B模块 ansible.note
配置一（简单一点）：
配置二：
1）git：
apt install -y git
mkdir /opt/ansible
cd /opt/ansible
git init
git config user.name "ANSIBLE-SRV"
git config user.email "ansible@paris.local"
git add .
git commit -m "Initial Ansible configuration"2）剧本：
---
- name: Paris
hosts: PARIS
gather_facts: false
tasks:
- name: create paris ou
microsoft.ad.ou:
name: "{{ item.ou.split(',')[0].split('=')[1] }}"
domain_server: DC1.paris.local
domain_username: "PARIS\\Administrator"
domain_password: "{{ ansible_password }}"
loop: "{{ file_shares }}"
- name: create paris read group
microsoft.ad.group:
name: "{{ item.read }}"
path: "{{ item.ou.split(',')[0] }},dc=paris,dc=local"
scope: global
domain_server: DC1.paris.local
domain_username: "PARIS\\Administrator"
domain_password: "{{ ansible_password }}"
loop: "{{ file_shares }}"
- name: create paris write group
microsoft.ad.group:
name: "{{ item.write }}"
path: "{{ item.ou.split(',')[0] }},dc=paris,dc=local"
scope: global
domain_server: DC1.paris.local
domain_username: "PARIS\\Administrator"
domain_password: "{{ ansible_password }}"
loop: "{{ file_shares }}"
- name: Lyon
hosts: LYON
gather_facts: false
tasks:
- name: create Lyon ou
microsoft.ad.ou:
name: "{{ item.ou.split(',')[0].split('=')[1] }}"
loop: "{{ file_shares }}"
- name: create Lyon Read group
microsoft.ad.group:
name: "{{ item.read }}"
path: "{{ item.ou.split(',')[0] }},dc=lyon,dc=paris,dc=local"
scope: global
loop: "{{ file_shares }}"
- name: create Lyon write group
microsoft.ad.group:
name: "{{ item.write }}"
path: "{{ item.ou.split(',')[0] }},dc=lyon,dc=paris,dc=local"
scope: global
loop: "{{ file_shares }}"
- name: Shared the folder
hosts: all
gather_facts: false
tasks:
- name: create root folder
win_file:
path: C:\project_share
state: directory
- name: create sub folder
win_file:
path: "c:\\project_share\\{{ item.name }}"
state: directory
loop: "{{ file_shares }}"
- name: NTFS disable inheritance
win_acl_inheritance:
path: "c:\\project_share\\{{ item.name }}"
reorganize: false
loop: "{{ file_shares }}"
- name: NTFS SYSTEM permission
win_acl:
user: SYSTEM
path: "c:\\project_share\\{{ item.name }}"
type: allow
rights: fullcontrol
loop: "{{ file_shares }}"
register: file
- name: NTFS OWNER permission
win_acl:
user: CREATOR OWNER
path: "c:\\project_share\\{{ item.name }}"
type: allow
rights: fullcontrol
loop: "{{ file_shares }}"
changed_when: file.changed
- name: NTFS read permission
win_acl:
user: "{{ item.read }}"
path: "c:\\project_share\\{{ item.name }}"
type: allow
rights: ReadAndexEcute
loop: "{{ file_shares }}"
- name: NTFS write permission
win_acl:
user: "{{ item.write }}"
path: "c:\\project_share\\{{ item.name }}"
type: allow
rights: fullcontrol
loop: "{{ file_shares }}"
- name: share Folder
ansible.windows.win_share:
name: "{{ item.name }}"
path: "c:\\project_share\\{{ item.name }}"
full: everyone
loop: "{{ file_shares }}"
·优化剧本：
题目要求要同时对子域和当前域创建，并且这里有的OU路径还是 dc=lyon
---
- name: paris site share folder
hosts: DMZ-1
gather_facts: false
tasks:
- name: Create a group in a custom path
microsoft.ad.ou:
name: "{{ item.ou.split(',')[0].split('=')[1] }}"
path: DC=paris,DC=local
domain_server: SH-INTERNAL-1.paris.local
domain_username: administrator@paris
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: Create a read group in a custom path
microsoft.ad.group:
name: "{{ item.read }}"
path: "{{ item.ou }}"
scope: domainlocal
#path: OU=groups,DC=ansible,DC=local
domain_server: SH-INTERNAL-1.paris.local
domain_username: administrator@paris
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: Create a write group in a custom path
microsoft.ad.group:
name: "{{ item.write }}"
path: "{{ item.ou }}"
scope: domainlocal
#path: OU=groups,DC=ansible,DC=local
domain_server: SH-INTERNAL-1.paris.local
domain_username: administrator@paris
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: Create Directory
win_file:
path: "c:\\project_share\\{{ item.name }}"
state: directory
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: disable other user
ansible.windows.win_acl_inheritance:
path: "c:\\project_share\\{{ item.name }}"
state: absent
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: "{{ item.write }}"
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
tags: t1
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: SYSTEM
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
tags: t2
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: administrators
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
tags: t3
- name: read
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: "{{ item.read }}"
rights: read
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
- name: Add secret share
ansible.windows.win_share:
name: "{{ item.name }}"
path: "c:\\project_share\\{{ item.name }}"
full: "{{ item.write }}"
read: "{{ item.read }}"
loop: "{{ file_shares }}"
when: "'lyon' not in item.ou"
tags: t4
- name: lyon site share folder
hosts: BJ-INTERNAL-1
gather_facts: false
tasks:
- name: Create a group in a custom path
microsoft.ad.ou:
name: "{{ item.ou.split(',')[0].split('=')[1] }}"
path: DC=lyon,DC=paris,DC=local
domain_server: BJ-INTERNAL-1.lyon.paris.local
domain_username: administrator@lyon
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: Create a read group in a custom path
microsoft.ad.group:
name: "{{ item.read }}"
path: "{{ item.ou }}"
scope: domainlocal
#path: OU=groups,DC=ansible,DC=local
domain_server: BJ-INTERNAL-1.lyon.paris.local
domain_username: administrator@lyon
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: Create a write group in a custom path
microsoft.ad.group:
name: "{{ item.write }}"
path: "{{ item.ou }}"
scope: domainlocal
#path: OU=groups,DC=ansible,DC=local
domain_server: BJ-INTERNAL-1.lyon.paris.local
domain_username: administrator@lyon
domain_password: Skills39
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: Create Directory
win_file:
path: "c:\\project_share\\{{ item.name }}"
state: directory
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: disable other user
ansible.windows.win_acl_inheritance:
path: "c:\\project_share\\{{ item.name }}"
state: absent
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: "{{ item.write }}"
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
tags: t1
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: SYSTEM
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
tags: t2
- name: write
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: administrators
rights: fullcontrol
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
tags: t3
- name: read
ansible.windows.win_acl:
path: "c:\\project_share\\{{ item.name }}"
user: "{{ item.read }}"
rights: read
type: allow
state: present
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
- name: Add secret share
ansible.windows.win_share:
name: "{{ item.name }}"
path: "c:\\project_share\\{{ item.name }}"
full: "{{ item.write }}"
read: "{{ item.read }}"
loop: "{{ file_shares }}"
when: "'lyon' in item.ou"
tags: t4