From a273df993b8496fa17fcfc04bb7729f3355a0016 Mon Sep 17 00:00:00 2001
From: Sebastian Trebitz <sebastian@nephosolutions.com>
Date: Fri, 27 Mar 2020 23:28:21 +0100
Subject: [PATCH] Set user login shell and directory skeleton globally

Closes nephosolutions/ansible-role-sftp-server#3
---
 README.md      | 3 ++-
 tasks/main.yml | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 4b15438..9487bad 100644
--- a/README.md
+++ b/README.md
@@ -33,13 +33,14 @@ The following role variables are relevant:
   * `name`: The Unix name of the user that requires SFTP access.
   * `group`: An optional user primary group. If set, it will be used for the user's home permission. Otherwise, the `sftp_group_name` is used.
   * `password`: A password hash for the user to login with - ie `openssl passwd -1 -salt salty passpass`.  Blank passwords can be set with `password: ""`.  NOTE: It appears that `UsePAM yes` and `PermitEmptyPassword yes` need to be set in `sshd_config` in order for blank passwords to work properly.  Making those changes currently falls outside the scope of this role and will need to be done externally.
-  * `shell`: Boolean indicating if the user should have a shell access (default to `True`).
+  * `shell`: Boolean indicating if the user should have a shell access (default to `False`).
   * `authorized`: An optional list of files placed in `files/` which contain valid public keys for the SFTP user.
   * `sftp_directories`: A list of directories that need to be individually created for an SFTP user. Defaults to a blank list (i.e. "[]").
   * `append`: Boolean to add `sftp_group_name` to the user groups (if any) instead of setting it (default to `False`).
   * `mode`: The users home directory mode (defaults to `0750`).
   * `skeleton`: An optional home skeleton directory (e.g: /dev/null). Default to system defaults.
   * `home`: An optional home directory (e.g: /home/bob). Default to `sftp_home_partition/name`.
+* `sftp_login_shell`: Boolean indicating if the users should have a shell access (default to `False`).
 * `sftp_nologin_shell`: The "nologin" user shell. (defaults to /sbin/nologin.)
 * `sftp_home_skeleton`: An optional home skeleton directory (e.g: /dev/null). Default to system defaults.
 * `sftp_configure_sshd`: Boolean indicating if sshd configuration should be altered. Defaults to `true`. 
diff --git a/tasks/main.yml b/tasks/main.yml
index 08423e7..0727f56 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -68,9 +68,9 @@
     groups: "{{ sftp_group_name }}"
     append: "{{ item.append | default(False) }}"
     home: "{{ item.home }}"
-    # `None` means default value -> default is to have a shell
-    shell: "{{ None if (item.shell | default(True)) else sftp_nologin_shell }}"
-    skeleton: "{{ item.skeleton | default(omit) }}"
+    # `None` means default value -> default is to have no login shell
+    shell: "{{ None if (item.shell | default(sftp_login_shell) | default(False)) else sftp_nologin_shell }}"
+    skeleton: "{{ item.skeleton | default(sftp_home_skeleton) | default(omit) }}"
     state: present
   with_items: "{{ _sftp_users }}"