{"id":14984450,"url":"https://github.com/ryandaniels/ansible-role-create-users","last_synced_at":"2026-01-28T20:15:58.477Z","repository":{"id":46195387,"uuid":"81905926","full_name":"ryandaniels/ansible-role-create-users","owner":"ryandaniels","description":"Manage users on Linux using Ansible","archived":false,"fork":false,"pushed_at":"2025-02-20T03:49:53.000Z","size":63,"stargazers_count":107,"open_issues_count":3,"forks_count":58,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-05-24T22:06:01.595Z","etag":null,"topics":["ansible","ansible-role"],"latest_commit_sha":null,"homepage":"https://galaxy.ansible.com/ryandaniels/create_users","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ryandaniels.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2017-02-14T04:44:55.000Z","updated_at":"2025-05-22T16:40:01.000Z","dependencies_parsed_at":"2024-06-06T02:30:03.127Z","dependency_job_id":"1265e22b-e170-483a-ad1f-78699fa3ebd1","html_url":"https://github.com/ryandaniels/ansible-role-create-users","commit_stats":{"total_commits":73,"total_committers":6,"mean_commits":"12.166666666666666","dds":0.0821917808219178,"last_synced_commit":"75b21a872284773352d3d021d7533b739246bb5f"},"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"purl":"pkg:github/ryandaniels/ansible-role-create-users","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryandaniels%2Fansible-role-create-users","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryandaniels%2Fansible-role-create-users/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryandaniels%2Fansible-role-create-users/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryandaniels%2Fansible-role-create-users/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ryandaniels","download_url":"https://codeload.github.com/ryandaniels/ansible-role-create-users/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryandaniels%2Fansible-role-create-users/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28850492,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-28T15:15:36.453Z","status":"ssl_error","status_checked_at":"2026-01-28T15:15:13.020Z","response_time":57,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role"],"created_at":"2024-09-24T14:09:04.917Z","updated_at":"2026-01-28T20:15:58.447Z","avatar_url":"https://github.com/ryandaniels.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# ansible-role-create-users\n\n[![CI](https://github.com/ryandaniels/ansible-role-create-users/workflows/CI/badge.svg)](https://github.com/ryandaniels/ansible-role-create-users/actions?query=workflow%3ACI)\n\nRole to manage users on linux.  \nManage users in the user list config file (list is in the file vars/secret).  \nAdd users (with specific uid), change passwords, lock/unlock user accounts, manage sudo access (per user), add ssh key(s) for sshkey based authentication, set user's primary group and gid, add user (append) to group(s) and group will be created if doesn't exist.  \nThis is done on a per \"group\" basis (Ansible group variables), as set in the config file. The group comes from the Ansible group as set for a server in the inventory file.  \n  `all` is also supported to apply to every host in an inventory file.  \n  Special variable `inventory_hostname` is also supported to apply to just one server in an inventory file.  \n\nMore detailed example can be found in the blog post: [User Management with Ansible](https://ryandaniels.ca/blog/ansible-user-management/)  \n\nNote: Deleting users is not done on purpose.  \n\n## Distros tested\n\n* Ubuntu 24.04, 22.04, 20.04, 18.04, 16.04\n* CentOS / RHEL: 9.1, 8.x, 7.x, 6.5, 5.9\n\n## Dependencies\n\nRequires Ansible \u003e2.9. Test on Ansible 2.16 (versions of this Ansible Role `\u003e=v2`).  \nIf Ansible 2.9 is required, the branch `ansible29` still works (versions of this Ansible Role `\u003cv2`).  \n\n## ansible-vault\n\nUse ansible-vault to encrypt sensitive info from git.\n\n```bash\ncat vars/secret\n#encrypt if cleartext (before git commit/push)\nansible-vault encrypt vars/secret\n\n#Edit encrypted file:\nansible-vault edit vars/secret\n\nvi .vaultpass\n-Enter the password for Ansible Vault from Password Safe\nchmod 600 .vaultpass\nvi ansible.cfg\n#Insert the following lines\n[defaults]\nvault_password_file = ./.vaultpass\n```\n\n## .gitignore\n\n```bash\nvi .gitignore\n#Insert the following lines\n.vaultpass\n.retry\nsecret\n*.secret\n```\n\n## How to generate password\n\n* on Ubuntu - Install \"whois\" package\n\n```bash\nmkpasswd --method=SHA-512\n```\n\n* on RedHat - Use Python\n\n```bash\npython -c 'import crypt,getpass; print(crypt.crypt(getpass.getpass(), crypt.mksalt(crypt.METHOD_SHA512)))'\n```\n\n## Default Settings\n\n```yaml\n---\n# Note: 'debug_enabled_default: true' will put hashed passwords in the output.\ndebug_enabled_default: false\ndefault_update_password: on_create\ndefault_shell: /bin/bash\ndefault_generate_ssh_key_comment: \"{{ item.username }}@{{ ansible_hostname }}\"\n```\n\n## User Settings\n\nFile Location: vars/secret\n\n* **username**: username - no spaces **(required)**\n* **uid**: The numerical value of the user's ID (optional)\n* **user_state**: present|lock **(required)**\n* **password**: sha512 encrypted password (optional). If not set, password is set to \"!\"\n* **update_password**: always|on_create (optional, default is on_create to be safe).  \n  **WARNING**: when 'always', password will be change to password value.  \n  If you are using 'always' on an **existing** users, **make sure to have the password set**.\n* **comment**: Full name and Department or description of application (optional) (But you should set this!)\n* **primarygroup**: Primary group name (optional).\n* **primarygid**: Primary group ID (optional). If same gid is reused on server the playbook will fail. If same duplicate group is specified with different gid, last configured will be used.\n  **WARNING**: changing the primarygroup and/or primarygid of **existing** users will not change permissions of existing files belonging to that user. Also old entries will remain in /etc/group. Use with caution.\n* **groups**: Comma separated list of groups the user will be added to (appended). If group doesn't exist it will be created on the specific server. This is not the primary group (primary group is not modified)\n* **shell**: path to shell (optional, default is /bin/bash)\n* **ssh_key**: Add authorized ssh key for ssh key based authentication (optional)  \n  NOTE: 1 key can go on single line, but if multiple keys, use formatting below from first example.\n* **exclusive_ssh_key**: yes|no (optional, default: no)  \n  **WARNING**: exclusive_ssh_key: yes - will remove any ssh keys not defined here! no - will add any key specified.\n* **generate_ssh_key**: Whether to generate a SSH key for the user in question. (optional, default is 'no')  \n  NOTE: This will not overwrite an existing SSH key\n* **ssh_key_bits**: Optionally specify number of bits in SSH key to create. (optional, default set by ssh-keygen)\n* **ssh_key_passphrase**: Set a passphrase for the SSH key. If no passphrase is provided, the SSH key will default to having no passphrase.\n* **generate_ssh_key_comment**: Specify the comment for the generated SSH key (optional). If not specified, will use default_generate_ssh_key_comment from defaults yaml.\n* **use_sudo**: yes|no (optional, default no)\n* **use_sudo_nopass**: yes|no (optional, default no). yes = passwordless sudo.\n* **system**: yes|no (optional, default no). yes = create system account (uid \u003c 1000). Does not work on existing users.\n* **servers**: sub-element list of servers where changes are made. **(required)**  \n  These are the Ansible groups from your Ansible inventory file. In below examples, `webserver` would be the 3 servers in the `webserver` Ansible inventory `webserver1`, `webserver2`, and `webserver3`.  \n\nNote:\n  You can have duplicate usernames on different servers, if you want to have different settings. See below example of testuser102 has sudo on servers defined as the `webserver` group in the inventory, but no sudo on the `database` group.\n\n## Example Ansible Inventory file\n\n```yaml\n[webserver]\nwebserver1\nwebserver2\nwebserver3\n\n[database]\ndb1\ndb2\ndb3\n\n[monitoring]\nmonitor1\n```\n\n## Example config file (vars/secret)\n\n```yaml\n---\nusers:\n  - username: testuser101\n    password: $6$/y5RGZnFaD3f$96xVdOAnldEtSxivDY02h.DwPTrJgGQl8/MTRRrFAwKTYbFymeKH/1Rxd3k.RQfpgebM6amLK3xAaycybdc.60\n    update_password: on_create\n    comment: Test User 100\n    shell: /bin/bash\n    ssh_key: |\n      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx8crAHG/a9QBD4zO0ZHIjdRXy+ySKviXVCMIJ3/NMIAAzDyIsPKToUJmIApHHHF1/hBllqzBSkPEMwgFbXjyqTeVPHF8V0iq41n0kgbulJG testuser101@server1\n      ssh-rsa AAAA.... testuser101@server2\n    exclusive_ssh_key: yes\n    use_sudo: no\n    use_sudo_nopass: no\n    user_state: present\n    servers:\n      - webserver\n      - database\n      - monitoring\n\n  - username: testuser102\n    password: $6$F/KXFzMa$ZIDqtYtM6sOC3UmRntVsTcy1rnsvw.6tBquOhX7Sb26jxskXpve8l6DYsQyI1FT8N5I5cL0YkzW7bLbSCMtUw1\n    update_password: always\n    comment: Test User 101\n    groups: testcommon, testgroup102web\n    shell: /bin/sh\n    use_sudo: yes\n    user_state: present\n    servers:\n      - webserver\n      - all\n\n  - username: testuser102\n    password: $6$F/KXFzMa$ZIDqtYtM6sOC3UmRntVsTcy1rnsvw.6tBquOhX7Sb26jxskXpve8l6DYsQyI1FT8N5I5cL0YkzW7bLbSCMtUw1\n    update_password: always\n    comment: Test User 101\n    groups: testcommon, testgroup102db\n    shell: /bin/sh\n    user_state: present\n    servers:\n      - database\n\n  - username: testuser103\n    password: $6$wBxBAqRmG6O$gPbg9hYShkuIe3YKMFujwiKsPKZHNFwoK4yCyTOlploljz53YSoPdCn9P5k8Qm0z062Q.8hvJ6DnnQQjwtrnS0\n    user_state: present\n    servers:\n      - webserver\n\n  - username: testuser104\n    primarygroup: testgroup104primary\n    ssh_key: ssh-rsa AAAB.... test103@server\n    exclusive_ssh_key: no\n    generate_ssh_key: yes\n    generate_ssh_key_comment: custom comment for generated ssh key\n    use_sudo: no\n    user_state: present\n    servers:\n      - webserver\n      - monitoring\n\n  - username: testuser105\n    uid: 1099\n    password: $6$XEnyI5UYSw$Rlc6tXtECtqdJ3uFitrbBlec1/8Fx2obfgFST419ntJqaX8sfPQ9xR7vj7dGhQsfX8zcSX3tumzR7/vwlIH6p/\n    primarygroup: testgroup105primary\n    primarygid: 2222\n    ssh_key: ssh-rsa AAAB.... test107@server\n    generate_ssh_key: yes\n    ssh_key_bits: 4096\n    use_sudo: no\n    user_state: lock\n    servers:\n      - webserver\n      - database\n```\n\n## Example Playbook create-users.yml\n\n```bash\n---\n- hosts: '{{inventory}}'\n  vars_files:\n    - vars/secret\n  become: yes\n  roles:\n  - create-users\n```\n\n## Prep\n\n* install ansible\n* create keys\n* ssh to client to add entry to known_hosts file\n* configure client server authorized_keys\n* run ansible commands\n\n## Usage\n\nCreate all users\n\n```bash\nansible-playbook create-users.yml --ask-vault-pass --extra-vars \"inventory=all-dev\" -i hosts\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryandaniels%2Fansible-role-create-users","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fryandaniels%2Fansible-role-create-users","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryandaniels%2Fansible-role-create-users/lists"}