如果不存在，请使用 Ansible 创建用户和组

Question

我有一个定制的要求。

1. 检查用户tomuser是否属于组tomuser并存在，无论uid，gid是什么;然后什么都不做，即我们很好。

2. 如果组tomuser不存在，则创建带有gid1900的组tomuser。

3. 如果用户tomuser不存在，则创建带有gid1900的用户tomuser，并在组tomuser中分配。

4. 最后，如果在创建用户和组时uid, gid1900已经在使用，那么更喜欢uid,gid作为2020，如果它也在使用中，那么任何随机的唯一数字对两者都很好。

下面，是我可以想到的，我知道这不是理想的解决方案;但我也会遇到问题。

剧本如下：

<小时 />

- name: Check tomuser user in passwd file
tags: always
ignore_errors: yes
block:
- group:
name: tomuser
gid: "{{ item }}"
loop:
- "1900"
- "2020"
register: groupcreated            
when: "tomuser" in groups
- debug:
msg: "GROUP tomuser does not exists or is empty"
when: 'tomuser' not in groups and not groups['tomuser']
- debug:
msg: "GROUP tomuser does not exists"
when: 'tomuser' not in groups
- debug:
msg: "GROUP tomuser is empty"
when: not groups['tomuser']

- raw: "cat /etc/passwd |grep -i tomuser"
register: tomusercheck

输出：

TASK [Check tomcat USER on server] *************************************************************************************************************************************
task path: /app/patch/patch.yml:81
fatal: [10.9.9.44]: FAILED! => {
"reason": "Syntax Error while loading YAML.n  did not find expected keynnThe error appears to be in '/app/patch/checktomuser.yml': line 11, column 30, but maynbe elsewhere in the file depending on the exact syntax problem.nnThe offending line appears to be:nn            gid: '1900'n          when: "tomuser" in groupsn                             ^ herenThis one looks easy to fix. It seems that there is a value startednwith a quote, and the YAML parser is expecting to see the line endednwith the same kind of quote. For instance:nn    when: "ok" in result.stdoutnnCould be written as:nn   when: '"ok" in result.stdout'nnOr equivalently:nn   when: "'ok' in result.stdout"n"

恳请建议。

Answer 1

知道了。也应该是幂等的。

---
- hosts: my_host
become: true
tasks:
- name: determine available groups
getent:
database: group
- name: determine available users
getent:
database: passwd
- name: set group with gid 1900 when not available
group:
name: tomuser
gid: 1900
when:
- "'tomuser' not in ansible_facts.getent_group"
- "'1900' not in item.value"
loop: "{{ ansible_facts.getent_group | dict2items }}"
- name: set group with gid 2020 when not available
group:
name: tomuser
gid: 2020
when:
- "'tomuser' not in ansible_facts.getent_group"
- "'2020' not in item.value"
loop: "{{ ansible_facts.getent_group | dict2items }}"
- name: create random number
set_fact:
random_num: "{{ range(1500, 2000) | random(seed=item) }}"
run_once: yes
with_items:
- string
- name: set group with random gid when 2020 already in use
group:
name: tomuser
gid: "{{ random_num }}"
when:
- "'tomuser' not in ansible_facts.getent_group"
- "'2020' in item.value"
loop: "{{ ansible_facts.getent_group | dict2items }}"
- name: set fact when tomuser exists
set_fact:
user_exists: true
when: '"tomuser" in item.key'
loop: "{{ ansible_facts.getent_passwd | dict2items }}"
- name: set fact when tomuser does not exists
set_fact:
user_exists: false
when: '"tomuser" not in item.key'
loop: "{{ ansible_facts.getent_passwd | dict2items }}"
- name: set user with uid 1900, and group tomuser when not available
user:
name: tomuser
uid: 1900
group: tomuser
when:
- not user_exists
- "'1900' not in item.value[1]"
loop: "{{ ansible_facts.getent_passwd | dict2items }}"
- name: set user with uid 2020, and group tomuser when not available
user:
name: tomuser
uid: 2020
group: tomuser
when:
- not user_exists
- "'2020' not in item.value[1]"
loop: "{{ ansible_facts.getent_passwd | dict2items }}"
- name: set user with random uid, and group tomuser when not available
user:
name: tomuser
uid: "{{ random_num }}"
group: tomuser
when:
- not user_exists
- "'2020' in item.value[1]"
loop: "{{ ansible_facts.getent_passwd | dict2items }}"

Answer 2

您的第一个问题是：when: "tomuser" in groups
groups变量包含清单中的主机组，而不是主机上的用户组。

其次，group模块将添加/修改组。因此，如果该组不存在，您的代码将使用gid1900 添加它，然后将该组的gid更改为 2020。因此，在您的循环结束后，您的小组将始终拥有 2020gid。

要更新用户的组，可以使用user模块.
要检查用户或组是否存在，可以使用getent模块。

检查组模块、用户模块和获取模块的文档。