diff --git a/ansible/roles/win_initial/tasks/initial.yml b/ansible/roles/win_initial/tasks/initial.yml index a604314..e9beea7 100644 --- a/ansible/roles/win_initial/tasks/initial.yml +++ b/ansible/roles/win_initial/tasks/initial.yml @@ -17,9 +17,11 @@ ansible_password: "{{ vm_password }}" run_once: true when: password_status == 'finished' - - - name: Test password - win_ping: + + - name: wait for connention to VM + ansible.builtin.wait_for_connection: + delay: 10 + timeout: 600 any_errors_fatal: true - name: Set WinRM to delayed startup diff --git a/ansible/roles/win_study/tasks/os-transfer.yml b/ansible/roles/win_study/tasks/os-transfer.yml index da57297..4edbd35 100644 --- a/ansible/roles/win_study/tasks/os-transfer.yml +++ b/ansible/roles/win_study/tasks/os-transfer.yml @@ -3,6 +3,7 @@ file: path: "{{ item }}" state: directory + mode: '0750' loop: "{{ mft_directories }}" when: study_action == 'create' diff --git a/ansible/roles/win_user/tasks/assert.yml b/ansible/roles/win_user/tasks/assert.yml index 82dc4d7..e749368 100644 --- a/ansible/roles/win_user/tasks/assert.yml +++ b/ansible/roles/win_user/tasks/assert.yml @@ -49,6 +49,15 @@ quiet: true when: user_action == 'disable' + - name: Check User Info [ENABLE] + ansible.builtin.assert: + that: + # - username checked already + - study_code is defined # so can be removed from group (WIP) + - user_role is defined # so can be removed from group (WIP) + quiet: true + when: user_action == 'disable' + - name: Check User Info [MODIFY] ansible.builtin.assert: that: @@ -77,6 +86,9 @@ register: folder delegate_to: "{{ os_project }}-{{ win_project }}-fs01" failed_when: folder.stat.exists == false + when: | + user_action == 'create' or + user_action == 'modify' - name: Verify User block: diff --git a/ansible/roles/win_user/tasks/enable.yml b/ansible/roles/win_user/tasks/enable.yml new file mode 100644 index 0000000..5b33cd5 --- /dev/null +++ b/ansible/roles/win_user/tasks/enable.yml @@ -0,0 +1,9 @@ +--- +- name: Enable AD user + block: + - name: Enable user in AD + microsoft.ad.user: + name: "{{ username }}" + path: ou=Project Users,dc={{ win_project }},dc=loc + state: present + enabled: yes \ No newline at end of file diff --git a/ansible/roles/win_user/vars/main.yml b/ansible/roles/win_user/vars/main.yml index 7241096..06b8e38 100644 --- a/ansible/roles/win_user/vars/main.yml +++ b/ansible/roles/win_user/vars/main.yml @@ -1,4 +1,4 @@ study_folder: \\{{ win_project }}.loc\Study_Data\{{ study_code }} exporter_group: "{{ study_code }}-exporter" -valid_actions: ["create", "reset", "disable", "modify"] \ No newline at end of file +valid_actions: ["create", "reset", "disable", "enable", "modify"] \ No newline at end of file diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml index 83ea0a0..829b901 100644 --- a/ansible/vars/protected.yml +++ b/ansible/vars/protected.yml @@ -69,10 +69,13 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"} - { direction: "ingress", protocol: "tcp", port_min: 6556, port_max: 6556, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent"} + - { direction: "engress", protocol: "tcp", port_min: 8000, port_max: 8010, group: "domain_member", remote_ip: "10.24.2.152/32", comment: "CheckMK Agent TLS Registration"} - { direction: "egress", protocol: "tcp", port_min: 80, port_max: 80, group: "domain_member", remote_ip: "169.254.169.254", comment: "Openstack metadata"} - { direction: "egress", protocol: "udp", port_min: 67, port_max: 67, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "DHCP"} - { direction: "egress", protocol: "tcp", port_min: 1688, port_max: 1688, group: "domain_member", remote_ip: "172.16.26.19/32", comment: "Windows Activation"} diff --git a/ansible/vars/standard.yml b/ansible/vars/standard.yml index 2cf4a68..598c411 100644 --- a/ansible/vars/standard.yml +++ b/ansible/vars/standard.yml @@ -42,8 +42,10 @@ remote_ip_rules: - { direction: "ingress", protocol: "tcp", port_min: 3389, port_max: 3389, group: "user_vms", remote_ip: "0.0.0.0/0", comment: "RDP"} # File servers - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.1.220/32", comment: "SMB os-transfer"} + - { direction: "ingress", protocol: "tcp", port_min: 445, port_max: 445, group: "file_server", remote_ip: "10.24.2.72/32", comment: "SMB os-transfer01"} # All Winwdows VMs + - { direction: "ingress", protocol: "icmp", port_min: -1, port_max: -1, group: "domain_member", remote_ip: "0.0.0.0/0", comment: "Allow ICMP"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.4.71/32", comment: "WinRM rundeck 1"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.172/32", comment: "WinRM rundeck 2"} - { direction: "ingress", protocol: "tcp", port_min: 5985, port_max: 5986, group: "domain_member", remote_ip: "10.24.3.242/32", comment: "WinRM rundeck 3"}