# Struggling with user accounts **URL:** \ **Category:** Ansible Project\ **Created:** [November 14, 2012, 9:00pm UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088 "2012-11-14T21:00:50Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Bruce1](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@Bruce1](https://forum.ansible.com/u/Bruce1)\ **Post date:** [November 14, 2012, 9:00pm UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/1 "2012-11-14T21:00:50Z")
I’m still trying to wrap my head around ansible in general and I guess I just don’t understand its structure fully yet. The very first thing I’m attempting to do is to create some user accounts across a group of servers. We have a handful of sysadmins who manage a group of servers, so I figured I could so something along these lines to define how we want an account created: tasks: -name: Add user ${username} action: command /bin/echo ${username} - name: Add/remove user ${username} action: user name=${username} comment=“${fullname}” uid=${uid} group=wheel shell=/bin/bash createhome=yes state=present - name: Add ssh key for ${username} action: authorized\_key user=${username} key=“$FILE(/ansible/conf/users/files/ssh-key.${username})” - name: Add user ${username} to nagios group on the util server only action: user name=${username} groups=nagios only\_if: “‘$facter\_hostname’== ‘util’” But then for the life of me I can’t figure out how to apply this playbook for each of the sets of username/fullname/uid that I need to create accounts for. Is this a good way of doing this sort of thing or am I completely missing the boat? -Bruce ---
**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\ **Post date:** [November 14, 2012, 9:25pm UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/2 "2012-11-14T21:25:54Z")
This is what I have... In an appropriate group\_vars file:- sysadmin\_users:   - username: fred     fullname: Fred Flintston     crypted\_pass: '$6$the\_rest\_of\_the\_password\_hash'     ssh\_pubkey: 'ssh-rsa ABCEF-ssh-key fred@localhost.localnet' removed\_sysadmin\_users:   - oldadmin   - somone Then in the tasks list (some bits have wrapped - sure you can work it out):- - name: ensure ${item.username} has an account   action: user name=${item.username} comment="${item.fullname}" password=${item.crypted\_pass} createhome=yes   with\_items: $sysadmin\_users - name: ensure ${item.username} has ssh keys   action: authorized\_key user=${item.username} key="name=${item.ssh\_pubkey}"   with\_items: $sysadmin\_users - name: ensure old sysadmin accounts are removed   action: user name=${item} state=absent remove=yes   with\_items: $removed\_sysadmin\_users - name: Build sudo config file   action: template src=templates/sudo/sudoers.j2 dest=/etc/sudoers.templated owner=root group=root mode=0440 - name: Move sudo config file into place   action: command /usr/bin/install --mode=0440 --owner=root --group=root /etc/sudoers.templated /etc/sudoers   only\_if: '${last\_result.changed}' ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [November 14, 2012, 9:37pm UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/3 "2012-11-14T21:37:43Z")
Nice Nigel! I would probably recommend explicitly setting the variable name in the "Build sudo config" step like: register: sudo\_result ... only\_if: ${sudo\_result.changed} just so that if you ever insert a step the 'last\_result' won't throw you. ---
**Author:** ![Romeo\_Theriault](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@Romeo\_Theriault](https://forum.ansible.com/u/Romeo_Theriault)\ **Post date:** [November 15, 2012, 1:46am UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/4 "2012-11-15T01:46:06Z")
Thanks for posting this, I find it useful as well. I don't understand why you have separate steps of building sudo and installing it though. Why do you do that? Does it have something to do with ansible using sudo and it could potentially mess up your ansible session? Thanks, ---
**Author:** ![jpmens1](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@jpmens1](https://forum.ansible.com/u/jpmens1)\ **Post date:** [November 15, 2012, 5:56am UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/5 "2012-11-15T05:56:08Z")
Nigel, > removed\_sysadmin\_users: >   - oldadmin >   - somone [...] > - name: ensure old sysadmin accounts are removed >   action: user name=${item} state=absent remove=yes >   with\_items: $removed\_sysadmin\_users Very nice! > sysadmin\_users: >     fullname: Fred Flintston You misspelled his surname. 😉         -JP ---
**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\ **Post date:** [November 15, 2012, 8:16am UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/6 "2012-11-15T08:16:56Z")
Would this work when splitting out this yaml list over more than one group file? I was also wondering how register variables would work out when using with\_items? Serge ---
**Author:** ![Nigel\_Metheringham](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@Nigel\_Metheringham](https://forum.ansible.com/u/Nigel_Metheringham)\ **Post date:** [November 15, 2012, 9:01am UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/7 "2012-11-15T09:01:12Z")
Romeo Theriault wrote: > Thanks for posting this, I find it useful as well. I don't understand > why you have separate steps of building sudo and installing it though. > Why do you do that? Does it have something to do with ansible using > sudo and it could potentially mess up your ansible session? I believe the issue I was working around has been fixed in ansible now (as in 0.9), but it has been the case that templating/copying a file into place with ansible has been a two (or more) stage operation where the file is put into place, and then (in a separate sudo invocation) the file has its permissions set. For sudoers this meant the permissions were wrong on the file at the time of invocation of the permissions setting stage, which meant you were locked out of the system - which is sorta embarrassing! Hence templating it into a different file and then an atomic operation to put it in place with the correct permissions. Michael also picked up on my use of last\_result in that stage - which no longer works as written in 0.8. Unfortunately the copy in my laptop git repo didn't have the most recent changes on it - but the only thing I had done was add a 'register: last\_result' to the template action, which is the bare minimum to make it work. The general rule of course is to be \*very\* careful when playing with sudoers - and make sure you test the case where you actually update it because it can be a nasty surprise when it goes pear shaped. Thankfully I am only working on our dev network, but plans are well underway for a slow roll out on production.   Nigel. ---
**Author:** ![Bruce1](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@Bruce1](https://forum.ansible.com/u/Bruce1)\ **Post date:** [November 15, 2012, 8:00pm UTC](https://forum.ansible.com/t/struggling-with-user-accounts/12088/8 "2012-11-15T20:00:25Z")
Thanks so much! This is exactly the sort of thing I was looking for and gives me a much better understanding of the right way to work with ansible. -Bruce