Here's a method I use to provision new Debian hosts without known ssh keys. Host needs to have
python-apt packages installed for this playbook to work out of the box. If you want to test it on a VM, you can run Debian installer with boot parameter
url=drybjed.github.io - installer will download a preseed file with
python-apt packages selected (among others). After installation, default password for root account will be
debian and you will be forced to change it upon first login.
After installation and first login:
- Make sure that you can ssh into the root@host using password (accept host fingerprint, etc.).
- ssh_user: $ENV(USER)
- name: INIT | Create admin system group
group: name=admins system=yes state=present
- name: INIT | Create admin account from current user
user: name=$ssh_user state=present shell=/bin/bash groups=admins
- name: INIT | Make sure essential software is installed
apt: pkg=$item state=latest install_recommends=no
- name: INIT | Install ssh public key from current account
authorized_key: user=$ssh_user key="$FILE(~/.ssh/id_rsa.pub)"
- name: INIT | Install sudoers file for admin accounts
lineinfile: "dest=/etc/sudoers.d/admins state=present create=yes regexp='^%admins' line='%admins ALL=(ALL:ALL) NOPASSWD: SETENV: ALL' owner=root group=root mode=0440"
Run Ansible with:
ansible-playbook -k -l host init.yml. Ansible will ask for root password, create a system
admins group with access to sudo, create an user account based on your current user, copy your
~/.ssh/id_rsa.pub to your new account, and add it to the
From now you can use Ansible through your user account using sudo.