58 lines
1.5 KiB
YAML
58 lines
1.5 KiB
YAML
---
|
|
- name: Install sshpass
|
|
package:
|
|
name:
|
|
- sshpass
|
|
state: present
|
|
|
|
- name: Set password for test
|
|
ansible.builtin.set_fact:
|
|
test_pw: myTest!pw
|
|
|
|
- name: Create locked_user
|
|
user:
|
|
name: locked_user
|
|
password: "{{ test_pw | password_hash('sha512') }}"
|
|
|
|
- name: Create ssh-client-keypair
|
|
community.crypto.openssh_keypair:
|
|
path: /root/.ssh/locked_user_id
|
|
type: ed25519
|
|
state: present
|
|
register: generated_key
|
|
|
|
- name: Add ssh-public-key to locked_user
|
|
ansible.posix.authorized_key:
|
|
user: locked_user
|
|
key: "{{ generated_key.public_key }}"
|
|
state: present
|
|
|
|
- name: Check successful login with password
|
|
ansible.builtin.shell:
|
|
cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"
|
|
|
|
- name: Check successful login with ssh key
|
|
ansible.builtin.shell:
|
|
cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"
|
|
|
|
- name: Set password change date for locked_user
|
|
ansible.builtin.shell:
|
|
cmd: chage -d 2020-01-01 locked_user
|
|
|
|
- name: Check unsuccessful login with password
|
|
ansible.builtin.shell:
|
|
cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"
|
|
register: output
|
|
ignore_errors: true
|
|
|
|
- name: Assert check unsuccessful login
|
|
ansible.builtin.assert:
|
|
that:
|
|
- output.rc | int == 1
|
|
- "'WARNING: Your password has expired.' in output.stderr"
|
|
- "'success' not in output.stdout"
|
|
|
|
- name: Check successful login with ssh key
|
|
ansible.builtin.shell:
|
|
cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"
|