diff --git a/README.md b/README.md index 74eba64..74602ef 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,8 @@ The following role variables are relevant: * `sftp_users`: A list of users, in map form, containing the following elements: * `name`: The Unix name of the user that requires SFTP access. * `password`: A password hash for the user to login with. Blank passwords can be set with `password: ""`. NOTE: It appears that `UsePAM yes` and `PermitEmptyPassword yes` need to be set in `sshd_config` in order for blank passwords to work properly. Making those changes currently falls outside the scope of this role and will need to be done externally. - * `authorized`: A list of files placed in `files/` which contain valid public keys for the SFTP user. + * `shell`: Boolean indicating if the user should have a shell access (default to `True`). + * `authorized`: An optional list of files placed in `files/` which contain valid public keys for the SFTP user. ## Example Playbook @@ -44,7 +45,7 @@ The following role variables are relevant: - sftp_users: - name: peter password: "$1$salty$li5TXAa2G6oxHTDkqx3Dz/" # passpass - authorized: [] + shell: False - name: sally password: "" authorized: [sally.pub] diff --git a/tasks/main.yml b/tasks/main.yml index b1235fa..d990b86 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -50,7 +50,8 @@ name: "{{ item.name }}" groups: "{{ sftp_group_name }}" home: "{{ sftp_home_partition }}/{{ item.name }}" - shell: "/sbin/nologin" + # `None` means default value -> default is to have a shell + shell: "{{ None if (item.shell | default(True)) else '/sbin/nologin' }}" state: present with_items: "{{ sftp_users }}" @@ -71,6 +72,8 @@ with_subelements: - "{{ sftp_users }}" - authorized + - flags: + skip_missing: True # Update user passwords, if they were specified. - name: SFTP-Server | Update user passwords