51 lines
1.5 KiB
YAML
51 lines
1.5 KiB
YAML
---
|
||
# set_user_password.yml
|
||
#
|
||
# Sets a user's password and forces them to change it on next login.
|
||
#
|
||
# Usage:
|
||
# ansible-playbook set_user_password.yml \
|
||
# -i inventory.ini \
|
||
# -e "target_user=alice new_password=TempPass123!"
|
||
#
|
||
# Variables (pass with -e or define in vars/group_vars):
|
||
# target_user – the Linux username to configure (required)
|
||
# new_password – the plaintext temporary password (required)
|
||
|
||
- name: Set user password and force change on next login
|
||
hosts: all
|
||
become: true
|
||
|
||
vars:
|
||
target_user: "{{ target_user | mandatory }}"
|
||
new_password: "{{ new_password | mandatory }}"
|
||
|
||
tasks:
|
||
|
||
- name: Ensure the user account exists
|
||
ansible.builtin.user:
|
||
name: "{{ target_user }}"
|
||
state: present
|
||
shell: /bin/bash
|
||
|
||
- name: Set the user's password (hashed)
|
||
ansible.builtin.user:
|
||
name: "{{ target_user }}"
|
||
# password filter hashes the plaintext with SHA-512
|
||
password: "{{ new_password | password_hash('sha512') }}"
|
||
update_password: always
|
||
|
||
- name: Force password change on next login (chage -d 0)
|
||
ansible.builtin.command:
|
||
cmd: "chage -d 0 {{ target_user }}"
|
||
changed_when: true # chage always returns 0; mark as changed for clarity
|
||
|
||
- name: Verify password expiry settings
|
||
ansible.builtin.command:
|
||
cmd: "chage -l {{ target_user }}"
|
||
register: chage_output
|
||
changed_when: false
|
||
|
||
- name: Show password expiry info
|
||
ansible.builtin.debug:
|
||
var: chage_output.stdout_lines |