $A/sudo.yml"
|
|
for n in $(nodes_names); do
|
|
need "/etc/sudoers.d/devops on $n is valid, mode 0440, and gives devops NOPASSWD: ALL" "sudo_ok $n"
|
|
done
|
|
need "ansible all -a id shows uid=0(root) on every node (as greg, in ~/ansible)" idroot
|
|
|
|
task 2 "typo.yml fails at validate, and sudo still works"
|
|
need "/home/greg/ansible/typo.yml exists" "[ -f $A/typo.yml ]"
|
|
need "typo.yml validates the file with visudo" "grep -Eq 'validate:.*visudo' $A/typo.yml"
|
|
need "running typo.yml fails with \"failed to validate\"" "! ans ansible-playbook typo.yml $P >\"\$OUT\" && grep -q 'failed to validate' \"\$OUT\""
|
|
for n in $(nodes_names); do
|
|
need "devops still has passwordless sudo on $n" "sudo_ok $n"
|
|
done
|
|
need "ansible all -a id still shows uid=0(root) on every node" idroot
|
|
|
|
task 3 "whoami.yml runs whoami as devops in a play that becomes root"
|
|
need "/home/greg/ansible/whoami.yml exists" "[ -f $A/whoami.yml ]"
|
|
need "whoami.yml has become: true and become_user: devops" "grep -Eq '^ *become: *(true|yes|True)' $A/whoami.yml && grep -Eq '^ *become_user: *[\"'\'']?devops' $A/whoami.yml"
|
|
need "whoami.yml runs whoami" "grep -q whoami $A/whoami.yml"
|
|
need "running whoami.yml -v shows whoami printing devops on every node, with no failures" 'ans ansible-playbook whoami.yml -v >"$OUT" && for n in $(nodes_names); do grep -E "^(ok|changed): \[$n\] => \{.*\"stdout\": \"devops\"" "$OUT" >/dev/null || exit 1; done'
|
|
rm -f "$OUT"
|