Ansible Playbookで連番の複数ユーザーを一括作成する：その2

# はじめに

[こちらの記事](https://qiita.com/hirokuda/items/cad0f985ae5b8d704f54)に投稿したAnsible PlaybookのSSH鍵バージョンを作ってみました。

# 想定ケース

例えば開発者向けなど、連番のユーザーを大量に作成する。ただし、パスワード認証ではなく、鍵認証させたい。

# Playbook

冒頭は先の記事とほぼ同じです。初期パスワードの変数は不要なので削除しています。

```yaml:usercreate_withkey.yml
---
- name: Create many user
  hosts: localhost
  vars:
    user_num_data: "{% for n in range(10) %}{{n+1}},{% endfor %}"
    user_num: "{{ user_num_data.split(',') }}"
    pre_id: 50
    pre_name: devuser
    common_group: devgroup

  tasks:
    - name: Common group is created
      group:
        name: '{{ common_group }}'
        gid: '{{ pre_id }}00'
        state: present

    - name: Groups are created
      group:
        name: '{{ pre_name }}{{ item.zfill(2) }}'
        gid: '{{ pre_id }}{{ item.zfill(2) }}'
        state: present
      with_items:
        - '{{ user_num[:-1] }}'
```

ユーザー作成のところで、`generate_ssh_key: true`と`ssh_key_bits: 4096`を指定するように変更します。

```yaml:usercreate_withkey.yml
    - name: Users are created
      user:
        name: '{{ pre_name }}{{ item.zfill(2) }}'
        group: '{{ pre_name }}{{ item.zfill(2) }}'
        groups: '{{ pre_name }}{{ item.zfill(2) }}, {{ common_group }}'
        uid: '{{ pre_id }}{{ item.zfill(2) }}'
        state: present
        generate_ssh_key: true
        ssh_key_bits: 4096
      with_items:
        - '{{ user_num[:-1] }}'
      register: usercreated
```

次に、作成したユーザーごとの`~/.ssh/authorized_keys`を作成します。ちなみに、`item.name`ではなく、`item.invocation.module_args.name`としているのは、Check mode(Dry run)でエラーにさせないためです。

```yaml:usercreate_withkey.yml
    - name: authorized_keys files are created
      copy:
        src: '/home/{{ item.invocation.module_args.name }}/.ssh/id_rsa.pub'
        dest: '/home/{{ item.invocation.module_args.name }}/.ssh/authorized_keys'
        owner: '{{ item.invocation.module_args.name }}'
        group: '{{ item.invocation.module_args.name }}'
        mode: '0600'
        remote_src: true
      with_items:
        - '{{ usercreated.results }}'
      when:
        - item.changed
        - item.invocation.module_args.state == "present"
      loop_control:
        label: "{{ item.invocation.module_args.name }}"
```

最後に、作成したユーザーの秘密鍵を/tmpに集めます。（秘密鍵を配布するってそもそもどうなの？って話はさておき・・）

```yaml:usercreate_withkey.yml
    - name: Secret key files are copied
      copy:
        src: '/home/{{ item.invocation.module_args.name }}/.ssh/id_rsa'
        dest: '/tmp/id_rsa_{{ item.invocation.module_args.name }}'
        owner: root
        group: root
        mode: '0644'
        remote_src: true
      with_items:
        - '{{ usercreated.results }}'
      when: 
        - item.changed
        - item.invocation.module_args.state == "present"
      loop_control:
        label: "{{ item.invocation.module_args.name }}"
```

# 実行結果

ansible-playbookの実行結果は次のとおり。

```
$ ansible-playbook -i inventories/test usercreate_withkey.yml

PLAY [Create many user] ************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [localhost]

TASK [Common group is created] *****************************************************************************************
ok: [localhost]

TASK [Groups are created] **********************************************************************************************
changed: [localhost] => (item=1)
changed: [localhost] => (item=2)
changed: [localhost] => (item=3)
changed: [localhost] => (item=4)
changed: [localhost] => (item=5)
changed: [localhost] => (item=6)
changed: [localhost] => (item=7)
changed: [localhost] => (item=8)
changed: [localhost] => (item=9)
changed: [localhost] => (item=10)

TASK [Users are created] ***********************************************************************************************
changed: [localhost] => (item=1)
changed: [localhost] => (item=2)
changed: [localhost] => (item=3)
changed: [localhost] => (item=4)
changed: [localhost] => (item=5)
changed: [localhost] => (item=6)
changed: [localhost] => (item=7)
changed: [localhost] => (item=8)
changed: [localhost] => (item=9)
changed: [localhost] => (item=10)

TASK [authorized_keys files are created] *******************************************************************************
changed: [localhost] => (item=devuser01)
changed: [localhost] => (item=devuser02)
changed: [localhost] => (item=devuser03)
changed: [localhost] => (item=devuser04)
changed: [localhost] => (item=devuser05)
changed: [localhost] => (item=devuser06)
changed: [localhost] => (item=devuser07)
changed: [localhost] => (item=devuser08)
changed: [localhost] => (item=devuser09)
changed: [localhost] => (item=devuser10)

TASK [Secret key files are copied] *************************************************************************************
changed: [localhost] => (item=devuser01)
changed: [localhost] => (item=devuser02)
changed: [localhost] => (item=devuser03)
changed: [localhost] => (item=devuser04)
changed: [localhost] => (item=devuser05)
changed: [localhost] => (item=devuser06)
changed: [localhost] => (item=devuser07)
changed: [localhost] => (item=devuser08)
changed: [localhost] => (item=devuser09)
changed: [localhost] => (item=devuser10)

PLAY RECAP *************************************************************************************************************
localhost                  : ok=6    changed=4    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
```

/tmpに秘密鍵が集約され、その秘密鍵でログインすることが出来るようになっています。

```
$ ls -l /tmp/id_rsa*
-rw-r--r-- 1 root root 3247 Apr 27 22:42 /tmp/id_rsa_devuser01
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser02
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser03
-rw-r--r-- 1 root root 3247 Apr 27 22:42 /tmp/id_rsa_devuser04
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser05
-rw-r--r-- 1 root root 3247 Apr 27 22:42 /tmp/id_rsa_devuser06
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser07
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser08
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser09
-rw-r--r-- 1 root root 3243 Apr 27 22:42 /tmp/id_rsa_devuser10
$ ssh -i /tmp/id_rsa_devuser01 devuser01@localhost
Last login: Mon Apr 27 22:46:46 2020 from ::1
$
```

以上です。さて、この秘密鍵をどう配りましょうか・・・