Python Ansible：维护 sudoers 列表的最佳实践
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/33359404/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Ansible: best practice for maintaining list of sudoers
提问by chishaku
In the documentation, there is an example of using the lineinfilemodule to edit /etc/sudoers.
在文档中，有一个使用lineinfile模块进行编辑的示例/etc/sudoers。
- lineinfile: "dest=/etc/sudoers state=present regexp='^%wheel' line='%wheel ALL=(ALL) NOPASSWD: ALL'"
Feels a bit hackish.
感觉有点hackish。
I assumed there would be something in the usermodule to handle this but there doesn't appear to be any options.
我认为user模块中会有一些东西来处理这个问题，但似乎没有任何选择。
What are the best practices for adding and removing users to /etc/sudoers?
添加和删除用户的最佳做法是/etc/sudoers什么？
采纳答案by ydaetskcoR
That line isn't actually adding an users to sudoers, merely making sure that the wheelgroup can have passwordless sudo for all command.
该行实际上并不是将用户添加到 sudoers，只是确保该wheel组可以为所有命令使用无密码的 sudo。
As for adding users to /etc/sudoersthis is best done by adding users to necessary groups and then giving these groups the relevant access to sudo. This holds true when you aren't using Ansible too.
至于向/etc/sudoers此添加用户，最好通过将用户添加到必要的组，然后授予这些组对 sudo 的相关访问权限来完成。当您不使用 Ansible 时也是如此。
The user moduleallows you to specify an exclusive list of group or to simply append the specified groups to the current ones that the user already has. This is naturally idempotent as a user cannot be defined to be in a group multiple times.
该用户模块允许您指定组的独占列表或简单地追加指定的组为当前的用户已经拥有。这自然是幂等的，因为不能多次将用户定义为在一个组中。
An example play might look something like this:
一个示例游戏可能看起来像这样：
- hosts: all
vars:
sudoers:
- user1
- user2
- user3
tasks:
- name: Make sure we have a 'wheel' group
group:
name: wheel
state: present
- name: Allow 'wheel' group to have passwordless sudo
lineinfile:
dest: /etc/sudoers
state: present
regexp: '^%wheel'
line: '%wheel ALL=(ALL) NOPASSWD: ALL'
validate: visudo -cf %s
- name: Add sudoers users to wheel group
user:
name: "{{ item }}"
groups: wheel
append: yes
with_items: "{{ sudoers }}"
