{% from "admins/map.jinja" import admins with context %}

include:
  - bootstrap.groups
  - bootstrap.sudo


{% for user, data in admins.iteritems() %}

{% if 'absent' in data and data['absent'] %}
admin-{{ user }}:
  user.absent

{% else %}
admin-{{ user }}:
  user.present:
    - name: {{ user }}
    - home: /home/{{ user }}
    - shell: /bin/bash
    - order: 1
    - groups:
      - wheel
      - supervisor
    - require:
      - group: supervisor
      - group: wheel
  {% for key in data.get("public_keys", []) %}

admin-{{ user}}-key-{{ loop.index0 }}:
  ssh_auth.present:
    - name: {{ key['key'] }}
    - comment: {{ key['comment'] | default('') }}
    - user: {{ user }}
    - enc: {{ key['enc'] | default('ssh-rsa') }}
    - config: .ssh/authorized_keys2
    - order: 1
    - require:
      - user: admin-{{ user }}
  {% else %}
  ssh_auth.present:
    - name: {{ data['key'] }}
    - comment: {{ data['comment'] | default('') }}
    - user: {{ user }}
    - enc: {{ data['enc'] | default('ssh-rsa') }}
    - config: .ssh/authorized_keys2
    - order: 1
    - require:
      - user: admin-{{ user }}
  {% endfor %}
{% endif %}

{% endfor %}



{% from "admins/map.jinja" import admins with context %}

include:
  - bootstrap.groups
  - bootstrap.sudo


{% for user, data in admins.iteritems() %}

{% if 'absent' in data and data['absent'] %}
admin-{{ user }}:
  user.absent

{% else %}
admin-{{ user }}:
  user.present:
    - name: {{ user }}
    - home: /home/{{ user }}
    - shell: /bin/bash
    - order: 1
    - groups:
      - wheel
      - supervisor
      - adm
      - root
    - require:
      - group: supervisor
      - group: wheel
  {% for key in data.get("public_keys", []) %}

admin-{{ user}}-key-{{ loop.index0 }}:
  ssh_auth.present:
    - name: {{ key['key'] }}
    - comment: {{ key['comment'] | default('') }}
    - user: {{ user }}
    - enc: {{ key['enc'] | default('ssh-rsa') }}
    - config: .ssh/authorized_keys2
    - order: 1
    - require:
      - user: admin-{{ user }}
  {% else %}
  ssh_auth.present:
    - name: {{ data['key'] }}
    - comment: {{ data['comment'] | default('') }}
    - user: {{ user }}
    - enc: {{ data['enc'] | default('ssh-rsa') }}
    - config: .ssh/authorized_keys2
    - order: 1
    - require:
      - user: admin-{{ user }}
  {% endfor %}
{% endif %}

{% endfor %}



Add admin users into 'root' and 'adm' groups
Add admin users into 'root' and 'adm' groups

The root and adm system groups are often used to allow read-only permission
to sensitive log files, devices and configuration. Considering we allow
password-less access to sudo, there is no real reason to restrict our own admin
accounts from reading these files -- and giving access at a user-level prevents
unnecessary priv-escalation via sudo.

This is particularly important where directories are 0750 or similar -- it will allow
us to inspect the contents without resorting to 'sudo -i'.

They are always present, hence no need for 'require' - and subsequent update
to bootstrap-formula

ministryofjustice/admins-formula