Ansible Create Users

This tutorial will guide you through the process of creating and managing users on remote systems using Ansible. You’ll learn how to write playbooks, handle user permissions, and automate user management tasks in real-world scenarios.

Beginner30 minutes

Step 1: Step 1: Install Ansible and Set Up Your Environment

Before creating users, ensure Ansible is installed and your environment is configured. Install Ansible using your package manager (e.g., apt, yum, or pip). Then, create an inventory file to define your target hosts.

Key Concepts:

- Installing Ansible

- Inventory files

- SSH access to remote hosts

# Install Ansible on Ubuntu
sudo apt update
sudo apt install ansible

# Create an inventory file
cat > inventory <<EOF
[webservers]
192.168.1.10
192.168.1.11
EOF

Practice Exercise

Install Ansible on a CentOS system and create an inventory file with two groups: webservers and dbservers. Include at least one host in each group.

Show Solution

# Install Ansible on CentOS
sudo yum install epel-release
sudo yum install ansible

# Create an inventory file
cat > inventory <<EOF
[webservers]
192.168.1.10

[dbservers]
192.168.1.20
EOF

Step 2: Step 2: Write a Basic Playbook to Create a User

Ansible uses playbooks to define tasks. Write a playbook that creates a user on remote hosts using the user module.

Key Concepts:

- Playbook structure

- The user module

- Running playbooks

# create_user.yml
- name: Create a new user
  hosts: webservers
  become: yes
  tasks:
    - name: Add user 'john'
      ansible.builtin.user:
        name: john
        state: present

Practice Exercise

Write a playbook to create a user named alice on the dbservers group. Ensure the user has a home directory and a default shell of /bin/bash.

Show Solution

# create_alice.yml
- name: Create user alice
  hosts: dbservers
  become: yes
  tasks:
    - name: Add user 'alice'
      ansible.builtin.user:
        name: alice
        state: present
        shell: /bin/bash
        create_home: yes

Step 3: Step 3: Set User Passwords and SSH Keys

Secure user accounts by setting passwords or adding SSH keys. Use the password parameter or the ssh_key module.

Key Concepts:

- Password hashing

- SSH key management

# set_password.yml
- name: Set password for user 'john'
  hosts: webservers
  become: yes
  tasks:
    - name: Set password
      ansible.builtin.user:
        name: john
        password: '{{ "mypassword" | password_hash("sha512") }}'

Practice Exercise

Create a playbook to add an SSH key for user alice from a local file alice_id_rsa.pub. Ensure the key is added to the correct user's authorized_keys file.

Show Solution

# add_ssh_key.yml
- name: Add SSH key for alice
  hosts: dbservers
  become: yes
  tasks:
    - name: Copy SSH key
      ansible.builtin.copy:
        src: alice_id_rsa.pub
        dest: /home/alice/.ssh/authorized_keys
        owner: alice
        group: alice
        mode: '0600'

Step 4: Step 4: Manage User Groups and Permissions

Assign users to groups and manage permissions. Use the group and user modules to add users to groups or set sudo privileges.

Key Concepts:

- Group management

- Sudo permissions

# manage_groups.yml
- name: Add user to sudo group
  hosts: webservers
  become: yes
  tasks:
    - name: Add user 'john' to sudo group
      ansible.builtin.user:
        name: john
        groups: sudo
        append: yes

Practice Exercise

Write a playbook to create a group developers and add users alice and john to it. Ensure the group has sudo privileges.

Show Solution

# create_developers_group.yml
- name: Create developers group
 hosts: all
 become: yes
 tasks:
 - name: Create group 'developers'
 ansible.builtin.group:
 name: developers
 state: present

 - name: Add users to developers group
 ansible.builtin.user:
 name: '{{ item }}'
 groups: developers
 append: yes
 loop:
 - alice
 - john

 - name: Grant sudo access to developers
 ansible.builtin.lineinfile:
 path: /etc/sudoers
 line: 'velopers ALL=(ALL) NOPASSWD: ALL'
 validate: 'visudo -cf %s'

Step 5: Step 5: Automate User Creation with Variables

Use variables to make your playbooks reusable. Define user details in a variables file or pass them as extra vars.

Key Concepts:

- Variables in playbooks

- Reusable playbooks

# vars.yml
users:
  - name: alice
    shell: /bin/bash
  - name: bob
    shell: /bin/zsh

# create_users.yml
- name: Create multiple users
  hosts: all
  become: yes
  vars_files:
    - vars.yml
  tasks:
    - name: Create users
      ansible.builtin.user:
        name: '{{ item.name }}'
        shell: '{{ item.shell }}'
      loop: '{{ users }}'

Practice Exercise

Create a playbook that reads user details from a file users_list.yml and creates the users. Include at least three users with different shells and home directories.

Show Solution

# users_list.yml
users:
  - name: carol
    shell: /bin/bash
    home: /home/carol
  - name: dave
    shell: /bin/zsh
    home: /home/dave
  - name: eve
    shell: /bin/fish
    home: /home/eve

# create_users_from_file.yml
- name: Create users from file
  hosts: all
  become: yes
  vars_files:
    - users_list.yml
  tasks:
    - name: Create users
      ansible.builtin.user:
        name: '{{ item.name }}'
        shell: '{{ item.shell }}'
        home: '{{ item.home }}'
        create_home: yes
      loop: '{{ users }}'

Step 6: Step 6: Handle User Removal and State Management

Learn how to remove users or ensure they are absent using the state parameter in the user module.

Key Concepts:

- User removal

- Idempotency

# remove_user.yml
- name: Remove user 'john'
  hosts: webservers
  become: yes
  tasks:
    - name: Delete user 'john'
      ansible.builtin.user:
        name: john
        state: absent
        remove: yes

Practice Exercise

Write a playbook to remove users alice and bob from all hosts. Ensure their home directories are also deleted.

Show Solution

# remove_users.yml
- name: Remove users alice and bob
  hosts: all
  become: yes
  tasks:
    - name: Delete users
      ansible.builtin.user:
        name: '{{ item }}'
        state: absent
        remove: yes
      loop:
        - alice
        - bob

Step 7: Step 7: Test and Debug Your Playbooks

Use Ansible's built-in tools to test and debug your playbooks. Check syntax, run in dry-run mode, and use verbose output.

Key Concepts:

- Playbook testing

- Debugging techniques

# Check playbook syntax
ansible-playbook create_user.yml --syntax-check

# Run in dry-run mode
ansible-playbook create_user.yml --check

# Run with verbose output
ansible-playbook create_user.yml -vvv

Practice Exercise

Write a playbook to create a user testuser and test it using dry-run mode. Then, run it with verbose output to observe the execution steps.

Show Solution

# test_playbook.yml
- name: Create test user
  hosts: all
  become: yes
  tasks:
    - name: Add user 'testuser'
      ansible.builtin.user:
        name: testuser
        state: present

# Dry-run command
ansible-playbook test_playbook.yml --check

# Verbose command
ansible-playbook test_playbook.yml -vvv

Step 8: Step 8: Advanced Scenario - Conditional User Creation

Use conditionals to create users only if certain conditions are met, such as the existence of a file or a specific OS version.

Key Concepts:

- Conditionals in Ansible

- Advanced playbook logic

# conditional_user.yml
- name: Create user if file exists
  hosts: webservers
  become: yes
  tasks:
    - name: Check if file exists
      ansible.builtin.stat:
        path: /tmp/flag_file
      register: file_stat

    - name: Create user 'flaguser'
      ansible.builtin.user:
        name: flaguser
        state: present
      when: file_stat.stat.exists

Practice Exercise

Write a playbook to create a user backupuser only if the host is running Ubuntu 20.04. Use conditionals to check the OS version.

Show Solution

# conditional_backupuser.yml
- name: Create backupuser on Ubuntu 20.04
  hosts: all
  become: yes
  tasks:
    - name: Check OS version
      ansible.builtin.shell: lsb_release -d
      register: os_info

    - name: Create user 'backupuser'
      ansible.builtin.user:
        name: backupuser
        state: present
      when: '"Ubuntu 20.04" in os_info.stdout'